{ "Event": { "published": true, "date": "2021-03-19", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-03-19", "timestamp": 1616198581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "2a85d05a-03fc-403c-8bf9-4dcc9f4de264", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c35826bd-8902-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1616193052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616193052, "uuid": "875dcb7c-e657-468d-b8ea-82e46a748aa1", "comment": "Malware payload (TrickBot)", "value": "0f342e64cf48ef4b6131f7c2f1244f70", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616193052, "uuid": "78e7a418-774a-4266-8f76-fe26e5fcd5de", "comment": "Malware payload (TrickBot)", "value": "038d131f77ce33aa98935bef9318d310ec141e3c0db0b84e4b4679d8a6665151", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616193052, "uuid": "ae027bb9-d4fa-4fe5-b7f3-5f2326d39337", "comment": "Malware payload (TrickBot)", "value": "b22193c588a53be3a69bf939dafa6df3d6b82776", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616193052, "uuid": "2e6da6e6-827a-4529-82bc-afcd47016efa", "comment": "Malware payload (TrickBot)", "value": "18b9233ea4e242d9f38e0c55e2220560ebabd125920a58c955e6d4eac2b9d0714dfd27fea4064bd5c2dee655f8226158", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616193052, "uuid": "3b38f795-2a18-4b4a-ab4c-c0d18f4de279", "value": "9CB4D032F654444EC9E917FB6C95BFC3E03DA38D6F221393B96C099DC6608B14649793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616193052, "uuid": "e9f477f5-7582-4459-a4f3-3a80b30b22dc", "value": "f85662bbdd9a91bfc7b40b98b12d4ad8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616193052, "uuid": "4908145d-b06c-4967-ab88-850203722565", "value": "6144:/gWc0bBIikmQ2MfZu3rxY11eUaykSbahi4bnXt6/aJaETCPy77jRUufqAsd+s//L:9dbqvmQi1Y11uAbh89E0aBs1ylkB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616193052, "uuid": "623aa860-3449-4f1b-85f4-25a0adb4113f", "value": 506368, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616193052, "uuid": "c5a04868-7255-4393-9815-8406068b4fb0", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616193052, "uuid": "479d5369-a5ac-40dd-9158-2522667fac79", "value": "SecuriteInfo.com.Variant.Zusy.371743.25402.7889", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c99ea3-88a7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616153682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616153682, "uuid": "434689d5-0575-4a89-a53b-5be9f7df4fe3", "comment": "Malware payload (Dridex)", "value": "9678381429c61c25993b160c96ec250f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616153682, "uuid": "934ce2b7-5dab-4f39-9cea-202416f3242b", "comment": "Malware payload (Dridex)", "value": "03da5c7a4ed0c3c9491e33668eada57cf50bc374497092df43cdc9491a1e5027", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616153682, "uuid": "5c6d26f9-b9e2-457f-b9a6-2e274371af87", "comment": "Malware payload (Dridex)", "value": "d79b8acc63a530b94076a5b524debe52d723499a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616153682, "uuid": "66464295-24b9-459c-be44-9aef23a0d5c2", "comment": "Malware payload (Dridex)", "value": "703eae884c66e9d161a98f9db7985cffa29f5a74ae83d34397a844cb6c58db5f43517b193705fe797f4d6a6939a27612", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616153682, "uuid": "6030f35f-7ffc-4f8d-aa7d-4a6e846cdfef", "value": "3424CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616153682, "uuid": "07acb92f-f840-4856-bd05-c97dbd269b0a", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616153682, "uuid": "755a2e03-b4c9-479f-9ef0-261d806d6cb0", "value": "3072:Q9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:Q9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616153682, "uuid": "d34273f1-857c-451e-b915-c22180e3bd2f", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616153682, "uuid": "cf2d9e20-94d8-43bb-8e4f-5a04692a1916", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616153682, "uuid": "4365c021-002a-4ab7-9b28-7322051f88b9", "value": "03da5c7a4ed0c3c9491e33668eada57cf50bc374497092df43cdc9491a1e5027", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9334d915-88d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616175362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175362, "uuid": "ab537dcc-ae8e-4d22-a3db-39312cf8d47c", "comment": "Malware payload (AgentTesla)", "value": "b1eb2519ebfb922c1e3b3b241c07c1d7", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175362, "uuid": "26ccc174-f452-452a-bc65-c56e048511a4", "comment": "Malware payload (AgentTesla)", "value": "0459f81ac859d2b6e854e2bbfcd3313e36ace4d2390d38af33ce8d3b55ac3147", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175362, "uuid": "2ca4ae5e-fec9-4437-a718-e350d737f829", "comment": "Malware payload (AgentTesla)", "value": "fa8ebe1e9079c344552e631f8e7404625a717981", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175362, "uuid": "83653d70-2d77-4ccd-8cfb-fdf11b1305f8", "comment": "Malware payload (AgentTesla)", "value": "7204b7dde94f1a46958e1d9fcfa0ae1173aaf183a52c22d2a9f5636aa5c4733b63d403f58a50f9277b95c6e5dfd15bc8", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616175362, "uuid": "000cc8f8-971d-41eb-b8e0-82010df4c7fe", "value": "91E42399DDB6C3D6359A761FD8EEAB2D400C6BEC9CA1AC0BE5DD0464C5AFC4C49CB140", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616175362, "uuid": "3c13ac9d-e8c4-479b-935c-9d31becec8ac", "value": "12288:KH24pIMe0kwTNV9lLRsB7f8VgZ+Ymzyur4sAhUNMcN8upBRAxHf:KLde0kQPTsBf8VgIF2xLyMjuXRAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616175362, "uuid": "e1dcc031-fccb-4d2d-bbc2-dbadeb2898fe", "value": 675629, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616175362, "uuid": "e8bb4ed4-1240-44cd-8d4f-cfdfa1e0c860", "value": "application/x-7z-compressed", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616175362, "uuid": "c10f682f-8ca5-442a-acef-f4e06044fd2e", "value": "PO NO-278 HAC.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca5e747-88c9-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1616168479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616168479, "uuid": "fc2fad27-fe2c-4972-91d1-81d4a8c5fd0a", "comment": "Malware payload (TrickBot)", "value": "d17e780a23c19a5ce5c2a0d4abc19b55", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616168479, "uuid": "0427e317-8f62-4e01-908c-a16ac4e249ed", "comment": "Malware payload (TrickBot)", "value": "056809e596895320397378f7f3ff4958107e48f4890a960229dcfbc32b7379b7", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616168479, "uuid": "324621bf-6277-4ccf-b39a-088eddf1c87c", "comment": "Malware payload (TrickBot)", "value": "d3d73e9f08cb6d880dc163149d352a197dac7300", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616168479, "uuid": "6224f086-b799-4e7d-8977-2ddd5628adc6", "comment": "Malware payload (TrickBot)", "value": "0da1c77d954489af534c1a1e3268e72886652a67b0842d5f9fb539303de58f31897b2e580af6e510d3f830d0f1a69479", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616168479, "uuid": "2db310cd-5822-49e2-9958-67d86dcbab6d", "value": "C464F039F7D7EB05CB8B227D06BCBC772B5511C255C1A007299B2E41A294FB26B9B03D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616168479, "uuid": "c6295ff3-f069-4486-b6ee-314ca99e6ad3", "value": "6144:XO6KetSlq9SObQ6TJHhSWtogHp8G0Y6IR8/Iptq0um6F4eOCJe0cj:XOWRSObQEhSh0AT+Hu0umM4e9e0cj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616168479, "uuid": "42800dc5-ea3a-4862-a006-8775d6ce4d0d", "value": 336272, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616168479, "uuid": "b964b64e-040f-4012-b658-42e0df2c7719", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616168479, "uuid": "eb0a5ad2-a606-46db-aa93-432a3c86ddf6", "value": "subscription_1616167805.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ab41c4-88f9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616188868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616188868, "uuid": "da6b6fb5-4ae6-4fed-bb9c-aa5de8772fb4", "comment": "Malware payload", "value": "0df51691bab2d7a78a62b4a9061038b5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616188868, "uuid": "a838273a-3146-4933-8d60-c2363515ec93", "comment": "Malware payload", "value": "067214777dd2d3abc9be52dd91b1bfec401188f0898f85b15d72caac19fb9331", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616188868, "uuid": "e3555472-819a-47d8-8cde-e805deb6d416", "comment": "Malware payload", "value": "888b1af1771183831d41b8400e8ccf60f5f13a34", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616188868, "uuid": "4dbff7f7-7263-4c8a-8468-97e833d62086", "comment": "Malware payload", "value": "9db55bc48fd345fc44a599f3676a3c435d402895c11473e53b37f231eb5384695cdef8b9fc77021b8e4f228a34d8d24a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616188868, "uuid": "83f4dc94-e357-4ae4-af7d-22c3151b4500", "value": "FE14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01E124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616188868, "uuid": "68521038-aabc-4fce-bee1-6474c86c4966", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616188868, "uuid": "87344f97-4db2-4809-b88c-1a8629a2a2da", "value": "3072:A1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:8i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616188868, "uuid": "0d6bda66-0ce8-484a-9593-8510ce57e96a", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616188868, "uuid": "069da21e-81b1-455e-9a92-489d8e05eadb", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616188868, "uuid": "ce643c71-eb63-459a-9ad2-93c4a8e12bb5", "value": "067214777dd2d3abc9be52dd91b1bfec401188f0898f85b15d72caac19fb9331", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca3e31cc-887b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1616135082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616135082, "uuid": "bd619f45-02f7-46bd-951a-f551e22701ed", "comment": "Malware payload (Formbook)", "value": "f40730763576727cc6bd8e4119e58b47", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616135082, "uuid": "0f50a2f8-347e-4312-b1e3-afeebfa4a6e9", "comment": "Malware payload (Formbook)", "value": "07acb4e52279a36822b1f3b72ded18552bd08366747db1c71ec2f7b6cd822f3a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616135082, "uuid": "4ee71b0e-d3c1-42c0-aec5-05c8f759b72a", "comment": "Malware payload (Formbook)", "value": "64cc1507584c0c3479c99e17009d15d8a284cea9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616135082, "uuid": "234aebdb-97c5-47f1-bd36-8964cef097bc", "comment": "Malware payload (Formbook)", "value": "403f1d1df77af90aed33a56c6536f9c3fd85621a7ead8cbca00c532be0a9e95a9158b9f778e567288049d206122f1e47", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616135082, "uuid": "df0b567d-6625-4125-9b4b-84cf551f9788", "value": "1CB4232716D4882B08F983B8D52344E1E29AF4430486EDBDFE5B1E56D60476F52AFEC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616135082, "uuid": "a94cc4c8-52cf-4231-8fd2-2624d604c23b", "value": "12288:z90QpDulCc3QB8yWnzXd3KXrhdSUiLY6hF1JWDF1BpaJf86FWROh:J0QpsD3QBgTtEbZ4FJ+BpsB8ROh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616135082, "uuid": "317fb8e4-54f3-4c9c-b49e-a9b886cb0141", "value": 512011, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616135082, "uuid": "fc94396f-b825-430f-9d9c-7e4452866ffc", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616135082, "uuid": "a22771e2-7fd0-40f6-b03d-c698903dbb9f", "value": "PO _ETPO.21.0419.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2119a2d6-88fb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616189773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616189773, "uuid": "ff832ed5-df60-4ff9-996d-30768958d8e4", "comment": "Malware payload", "value": "14009c2832a68072551cc160fe36d5a8", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616189773, "uuid": "b29663bb-c0f4-4b08-ae75-414d1306f470", "comment": "Malware payload", "value": "08630517aa83eae76837e6f36065e2d2e2a2b6a02817c2c7cfb274144907bbb4", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616189773, "uuid": "189a0151-749b-4ddc-b50b-81f11956c732", "comment": "Malware payload", "value": "e32d2c70a109ca1572bcb0307638eff9fb1892fc", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616189773, "uuid": "e216008f-9535-4cc7-a963-823604a6fb4a", "comment": "Malware payload", "value": "47955e6623294e177ecbba2f12a64f6d0366d4e5f2f322549a78b4a50107fb08b62fc081d9cd43d6c7dd4e349508a967", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616189773, "uuid": "2b1eee01-0d97-4f10-937f-ecd7340ca69a", "value": "E124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616189773, "uuid": "747ff5b9-14df-4b3c-8eb1-1bd29042671a", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616189773, "uuid": "095c34fe-aab3-44e1-a8c3-970284bf6167", "value": "3072:v9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:v9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616189773, "uuid": "1e3326f8-5048-45f3-961d-b9c53dec7250", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616189773, "uuid": "9596c50f-3620-434b-8d3c-d27acdbb5d03", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616189773, "uuid": "8afb153a-8888-408e-9084-9c81f3964e40", "value": "08630517aa83eae76837e6f36065e2d2e2a2b6a02817c2c7cfb274144907bbb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf907f00-887b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1616135090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616135090, "uuid": "92eb3e7d-e0ff-4788-a3af-772115ebf686", "comment": "Malware payload (Formbook)", "value": "08cecdc03dce030c14621361e69041d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616135090, "uuid": "da634601-a21a-45b3-af81-cba0e32d1c24", "comment": "Malware payload (Formbook)", "value": "08c17f992720bb732bf204de0e7767632995bca8a0072e6217f8ffe1c17e3d00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616135090, "uuid": "b73d46dc-07c7-4bed-b27b-e359269218da", "comment": "Malware payload (Formbook)", "value": "b5c741307c06dedccac5f8214725d861f6db1c5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616135090, "uuid": "b84cbfa6-545e-4ec3-a4a2-10133230d5df", "comment": "Malware payload (Formbook)", "value": "df040d75daaa6311accf3cf0ddb916db27ed3eba2389f1c1470c4f4763f191c7e9a9c17efb3a53ad1c63d3b66c3e16a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616135090, "uuid": "8aff75c6-d35b-447c-8e6e-234b59ff5c81", "value": "A1E4C0A63744EB0DCE354F79D4522800F3E0D6F68117EA976E9208D94A4D7ED8EE72C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616135090, "uuid": "b260571d-db6e-4a97-9d03-6953887eeab2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616135090, "uuid": "de3e1428-6ea7-4406-bcaa-6691797330eb", "value": "12288:QyZNgqumRPhAN3BU9bi/wl8AWnzzdbKXpRtUOiLY6fFRbgDFxfpa/fi4CLSiUWiF:ZHJRPhANRU9OkSnF4HL43bWfpe3USi+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616135090, "uuid": "cfbd412a-3be6-4648-9d62-16b764641c60", "value": 671744, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616135090, "uuid": "0ad1ce9d-2caa-44fa-ac2e-c497079a4533", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616135090, "uuid": "e804532e-c6dc-40a5-824f-c82bd0c64e6c", "value": "PO _ETPO.21.0419.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b744013c-88e1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616178858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616178858, "uuid": "5e5b7511-253d-40ec-b2f4-a6a9b116fcee", "comment": "Malware payload", "value": "88ac04e653225cfb13f5611ed87a130a", "object_relation": "md5", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616178858, "uuid": "c8941d70-05b7-4df7-b7b3-d3d508688fc1", "comment": "Malware payload", "value": "09f2e3658cbc40c948b56017608af5316b0ff94ea3d632a3c977152eedd24aad", "object_relation": "sha256", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616178858, "uuid": "d9c27214-d86a-4c2c-8154-41661e259544", "comment": "Malware payload", "value": "aeb98e3ecd75ef419355a39ef003f0fdf42f710c", "object_relation": "sha1", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616178858, "uuid": "0af54686-988e-45f8-a141-a1997cdeb018", "comment": "Malware payload", "value": "2e70cf8d24fe4eb0081d057dae0efbeb11abe37445d1d459ee6c8acafff6bc1f6357b8ab10f11ff573f4316e310ac984", "object_relation": "sha3-384", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616178858, "uuid": "64fff598-4468-44f1-b79c-51611f5e5523", "value": "8C442345D802E0BAC3CA0D436711D0B35F7BB32D610E7874C44E5B6D751AABA3C39AA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616178858, "uuid": "10acde19-ee63-44fd-a2aa-ea6eb987cb9a", "value": "6144:+yOLZ32M75BUXDtXg96OahTxfhNKbStGkMf1e+yptSlvyLvJC+MMQ:+yClNBMDtQ9eRtvtN61CSl8C+MMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616178858, "uuid": "61080c4b-8634-4749-8280-b82891335501", "value": 269423, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616178858, "uuid": "bd8b6f94-465b-47e9-a9a1-6ef66347bb68", "value": "application/x-rar", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616178858, "uuid": "4cfee029-1d07-4256-a3f6-233668fe4099", "value": "PO-21-0076.PDF.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c29ac7-8885-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1616139179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139179, "uuid": "82637149-1c83-4756-944b-7f64645dc37f", "comment": "Malware payload (ArkeiStealer)", "value": "9a3292209e0d65559b95e289032f6a5b", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139179, "uuid": "39fb137c-c40c-4a8f-a70c-39b11ed121c7", "comment": "Malware payload (ArkeiStealer)", "value": "0e18d0556776d09a6bb586125fedcb650df7090a0e2cdf2cd75ac04c5fec4ba1", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139179, "uuid": "430b8e64-a87a-4453-9aa5-33bfccc8cb32", "comment": "Malware payload (ArkeiStealer)", "value": "e3759b9fd89602d211ed6e5916f6de0ec412b8d7", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139179, "uuid": "1cd94265-60a1-458d-b4c1-609176020e54", "comment": "Malware payload (ArkeiStealer)", "value": "598a57e7bdde6b01976cd869b5c50b1d203c7b5a89b94ed1f893ee35df02c8dd542422afdb1053f5f86d617310af10a7", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139179, "uuid": "28fe1a04-a1e7-40a8-a4fb-0ed122197ddf", "value": "5FC4E110B7E0C035F1B262B449AA97A8A93A79F09F2C40CF66D71BFA57746E09C31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139179, "uuid": "819bc3a8-cf96-47bb-973e-d7dadd1dde0c", "value": "5d17de16c76266fd8d910bc0fc0e437c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139179, "uuid": "69520932-1b4b-45bb-9a03-d624fe69a4f0", "value": "12288:iua7FfPITGvxHBNBcMeQGBXQmIoXcV7FKq5tuBNYggDsAjh4XqN4:DMFfPTvnKB1cmotegDsoh4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616139179, "uuid": "b739ece0-4bd7-441d-97af-cef21098e3eb", "value": 579584, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616139179, "uuid": "37e75966-e86d-45c9-b49a-8238a16e9773", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139179, "uuid": "b67e905e-b19b-4ac3-93fb-3f68ecaeae58", "value": "9a3292209e0d65559b95e289032f6a5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af0e6317-887b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616135036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616135036, "uuid": "ac5d2b1f-68e8-4c1f-af26-10435583f3ee", "comment": "Malware payload (AgentTesla)", "value": "f52357bed0bb249483d26a0b82ddcc36", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616135036, "uuid": "4471fbb6-0a45-432c-a72c-c969e08bbf3f", "comment": "Malware payload (AgentTesla)", "value": "0f91d9c75cf1dd126dfd5672bdb48b8d5872578ea70933c14db18eca3ea26995", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616135036, "uuid": "37201bc3-3d1f-4588-adaa-291187e557ad", "comment": "Malware payload (AgentTesla)", "value": "5d646f5ee8dfd16aa2c3c16781785bc892512b50", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616135036, "uuid": "236d42e8-6ce3-49a3-9c70-51dad9388f12", "comment": "Malware payload (AgentTesla)", "value": "579ff27cc104c322a1da4135ee9faf14e59094305350442243e4e3744ff2393297c16f7622d60e374a5c890053fc1ee4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616135036, "uuid": "f376fb86-5b95-4579-ae50-8dd27bdc43a6", "value": "65B4233F4A127456C60B7C35DE52AEA400C2D4FC9E9B41BCB7631C05DA6DE52AAF243E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616135036, "uuid": "0f28150b-8798-4156-a9e2-19c15282d6f9", "value": "12288:hCfRA0kZd9DPgvALr1aAxlhrtgibyAlpFhRom5X718nZNl:hCfRaX97Dr1aAxHtTbyAlpFhyW1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616135036, "uuid": "242c9387-2cab-4c1b-b991-a6d76026507d", "value": 532877, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616135036, "uuid": "e8d5fde7-5101-4596-ac42-4892e8e763b9", "value": "application/x-rar", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616135036, "uuid": "6cd62ae5-57cb-4be9-a705-74811da4aa34", "value": "Revised PO.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a24651ae-88bc-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1616162932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616162932, "uuid": "5547c56d-eda3-45d4-8f8d-5fa8d8892bd7", "comment": "Malware payload (RemcosRAT)", "value": "187f4f173274995266582eb944c619ad", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616162932, "uuid": "a2615d3f-c9f3-4e7b-8e01-a325a6743dba", "comment": "Malware payload (RemcosRAT)", "value": "101f22376f6a937426fe5045b5eda6ff94af3e0882033a10236c83b4c554e5eb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616162932, "uuid": "6792cef8-e395-4fc1-97f2-47a998b534be", "comment": "Malware payload (RemcosRAT)", "value": "8085d975c38cbd92c0c9e9ae4fbfad2808f1f61a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616162932, "uuid": "d69e6485-4a5e-41c9-9145-b56f91e6312e", "comment": "Malware payload (RemcosRAT)", "value": "8f31ff7c526bc2bbcdfd806dc42f8a7ce5373e1d9819d383eff2acc97b740a87d305431f65061b3c1ef295e0c5e0015c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616162932, "uuid": "be3d53ee-836c-4a9c-bf09-95720f5e8bfe", "value": "63C3AFF866087DE65A2F576BDA59FCDD03B637628ACB64CD4064B7C309A3325FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616162932, "uuid": "3e60b0ba-13ac-4ff7-b365-2bb3623cdd40", "value": "3072:a26ByCDhw4CwJwxXYJZF3cw0dVcD33xmcu38E/eMA9c9/23LAFBkbgyvAztlM:aRDhw4C3XYlKo3BmZmjMoeDUUe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616162932, "uuid": "b0436961-f040-49e2-b96d-70d2d10f5489", "value": 129108, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616162932, "uuid": "d43e3891-283b-4a25-91db-3e568b451eda", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616162932, "uuid": "5a47cc35-ff8d-4f4c-bb8e-00c977c16768", "value": "PO451093PO1595_INVOICE.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a967169-88da-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1616175670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175670, "uuid": "cc28f31e-ce7a-4576-81b7-5109daf3ce52", "comment": "Malware payload (Formbook)", "value": "591ae1a059336e926b018a576899c536", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175670, "uuid": "35494f69-7ae6-4949-9d42-ecbb5ef20f1f", "comment": "Malware payload (Formbook)", "value": "10a6e6bcc54c606d63d23045eb5d2b78b0c5c001f2eae9fbab22f868fe82d20a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175670, "uuid": "b8a4323a-acd7-4d41-9274-8c8e322dcf6a", "comment": "Malware payload (Formbook)", "value": "6fbeac10881d106e95117898b594fa6f04a1f5a7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175670, "uuid": "d054b998-a769-4c3a-81d0-af6f1277e45f", "comment": "Malware payload (Formbook)", "value": "8272518e00b83d33940b1aa611ab77a76169b7f6ab4b99d314197e9df9285193f1a77b1d038b181df366e3d5248e2168", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616175670, "uuid": "ee6a3033-5b20-484b-8ce5-048ad0c2a4ae", "value": "5AB2BFCA9132148CD30B24F8141820A1D63AFE71898B6EDE76F3F2959D5B5D7BB25338", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616175670, "uuid": "190e3570-4b37-4c81-9083-2b1700fd73fa", "value": "768:Svaqm0l82k3sdQ5zTe9FHqocR7G8c/nugj2px:qE2kzTe/gGljKpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616175670, "uuid": "05974240-2f23-4bdd-aa33-ef42dcdc22ab", "value": 24596, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616175670, "uuid": "a2f82910-3333-44c7-b8a4-dc5919f5d696", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616175670, "uuid": "0f856683-afc4-4724-9149-27af7afdc275", "value": "ITB SE20059OSB.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "506a11a4-8886-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1616139602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139602, "uuid": "7a20a467-2bae-4405-945e-09c7b27cdddc", "comment": "Malware payload (RedLineStealer)", "value": "5012a1f58ec574a3b894e91cfa284e54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139602, "uuid": "68c09cf0-fba1-423d-b2a4-4e0ccc2fb03e", "comment": "Malware payload (RedLineStealer)", "value": "121e4fc2c5c5ba6ba557c50761e09d7c2b80466a569adb9fce60689a4cc2c569", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139602, "uuid": "993df987-a77c-47d0-affd-cebceaa0cf35", "comment": "Malware payload (RedLineStealer)", "value": "4cf5c7448df806d146ad79222adc9ccef24a0562", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139602, "uuid": "8e355a43-e71a-49ad-a9fc-4397a40b33b0", "comment": "Malware payload (RedLineStealer)", "value": "a399901bcf72c3af7d507663a7ecd830b742ea55dc6cabe0e892b614e18e2d0726ef85f1c8d331d0ca58edf845875873", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139602, "uuid": "69572a7a-1dfb-40c5-bc4a-60488fa2d615", "value": "F9C21A327B9CC936DCFF0BB468B0564685B5E1501602FF578EC821536E23B91D6227E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139602, "uuid": "8345d456-643c-4946-95a4-cab38c2ed305", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139602, "uuid": "a353ceb8-118b-412f-9204-ff508ff8ed1f", "value": "384:lrnzdDlgs5z1LnJXR9fLUQmgHLIDz9JnLFSC6UXsm:dnzdDK2j/XHUdJLFSg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616139602, "uuid": "69a90837-6244-459e-a80d-69db557de16e", "value": 26624, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616139602, "uuid": "40a200e0-45ea-4c16-b51a-706933ddf5d6", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139602, "uuid": "13037af5-df41-4f0a-af44-67709fd22834", "value": "5012a1f58ec574a3b894e91cfa284e54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfff47bd-88c4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616166471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166471, "uuid": "a91ec21b-f585-4ec3-9378-acf07ca6d9a0", "comment": "Malware payload", "value": "04ea07e45a8ebcb50bae94c78fedfe57", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166471, "uuid": "ddcc969d-216c-40e2-ae03-584b144e7ce4", "comment": "Malware payload", "value": "128d0aa19b1af2c588938bb6c1bd0eb1adc94dff53da4caaac9d0b65b0b8199a", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166471, "uuid": "c3f634d8-b095-4b1a-b9c7-0c5efa2a1b70", "comment": "Malware payload", "value": "5b7ac7391c328ffcd6af36ad84acc898d0633fd8", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166471, "uuid": "49d55e3c-343b-4fbf-95e6-662add702aa9", "comment": "Malware payload", "value": "9625266b617a1df4e680714547f16f0771b48b1dea0c9f22619ed787b03280ff679d532f134710cdc080ec94344b6c2e", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166471, "uuid": "7128be4b-89f0-4d49-8d5a-42e752ef1750", "value": "8DB42335F1F99A9371264C20510C8E111955E127E8FB23A9FC9E6CEE847BBFC64003AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166471, "uuid": "bbe49d1a-1eb8-46fd-aaeb-4c231128a12d", "value": "12288:0IRo1ml6kYjp6lIFnA9AvrFeLXSpiffxj5v7bfj6z:0IRoYYjp6lIFA9ATFeLCpiRpbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616166471, "uuid": "7b844f8d-cc58-4edf-8d7a-86984325525e", "value": 499484, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616166471, "uuid": "b1c19d07-e240-4e35-a021-d529955ad71f", "value": "application/x-rar", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166471, "uuid": "4d76f127-7098-415f-ae0e-206120be84db", "value": "Profoma Invoice_ update.png.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "498a0589-88fb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616189841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616189841, "uuid": "a48bc377-34e3-446b-bbb8-3cc54cf87691", "comment": "Malware payload", "value": "8325f4c73da554f7167c9c59b51509c6", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616189841, "uuid": "acf2ac29-2144-4ef6-a822-2126e09412ca", "comment": "Malware payload", "value": "13befdab58577bd48ebd95df99c7a128304d9691a55de3aa1b8eb8f8e5a81188", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616189841, "uuid": "36cbd5e0-20d2-4aaa-b74c-8c72a5a66861", "comment": "Malware payload", "value": "07e477a43c2e123554f33f218ef377fead37788b", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616189841, "uuid": "da64b5f1-de53-46c7-b3ca-2723b91bdcf7", "comment": "Malware payload", "value": "e1bd0f5acfbeb3dd8a31912b1c292d5678687c5455668cf7ebe1cdd49a98cd39a2801e8bea0e95b4a701e92a18e58ef4", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616189841, "uuid": "03b1e676-edb9-4261-b981-3ba0a3f42e2e", "value": "BC24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616189841, "uuid": "0200802d-99ad-470a-a6d0-3aaeeeb063f1", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616189841, "uuid": "bf897799-5aa8-4c64-b83c-fdf5f93c6133", "value": "3072:m9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:m9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616189841, "uuid": "023c8ad5-5975-42e4-862e-d0a4f3f7bb24", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616189841, "uuid": "34fde9b2-903b-4af2-8c27-40ba79504ca6", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616189841, "uuid": "a2a6b534-0245-443f-b5d4-348502861644", "value": "13befdab58577bd48ebd95df99c7a128304d9691a55de3aa1b8eb8f8e5a81188", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24bf827a-8888-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1616140387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140387, "uuid": "53879025-efcf-4442-a30f-5a9b5f72f078", "comment": "Malware payload (AveMariaRAT)", "value": "40378e7fe51e93e9179a99bb611ce303", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140387, "uuid": "357239a3-557c-4f29-90ce-428c49f3a89b", "comment": "Malware payload (AveMariaRAT)", "value": "1703ccb7bf3fdde90f8b0d632811137f06d6bccc551418cbbb36e627da336aea", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140387, "uuid": "f03cf0b7-b8c8-44d9-8c2a-0202e42cb746", "comment": "Malware payload (AveMariaRAT)", "value": "2c22413992d3197fc4fdbbafc240417b1a93e760", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140387, "uuid": "ec286764-e568-4b03-a13a-d356eb0f22e8", "comment": "Malware payload (AveMariaRAT)", "value": "6191626f12803aa2862078028db271684a1b8594372e2a42a840b9776f0bcda467b941cb34ff6b8adc6bbabe3318cc2b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140387, "uuid": "110ac5aa-c4d0-4733-bfbf-96d6f8b2771b", "value": "6E72E16F18C664770F933B4BD70ABC4A6D117B87112F2183B8D6E96831F6A3602630CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140387, "uuid": "28dfa446-5f7a-4654-9a93-a1a863b23824", "value": "384:60Jyrn+/e/rlwbDiq5RFGDJOPf0tpVlIfjvi0DFYfX89288qIxcF35WCj:6QE/8tUDftfaFi89RplWCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616140387, "uuid": "315c4e31-89e6-4976-aa76-f84e2fec5ee9", "value": 16428, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616140387, "uuid": "1dd41054-4d07-4e32-bfe3-c0b383e9ded1", "value": "application/octet-stream", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140387, "uuid": "df66e33a-185a-4379-930e-5ca0e78b55e6", "value": "Purchase Orders - Foreign_000000000077057.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c5dcd9f-88bd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616163137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163137, "uuid": "63230860-142b-4958-a032-de70e2e262f9", "comment": "Malware payload (Dridex)", "value": "8ae5cd607758e2f352a682171ff4f8fe", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163137, "uuid": "3ccaace1-83a1-4681-9215-65f75aa0620b", "comment": "Malware payload (Dridex)", "value": "184d39aec8a5bccbd7993537e8eebcdfe24565db2bbb2dc4c8a78001284fea2c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163137, "uuid": "fda1d182-7bbe-47d8-b837-3b4bafd54bcb", "comment": "Malware payload (Dridex)", "value": "bbd8a02f4983079b85969fe8b5c20629eb4cbe4e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163137, "uuid": "a706dccf-6390-4893-8c91-9523d7718982", "comment": "Malware payload (Dridex)", "value": "d5a34f9de775441c3e72dd71f1b94d2fe1a893636ce7a874b5f03389a6c2d59f10486b5621e97e39ca4c69fdc08203ee", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163137, "uuid": "8b57b05e-4f54-4139-ac83-20060021e53b", "value": "8F14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163137, "uuid": "96d6dd71-7edb-48bc-a07b-956661aeb8ff", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163137, "uuid": "4829afac-f9ac-47d0-8294-e5493c9d3126", "value": "3072:N1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:fi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616163137, "uuid": "81626ffd-7090-4911-9268-d6e05210fec5", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616163137, "uuid": "9d7dbb67-aaed-4f85-ae7b-22a00b21d15f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163137, "uuid": "2d75a486-5b79-4ba7-a6a9-8d6762b26631", "value": "184d39aec8a5bccbd7993537e8eebcdfe24565db2bbb2dc4c8a78001284fea2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c65ff49-8889-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1616140937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140937, "uuid": "5602eaa1-528e-4054-be97-7b4e8efb8d6b", "comment": "Malware payload (RemcosRAT)", "value": "82a23266b999a0e3c2b411d221b1b590", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140937, "uuid": "7d445140-6349-4e05-ae2b-4e16220b20c0", "comment": "Malware payload (RemcosRAT)", "value": "1b49da172b79de32c6df4e87385e57c0e3768b0b227b84cc38cd746b05200720", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140937, "uuid": "c43cd662-c58b-4cf8-9b30-4c08f60ac2ba", "comment": "Malware payload (RemcosRAT)", "value": "b6ef8451e17fefd09328badf84d8eef5b8d9a82b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140937, "uuid": "6c148a00-88f0-49f7-999c-76b93c60e5e7", "comment": "Malware payload (RemcosRAT)", "value": "540dd33f4e58a5c32b7cd052a952dd9d62cd1f85cf16232d6218d145b1e9cb8126df911b3ee7fd83e150867eaede42e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140937, "uuid": "ebc5960f-d555-495e-af7f-2f26728d1691", "value": "4D158EA613172A67F2263A741041F37537B0DEE1A07AB6B59DD43CA3B8853C0697BC74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140937, "uuid": "9becada7-abfd-437b-816f-b9d98c908f0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140937, "uuid": "e537dbdc-14f3-435d-a300-890767c183f6", "value": "12288:KXV4J4ce4WiSwb96Ot43CvrFkffN1dGrc+VPMRR9vt8+Zcb3Bd0z0ak:8Epn6zsrdVP2R9vttq15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616140937, "uuid": "6add31b3-8ce7-4e64-8b46-7c020ae0c0c9", "value": 896512, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616140937, "uuid": "20318f51-a6ef-419e-b30b-177293601b9c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140937, "uuid": "52886e4d-8413-452a-9ca6-3f52981e1ad3", "value": "82a23266b999a0e3c2b411d221b1b590.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3246cdc-88e1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616178905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616178905, "uuid": "18ea3241-1929-46f7-b381-544fe8fcc3d8", "comment": "Malware payload", "value": "19cb3047f93de2730139cc63954c8af1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616178905, "uuid": "d2d7a21e-7585-4171-859e-045f7a050277", "comment": "Malware payload", "value": "1d03cbad439f831d0cdd34e444ef7d054fc46370025a2ee70a29abc50a178cd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616178905, "uuid": "24b96230-bac9-4368-959e-edf9bce9b623", "comment": "Malware payload", "value": "a25ce936892d21e4ed4a990f5a8c5112138d48a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616178905, "uuid": "d2797131-b44e-4e19-b436-d41097d998af", "comment": "Malware payload", "value": "70284bb58d3e54ab42184dee8afc5f12e9884267b14af1d1677b9640b7f051d5f90b84e2f012c978ddb83decc9b75ed2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616178905, "uuid": "6ec96a44-e46c-4e13-ba2f-2b5f071dcbc3", "value": "02949E85A4D0D6C7E822023458B6BDF121177C2AD9B4C91EF999BECB7A7E6039C33507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616178905, "uuid": "c29f9291-99d3-4e8a-b25e-f8f6fec3daef", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616178905, "uuid": "3ba0d5cd-7e7c-4dfd-a11f-4dd9b69a3734", "value": "12288:owL7a9tIxqlv+qQ4vgqzMyCeJngNbs29ZmluCxO:nsVQ4I8xgNbs29ZmRxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616178905, "uuid": "576b4305-a3af-4be8-b434-ff599cc99850", "value": 419858, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616178905, "uuid": "bafd2891-41b3-4fc1-8816-4120d2f50a9b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616178905, "uuid": "f671c0e7-44b8-4eab-beb4-bd8825c3a329", "value": "PO-21-0076.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f7d981-88bd-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1616163498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163498, "uuid": "d860f6c6-600a-4605-b3ad-0802b08bb953", "comment": "Malware payload (SnakeKeylogger)", "value": "eeb75f4752b63b800fa2d653760d8fb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163498, "uuid": "4821635f-eced-4a06-89b4-623e62a9633a", "comment": "Malware payload (SnakeKeylogger)", "value": "1e610d9e5c54f5f5ecece3d88d3d1787fca89cc1975f56cc352e4963e977c3cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163498, "uuid": "7428b534-783e-4c4f-b02a-92901211c913", "comment": "Malware payload (SnakeKeylogger)", "value": "c046392594a5633563d52d89d3221001d498df6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163498, "uuid": "9d87b1d0-81a2-403d-abca-9debd19e3f29", "comment": "Malware payload (SnakeKeylogger)", "value": "c4e75c42c9f27ddf81fdd8dde53696f66fdf1f1c89e2525bc69d73744351ac345d832942c03e6cf6e081629d3493ffd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163498, "uuid": "4e404fd3-b34e-4285-b13b-c3a259631a25", "value": "4515CF01A3A5AA48F37B53748278120197FAB585D736D7BDA98050DE0E73B824B7B337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163498, "uuid": "48532073-183e-4aac-a3c4-83500bfb2e2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163498, "uuid": "ff08b991-4d8d-4d4c-82ce-feba2553d254", "value": "12288:vvJObKbKYXqzx/cP+plHzsw8qHmsztSLd4bAEQKxlHr+TdK5:vhObK5q9cG7oLqHted4bAEQeBaI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616163498, "uuid": "eb7c3ced-0e1e-41e7-b45f-868c48364333", "value": 888320, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616163498, "uuid": "5dccdecc-f699-41a9-973e-6103837902bf", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163498, "uuid": "df09c617-735b-4e24-a900-1679ef450c2f", "value": "eeb75f4752b63b800fa2d653760d8fb7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4717d80f-88b8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616161061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616161061, "uuid": "d36b1612-2c7a-4ad7-8360-029c841ad80c", "comment": "Malware payload (Dridex)", "value": "c3f20cc819b9b59487565639d8e71021", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616161061, "uuid": "3fd47d8e-25a6-4f07-8ab5-2e765d69bec4", "comment": "Malware payload (Dridex)", "value": "1fc536f2935a6ceaa8d016e104af820c5db6898ae18f9503b0960686aa325735", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616161061, "uuid": "73945449-330e-425f-8e59-b3dbdab4a39e", "comment": "Malware payload (Dridex)", "value": "4adf9657bd1acb3ee55aff10ed3a84da5561fc3e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616161061, "uuid": "3bef8469-1861-405a-ade9-7d56ef30af99", "comment": "Malware payload (Dridex)", "value": "5903b80c3cbfb6e3634a47509a3fd478f4bebb44df88d76664b0a0798d734fafdafbb7bbd6525f683b7cbd85882e2ce2", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616161061, "uuid": "e193cdb1-7d1d-490e-b219-5d15d1df4686", "value": "4724CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616161061, "uuid": "c37c13d1-1f93-4213-b1a8-a7aeee5f8319", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616161061, "uuid": "1b3fa0df-c4ea-4340-b136-6d738339f90c", "value": "3072:O9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:O9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616161061, "uuid": "50515fc6-19bc-4f9e-aede-567d8993d3c1", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616161061, "uuid": "f906bfe7-cbb3-4daf-8322-9b47617620e4", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616161061, "uuid": "80711ff9-75e1-4066-a7c4-0eb0dd5ca342", "value": "1fc536f2935a6ceaa8d016e104af820c5db6898ae18f9503b0960686aa325735", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b031a95-88f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616188636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616188636, "uuid": "c808d72f-b7bb-41b6-8768-f6cdcc4763c2", "comment": "Malware payload", "value": "093aab0489f1b55babf45a451d3a541f", "object_relation": "md5", "Tag": [ { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616188636, "uuid": "90abc878-9695-4a19-b306-11d20303dbe0", "comment": "Malware payload", "value": "21ba184b544b496893283fd1bcae6e54bf10ac7d6db461741416bf46c0f2866f", "object_relation": "sha256", "Tag": [ { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616188636, "uuid": "f991df8a-8c95-41c0-a9d2-3cb55bf0410e", "comment": "Malware payload", "value": "0f76979bb890bdb7092f0ea901e358e34d94ee95", "object_relation": "sha1", "Tag": [ { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616188636, "uuid": "6b999eb8-32f3-4032-92ce-1f15cb6df3b6", "comment": "Malware payload", "value": "f4b442c957dc1d0d032971a2f0e10448fb6306552b595a2a626b9e062fda600a7eb64bb484dcf5ad7d3200e4abcef89a", "object_relation": "sha3-384", "Tag": [ { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616188636, "uuid": "22731a12-2c70-44ed-9d30-9d4d76f879d0", "value": "EEB4239501431E94CE7BFC4931B9090A7905AB7E42CB3F48BFE26739B68584843BED97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616188636, "uuid": "4e8fe13b-63c2-4981-b1a5-a18ad4537ce0", "value": "12288:AL/N7NzviRBl/+7TYYf8PbtDaV1Rt47na8xeIAh74Gf+PbFDap16pQ5MH:AjNNzyXpTteXoaIs7mTFeT64MH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616188636, "uuid": "8bb00b45-0eb9-4c05-8851-b277dc306415", "value": 535144, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616188636, "uuid": "6fe7cbd1-cbab-4405-82ff-06f3f62e0c53", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616188636, "uuid": "b0009deb-c85d-4d0a-b811-08576ab25571", "value": "\u76f4\u63a5\u5728\u7ebf\u89c2\u770b.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b74d7e46-88be-11eb-abe1-42010a9c0039", "comment": "Malware payload (CryptBot)", "timestamp": 1616163826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163826, "uuid": "6b1c384d-7973-46df-b334-8d9ec71de2a8", "comment": "Malware payload (CryptBot)", "value": "1fa0dc2ac5e6610b1f19c2afd119e9fe", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163826, "uuid": "35188415-6ed0-4677-8b94-bcb2c0524742", "comment": "Malware payload (CryptBot)", "value": "21c551ed1ce186d015c2fc69268f9243652c24a4fc4a37b1fecf799a3b89e063", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163826, "uuid": "0622e026-c77e-446b-853d-63150447fc96", "comment": "Malware payload (CryptBot)", "value": "a321e785279754cdf0bb21b30946755c5bed6655", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163826, "uuid": "497c2f20-1a7b-46b8-9fba-83a5d5f61f79", "comment": "Malware payload (CryptBot)", "value": "830a52a3747c0cf11683d64b4251605457c9e85e4e23b4cd6aeaa94e24035324454d84f87acb4ea7643a6fa888be0c95", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163826, "uuid": "21a2e291-106a-4e4c-9d64-cde14009b2ce", "value": "98D4125176C0C473E15A05B68C11C7B88B76FC7A0B2053D7BB806B6D5F392E28A3A74B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163826, "uuid": "e3c59fb9-ec8e-463d-af7a-51b3108f853b", "value": "0329daedf7410b851c763de6fe05fcee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163826, "uuid": "6b667506-64ea-44b9-ab60-7b08be9bff7f", "value": "12288:Kp93fTnoTNmp1uJpS90TttHWaF/GXKqxpUPmFoJXC3cTG0QPgo61mE:e9rahJ2OtVTFO6wpUuFYC308p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616163826, "uuid": "1cc61fd6-6c45-4de1-9306-8b6ab17f6bd9", "value": 641024, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616163826, "uuid": "564a7500-6b95-4fdd-8065-f2c379d0d079", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163826, "uuid": "8272fc1a-9479-4494-8b91-f891ae87d81a", "value": "1fa0dc2ac5e6610b1f19c2afd119e9fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c111be-88e7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616181478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616181478, "uuid": "f8659afe-944e-4413-a05e-a549a2aa7d87", "comment": "Malware payload (Dridex)", "value": "63b4c31b707efadf2d7bec2401fa1a8a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616181478, "uuid": "a275efa2-1112-4cf3-84bb-2ead097db2c4", "comment": "Malware payload (Dridex)", "value": "2541573fd50cd0123057cdd98155ef940cd15fd5bdbf0ac36ab791dd3075fc3a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616181478, "uuid": "559b6150-7339-4cef-8cda-4564b1ac085f", "comment": "Malware payload (Dridex)", "value": "6e9f293503c2f3a5341abff916db2db835930ee0", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616181478, "uuid": "21ffae68-d959-4711-8b50-8cd0d9d4aba0", "comment": "Malware payload (Dridex)", "value": "bc5bd78b994ef8534c44c344236bd9f2087ba259dc53da0dde40581dfb2f0815dd22a72bf087dc0fbc3fd54ecf292a56", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616181478, "uuid": "821ea6ee-e029-4a5b-9eb0-22a01162a75a", "value": "F014AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616181478, "uuid": "9de225e7-ab97-4ccb-9c3e-e4b31d440d40", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616181478, "uuid": "235aadb0-1258-4ce4-ac28-6cb7482474ba", "value": "3072:P1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:ti78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616181478, "uuid": "452a9257-718f-4b46-a051-76a6804d8ae7", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616181478, "uuid": "1157bced-d5ad-494b-b371-8b2725b6549c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616181478, "uuid": "3ba4b4f2-30f6-49a9-a079-dc804c5d8391", "value": "2541573fd50cd0123057cdd98155ef940cd15fd5bdbf0ac36ab791dd3075fc3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b43cf414-8863-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616124737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616124737, "uuid": "60d8029d-8007-4b8b-8b52-e4edbe865c67", "comment": "Malware payload (Dridex)", "value": "d34ac2ad7e855dc8e3eec0fdfaa88eaa", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616124737, "uuid": "1091b626-2f15-4df2-bff2-f72a4157f06e", "comment": "Malware payload (Dridex)", "value": "2644073db08e8995b590844ea6c4eeba51d54d5237351e1acc425eb81fba0755", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616124737, "uuid": "9cff1c79-4baf-4098-afbd-01536b02b976", "comment": "Malware payload (Dridex)", "value": "28830f770892fb88870f3560a6b8758ac4e46c52", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616124737, "uuid": "84784e18-9158-449b-a563-0a1f96d81810", "comment": "Malware payload (Dridex)", "value": "7701e543d5ab34944d6621595a71c02221d9744f736c12fafd6212589b6d35d8549a97dda6b307b4aa148ada4b25b157", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616124737, "uuid": "708484ad-5020-43d4-bd17-8bd88edf2b76", "value": "3324CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616124737, "uuid": "60e09ff5-38b2-4ae8-b096-f692b947efdb", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616124737, "uuid": "074b7717-6bbf-4f1c-a2be-926d66272e85", "value": "3072:f9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:f9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616124737, "uuid": "4c899f5d-37f8-496f-8326-fc21c7db9736", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616124737, "uuid": "cc9eea35-58d6-42d7-852f-c35340cfdf98", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616124737, "uuid": "2c0cf9d0-2bf3-40d5-b031-a6eb8cdcd618", "value": "2644073db08e8995b590844ea6c4eeba51d54d5237351e1acc425eb81fba0755", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "035a2b66-88ce-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616170396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616170396, "uuid": "84c1bd1e-663b-462a-b23f-bf8d8fd9a213", "comment": "Malware payload (Dridex)", "value": "52b964efe7c29ed41128a8f0653a30e1", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616170396, "uuid": "86413168-1347-4a85-a55d-ee1fbe6abd89", "comment": "Malware payload (Dridex)", "value": "26b7fbe7c6f6adeb515560f8ff0cbc4449942582c058f196aeb3555cc6a8efac", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616170396, "uuid": "350b6c81-1486-4aa9-96f3-1a3cca3136fb", "comment": "Malware payload (Dridex)", "value": "5a6410ef46ac1fc24bde28aa7fecae3bdc843da3", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616170396, "uuid": "723e5130-36a3-4c0f-af81-be858a460a65", "comment": "Malware payload (Dridex)", "value": "bfa7b885f109577e6ef2d2d09b01f12142e20dee3c06b7ad451f7b3ae195049ef45c8989a6e17dc762bc616ca6e79be6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616170396, "uuid": "01ce8906-cc63-46d0-a462-72414b5b5819", "value": "3914AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01E124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616170396, "uuid": "59f02a45-ee9e-4b28-8cef-5e41220e3ca7", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616170396, "uuid": "522e3164-9c16-46de-b549-40412eca1947", "value": "3072:m1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:ui78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616170396, "uuid": "91eae98f-eaa2-4fad-8fde-95b659b64ddd", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616170396, "uuid": "13f781c3-611e-4c2a-8e9e-ebdaa8d2f811", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616170396, "uuid": "b440f157-2ab7-4521-8b0b-ada584738796", "value": "26b7fbe7c6f6adeb515560f8ff0cbc4449942582c058f196aeb3555cc6a8efac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d0748b-88af-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616157297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616157297, "uuid": "a65edd80-f708-4548-8adc-fc2b87d72b2e", "comment": "Malware payload (Dridex)", "value": "58b7fa5634d1f60bfd3a4869c9a5f53d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616157297, "uuid": "de35bd05-febf-4fd7-9e9f-97211f5aeb9d", "comment": "Malware payload (Dridex)", "value": "27ac502f331f6b8952fc0dd49b3715cb8e22b6afd125ab3a05ff10f787cec9e6", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616157297, "uuid": "1bb4b975-05e4-4c42-88ab-99a971c1d26a", "comment": "Malware payload (Dridex)", "value": "bcc4593edd53d060aabe4d4a3010629ee53c8204", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616157297, "uuid": "fbdc410b-d972-464e-b13b-5b19d91581ea", "comment": "Malware payload (Dridex)", "value": "f333a21c744359f871a2aa19e22e138e413d55cad2d64eab0bb9a08065d4ff79d0fef3794acebd7e242ebcddec09a555", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616157297, "uuid": "e595cd1e-7a33-4e16-8883-1077b0b4d362", "value": "F024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616157297, "uuid": "638cbb08-845f-4277-9013-346d16203b41", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616157297, "uuid": "f7112ac2-b026-4d00-a2fc-518a11f6de4f", "value": "3072:q9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:q9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616157297, "uuid": "e4c5b168-5059-4361-8b10-9d5c175ee925", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616157297, "uuid": "b3b18468-a505-4567-a413-0e7b3128f6ef", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616157297, "uuid": "73c3f5ec-16be-406d-81da-f763463a9317", "value": "27ac502f331f6b8952fc0dd49b3715cb8e22b6afd125ab3a05ff10f787cec9e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4b3961-88b2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616158682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616158682, "uuid": "9a37ed8d-96ec-4896-a101-8398c0c0d0df", "comment": "Malware payload", "value": "328069f858de002f5bfe248dbba0d96d", "object_relation": "md5", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616158682, "uuid": "ced84075-3d0b-4d35-b8ea-587c10500793", "comment": "Malware payload", "value": "2d95163ef2732027615c7c98438da5401e1892707a104d18d703698a17be0806", "object_relation": "sha256", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616158682, "uuid": "e7dfd22e-8183-4a73-aaf5-4449cbf56892", "comment": "Malware payload", "value": "70f5fd7b163dae1d627a4278462cc7991d5f9b77", "object_relation": "sha1", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616158682, "uuid": "db92328c-4921-4f63-acf0-7f9602b160e7", "comment": "Malware payload", "value": "9fc4b8ac7107c3c28fa6785997b30e0069d5c6b283f0e40e0f38dcd120f309a2da6e0124665f3590591c3c677505b490", "object_relation": "sha3-384", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616158682, "uuid": "0aa2caa2-7a57-447e-95fc-52d8f8f8c93e", "value": "2C14CE79F7D3EB09CB4B143C52BDBCB76B6A44C244C1A40B15576E15A1A8FB22B9B03C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616158682, "uuid": "892ce107-c2d3-444e-8b73-784eb798ba9d", "value": "6144:K6x6TJHhSWtogHp8G0Y6IR8/Iptq0uH66o:KSEhSh0AT+Hu0uH66o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616158682, "uuid": "3c1faf64-6856-47c6-85e7-ea13d084fc74", "value": 207845, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616158682, "uuid": "57b39590-c2b2-4eb2-a718-b421bfe51817", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616158682, "uuid": "e7ea80bc-56d8-40af-a2e3-e78754f60ca5", "value": "Information.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e17b1df5-88c5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1616166903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166903, "uuid": "f29e68d1-39c3-458a-b0eb-395ea8a32582", "comment": "Malware payload (Smoke Loader)", "value": "6bab770bd66fa7242fa314a0987a89ec", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166903, "uuid": "dcefd7a7-729e-4d4a-bf6e-0bc026577521", "comment": "Malware payload (Smoke Loader)", "value": "2ed9cd200f5e28e2fd908d7203d86e74c3336db4867b904f0c7afd2b249d6ee6", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166903, "uuid": "8d999ab3-9673-47bc-a721-069b1ffb7eee", "comment": "Malware payload (Smoke Loader)", "value": "4b91872615e38c56ac7df5d1a0b1705656410c51", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166903, "uuid": "04516bf2-60bb-4a57-9416-2454682748fe", "comment": "Malware payload (Smoke Loader)", "value": "c21daad29ff6ba96f2fbf592052e099d4693283b6ede5c8ce3eb1877f68a27f3f1ac45c4f6a84c762739bc8f4c27df67", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166903, "uuid": "aa3e3ebf-d7a5-45f0-9f84-5b267305f5aa", "value": "C0058B0273D1C036FFABA2739B6AF64156BC79254133852F13981DB9BD701B2263E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166903, "uuid": "3ec92e68-751e-44f7-8099-85194dd5f92e", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166903, "uuid": "39a2d935-2010-4a06-9c82-956b3075bcd3", "value": "24576:nAHnh+eWsN3skA4RV1Hom2KXMmHa8SA5:ah+ZkldoPK8Ya8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616166903, "uuid": "f408c400-6b33-46ff-a951-f5a023fa8c50", "value": 867840, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616166903, "uuid": "dd037d53-be73-4719-9d22-76041fad2c98", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166903, "uuid": "e5287612-9a30-4391-a1ce-14fe20efebb8", "value": "6bab770bd66fa7242fa314a0987a89ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4de6c0-8852-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616117508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616117508, "uuid": "c152b720-54d9-4d59-af75-0ad14d950309", "comment": "Malware payload (Dridex)", "value": "47c9e4f7bf34a3a527c221013a638267", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616117508, "uuid": "dafc334e-5bd5-4c32-824b-ba7b329fa6fd", "comment": "Malware payload (Dridex)", "value": "3054a64fcfc330f4b48c4c19f51c6fd666fb5b5105d716e7fcdc780f8408baed", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616117508, "uuid": "a8ce6397-02ce-4198-804b-94f2be042c45", "comment": "Malware payload (Dridex)", "value": "052f82162a7f1a8fe2358c7a24beb8ddac08bc87", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616117508, "uuid": "1a326005-c962-43c8-a780-ab39b5b23c4f", "comment": "Malware payload (Dridex)", "value": "618c96432950876262c7ff798fdc4585b333bd77f2877f16ff63ad491d1045f21d7a0578e24e2d1bc53eec9e1c0db29d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616117508, "uuid": "ff7dcb39-22bf-476c-b50c-3b9cd91beec6", "value": "5124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616117508, "uuid": "97dce205-6bcf-42d3-b0e9-808256b42234", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616117508, "uuid": "64f5c5eb-60ea-464d-97f0-df9548188991", "value": "3072:29Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:29Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616117508, "uuid": "22fab2ca-cc87-4f85-95d9-c0d79cc1a527", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616117508, "uuid": "b6e8168e-e886-491d-8382-0919196d4624", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616117508, "uuid": "416045a6-6a79-43b4-9f8c-3536c114272e", "value": "3054a64fcfc330f4b48c4c19f51c6fd666fb5b5105d716e7fcdc780f8408baed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a7c520-8884-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1616138961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616138961, "uuid": "c6f86490-b4c9-4b4d-a43d-88b8eaf2db66", "comment": "Malware payload (Smoke Loader)", "value": "800b215d94cf536173c4debc0ea1e3a0", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616138961, "uuid": "b8492f75-1507-45b1-a27d-b8abe15e9bc4", "comment": "Malware payload (Smoke Loader)", "value": "3118708b292765069f61fbdee3214a874a0dff7ab96b5f59d38a200f36d2e106", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616138961, "uuid": "c391f7bb-31ab-4fbd-921d-ab1a43eed554", "comment": "Malware payload (Smoke Loader)", "value": "42b76a35b924cc37b79b449458d3aa1c3b7c182f", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616138961, "uuid": "6d0a9362-cc17-4aae-b61a-b7f9dbcf8b07", "comment": "Malware payload (Smoke Loader)", "value": "177f4c404c5ae285adde9b536e3ad528751a8032c2a324fccb0bb080aed95d8a8a5ab7dce273c9d9166acbd17b2609da", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616138961, "uuid": "0ba0156e-21cc-4d50-907c-86c9e39f6769", "value": "71E2E13E9EC47CB4D1379D30C9DD8CE94DF9828A643086196FB9B8DDAE5B0842A19187", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616138961, "uuid": "8447f7bb-c171-4fd3-b3e1-a57e3bb988aa", "value": "768:FrqQ7AmV3rjBkyo1bXkA8K9CWFwCtwTxf+/ASDz3HUYlyvQ:F33k7jFwvFfwAIDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616138961, "uuid": "ac5a2b76-7c87-4fe7-af0c-69aed8db4218", "value": 33280, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616138961, "uuid": "4bf4ccdf-3662-423e-9c65-7562ddfdd1e3", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616138961, "uuid": "48f5340f-8d98-46be-9c72-e3305505577d", "value": "800b215d94cf536173c4debc0ea1e3a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35c3024e-88c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616165327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616165327, "uuid": "e00bebf3-893d-4716-845d-c6b29c01d90a", "comment": "Malware payload (AgentTesla)", "value": "940d981d8ab43c61a5617fb82466f516", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616165327, "uuid": "fa837393-7b6b-4f68-8be0-00b87c0c150f", "comment": "Malware payload (AgentTesla)", "value": "344812cf8973f2db950bdcdc1413886677e350e3321f4307cb9209a8d21b8e64", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616165327, "uuid": "9b3368d0-85a3-4cb7-9d35-f9d0322bed36", "comment": "Malware payload (AgentTesla)", "value": "adee188997ddd33da297b2aa8831d8cadc23f1ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616165327, "uuid": "b6362afe-f198-4885-9020-1bfd29e3dcbc", "comment": "Malware payload (AgentTesla)", "value": "fa3eea2ca68927c2b14be7139392a9a58f2c53897a7966dfbeea231315b1ed147e328097ef44beef068ef98ddee66952", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616165327, "uuid": "8f3320a2-1927-46c7-b0c4-47bde180276e", "value": "4A63E9ECCA6885E3F9EDF574A443144AA670E4BBB448892F8096C1C3C95F7A27CD447E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616165327, "uuid": "9eaeb10c-d40d-443a-b613-730fcd2f759a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616165327, "uuid": "d30b0050-753b-409b-b3a5-da5e2381558a", "value": "768:ZSNERMiCbKEbqyH0YTK7f9nGflCCXJGflvx/FIwJGun51lnGflvx/FIwJGun5c5/:eERMiCbbbqyUYTqfFCXwPXw8vn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616165327, "uuid": "0b379645-7be8-4de4-80e6-31f529f9290a", "value": 68136, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616165327, "uuid": "32593d57-8b75-4e09-af4a-ce8713968935", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616165327, "uuid": "7fed646c-6a5b-46aa-bd85-ff0949c85857", "value": "P_O101419RI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41cf1dbc-88c6-11eb-abe1-42010a9c0039", "comment": "Malware payload (BazarCall)", "timestamp": 1616167065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616167065, "uuid": "026541ac-f0f4-42e3-9fbb-9f951791accf", "comment": "Malware payload (BazarCall)", "value": "b76a380da2c32e1c16844b2575f61f5e", "object_relation": "md5", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616167065, "uuid": "2d9be560-868a-4f85-a364-8cb554b9ef8d", "comment": "Malware payload (BazarCall)", "value": "3483f717d6c9b903413aa6e1a66f771db14ff7563c4d81ec5b761f50aeea0ea2", "object_relation": "sha256", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616167065, "uuid": "79d00aec-95fd-4f38-963f-ea456ffa7a2b", "comment": "Malware payload (BazarCall)", "value": "370465e853612bf3aca35b0eb517c60fe6f9c08c", "object_relation": "sha1", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616167065, "uuid": "99447288-50ec-4dcf-bb57-4ef9292fefd7", "comment": "Malware payload (BazarCall)", "value": "c6aca1a06a4e507b73725321dcc5a4b3a86aa20230332b67ca5ea6d88bf86d80faab6e084c2ce521a965836703587b65", "object_relation": "sha3-384", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616167065, "uuid": "bd1fc687-eb11-4039-9fef-8f0a7bbf878e", "value": "CE056D8121DF91D9F41D69302AFEF807F1637EF2998EDECF91C5101066266D2A32A739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616167065, "uuid": "825f3b5e-b2ef-4b24-8efb-0374d0e36de3", "value": "ae6670dd686f9d530d4808f1361603cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616167065, "uuid": "75a545ed-22ac-478d-9df7-e52d6cddc9f4", "value": "12288:K9s4KWYZsBYU0TURoMtc0EM235whVanp2rU+GjGo:RWcsUIiplM23EUqnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616167065, "uuid": "ad0506a2-0f8c-45e0-818f-16a9f7f001fa", "value": 827212, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616167065, "uuid": "a5233ca3-b705-4ec2-ad8d-b0eec9923048", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616167065, "uuid": "e092b57c-5f50-4cf3-b447-c5ac2c1585d8", "value": "b76a380da2c32e1c16844b2575f61f5e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ad6fa3-88d5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616173786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616173786, "uuid": "cf3ceb1e-bb61-4b7c-9d70-5a3de6736090", "comment": "Malware payload", "value": "2f8d6c0c6a449f3c074cfc0d6c8dbfc6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616173786, "uuid": "40732f9a-a6fb-445b-bf95-4fd26a19b3f8", "comment": "Malware payload", "value": "3768eb4b9101258f86d5f1cea1138c6df1f2ef6b13c82ed0186f2554bf0b04a1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616173786, "uuid": "a9297400-ca30-4ebc-a77c-e11b52b584c4", "comment": "Malware payload", "value": "0f8de2e4f375aba4119756af12eca5e6c761f430", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616173786, "uuid": "a529aa6d-6176-4904-97cf-95c960188399", "comment": "Malware payload", "value": "4b5a532c66e35159d27869f6aabe532f3622540810cf0c7441c2e3a15711fbe774b1595fcfbc81b6a30536b98f6c1a1b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616173786, "uuid": "b1733bba-f0de-458a-9085-1f906c8098f8", "value": "78D312A6760D92C5B021F03B25D8CA5633023D5ADFF45D7F66CDEA633EB94A2609D032", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616173786, "uuid": "52e0428d-1c6f-41ca-a8c3-3c5ef8ba099e", "value": "3072:MO0kY43JgIs9DBxYe6kvD7u3c+jtjI8KCX+/BqDKjvRUY56:MO0kY43e5rxYyb6pI8P+4DKjvRUYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616173786, "uuid": "85b679fd-ec51-46f2-b094-3dad0e1943ce", "value": 130408, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616173786, "uuid": "9de114ec-10cc-41c6-b505-8e4d982c0de4", "value": "application/x-executable", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616173786, "uuid": "aa8b5a84-2770-4293-930e-e5cff56b8601", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2958fd55-8885-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1616139107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139107, "uuid": "004fd116-7def-4cae-9409-4ff599db143e", "comment": "Malware payload (RedLineStealer)", "value": "4560354fa7d411a1b8808364dc399ace", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139107, "uuid": "4fd61110-14d1-43e7-81fd-80274d40939a", "comment": "Malware payload (RedLineStealer)", "value": "3b6533fc2c7b1b192c3111d6cb5558c40dec8050ebe2162c006ebc39732f2f73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139107, "uuid": "e2f4eb96-fcb1-4420-8fe2-dbb45d248c11", "comment": "Malware payload (RedLineStealer)", "value": "c5fcfff7708ed0a2746756a0a5a8c80f6abb2ca5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139107, "uuid": "9f79d7c6-a3b9-4d5e-a802-b38cc4ccd05b", "comment": "Malware payload (RedLineStealer)", "value": "a3675114fb0111d265e47ec6db95b7759c46ef48e4ad51db8c1e81c4e9d8e4a9599d26e591c1fb74fd03312a7ee3afa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139107, "uuid": "af747eb4-2fb3-46f1-a637-ec4b18e06407", "value": "FEC22A3577ECC539CCBF4BB5AAB146068AF4E5589802FF174DCC21926E13F90DA123A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139107, "uuid": "53025982-4bac-4441-91c0-d77b65431c8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139107, "uuid": "ce6326bc-93be-4660-a6fe-ab1f7e36f521", "value": "768:6nzdDozbW/svUMjjO+hGYA5bqg9qgpQjbzFYrzG:6nzdDo/qsvUMjjO+hGYA5bJqSQHzyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616139107, "uuid": "353e28d3-715c-448b-8b4c-82f2145d770f", "value": 26624, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616139107, "uuid": "cf040c7b-7f11-46dc-b39b-616e37569de7", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139107, "uuid": "7a107ea3-4ffc-41d5-99dd-abec4b5c5efb", "value": "4560354fa7d411a1b8808364dc399ace.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f07a377-88f9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616189018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616189018, "uuid": "cb2c17e6-db8e-41de-a405-1e6076b50f31", "comment": "Malware payload", "value": "445c1dc288c307d2a0e7b16cf059fdc1", "object_relation": "md5", "Tag": [ { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616189018, "uuid": "cb77975d-4289-4c98-b84f-c950832d7891", "comment": "Malware payload", "value": "40995428d8fcbe2da30dca08cd15228bb4b08a4dea38e78d71181d3fda5a4f42", "object_relation": "sha256", "Tag": [ { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616189018, "uuid": "3a0e7238-a88b-42db-bbdc-ca268af7ce91", "comment": "Malware payload", "value": "383ee3e8f79dc7d8937de6f0e1bff18c06894ad5", "object_relation": "sha1", "Tag": [ { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616189018, "uuid": "ba16fabd-c241-4e83-a071-063d6d9727ff", "comment": "Malware payload", "value": "d9c509050a4a5639672e0f93ec500234a7e1a67a5890fb09623a886d854eb976254624fa3760d08027c0d7a2ac8ed16d", "object_relation": "sha3-384", "Tag": [ { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616189018, "uuid": "edab9191-3a9f-4492-bed2-e25f7faba37c", "value": "15D4AD11BEDD84FAC64210318DD65BBDB2B8BE147E11868FA3A8FFDEDD313419919221", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616189018, "uuid": "bb52c812-a0fa-47aa-bb9d-72c2320cb94d", "value": "e2afc946bb1a7942e18b4d1a8f444ebd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616189018, "uuid": "0717a230-696f-4d35-a3ef-36fa48449f11", "value": "6144:Cc5s/L2PwnAFbCDCGkVcscYax9KCEv+/Yf2gl4ZQ:CcKzmwnAFbBGkaNu+Q+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616189018, "uuid": "e25df3db-afc9-4b96-818b-6bb95b7e5205", "value": 643072, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616189018, "uuid": "96213915-2019-4c5d-b581-044f0ab408a6", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616189018, "uuid": "bac49b15-4024-41fb-bb9b-d01d168a759e", "value": "\u6296\u97f3\u7f51\u7ea2\u53e4\u9a70\uff1a\u6f5c\u89c4\u5219\u6df1\u591c\u670d\u52a1\u795e\u8c6a\u6027\u7231\u79c1\u62cd\u6d41\u51fa.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "128c45ff-88b6-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1616160114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616160114, "uuid": "266e58c3-3a5d-4e53-a03e-4dea8e7024ab", "comment": "Malware payload (IcedID)", "value": "73fcd0f65a31ecd1a19345af6334c86a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616160114, "uuid": "2054b061-37be-4121-9b5b-b8fc63cf4d90", "comment": "Malware payload (IcedID)", "value": "41b9863c45245876aab05824d58c2a130871f806085db4d9311f857cabab1667", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616160114, "uuid": "36833667-80d4-4b98-b4b8-dcc7870ad657", "comment": "Malware payload (IcedID)", "value": "042753412cf7215c7b3b3c8f4d59ce01a15deb19", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616160114, "uuid": "49d4092f-78fb-40f6-92ef-718a98bdbef9", "comment": "Malware payload (IcedID)", "value": "18a9744f10bdce6cbd08604c03857f5dee78befccbdf14ba760dad12eba8248923fe7ecd692dcd8dfad99e80d27c5d50", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616160114, "uuid": "f174cd0e-acad-405c-8375-a44a5443631d", "value": "93734AA750EE2BAAD4F41635CC9163A1C1334C860B7CD07BF9D18FB16A307AD9643B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616160114, "uuid": "fcdc58bd-06d7-481a-bc73-016a5ea13837", "value": "a55875c660775c9604607b856433263d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616160114, "uuid": "7e0439bc-dbb5-4fd9-b2cf-f0798204f134", "value": "768:VTciJov9yCBKJxxaHcJGiPO/YP6aMSTK26AlKl5m5jtq0coMpTom4aXechOi:zAxBKJmOoaMr4Kl5Qs5TRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616160114, "uuid": "a47b1fe9-98f8-4d8c-8dca-424badfccea0", "value": 80384, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616160114, "uuid": "d06068fd-97c9-4459-abe7-738e153ba81c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616160114, "uuid": "dca060ce-313a-4b66-9b3a-0374829f07af", "value": "ff.gif.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6fc0e1-8885-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1616139222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139222, "uuid": "e723cff9-9e41-4835-bcb3-a2c97e3c368a", "comment": "Malware payload (RaccoonStealer)", "value": "936466131852d20a20fd9b06eb3ab077", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139222, "uuid": "351b6d23-5867-4857-b7e2-fe716c2414bf", "comment": "Malware payload (RaccoonStealer)", "value": "4239335443cbf3d45db485d33c13346c67d5ac717a57856315a166c190dde075", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139222, "uuid": "d6601d9a-e222-4709-88c8-aa0b54f07840", "comment": "Malware payload (RaccoonStealer)", "value": "4e1e8134e1e34459b6570b7f8ec90ef30fd5aa97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139222, "uuid": "aaff3df0-7241-4e55-abc9-7d114a34d8dc", "comment": "Malware payload (RaccoonStealer)", "value": "9aa616f3c36f3d90ba52d669021e9279a99594400c3b70f5f0cc6f8eaa83ca471b7bc82b829a81bc38ee5916e3fe379c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139222, "uuid": "1050cf71-f597-4a1e-bbbe-a83d69eda3c9", "value": "91B4E120E7E0C035F5B766B4C5B686ACAD3A7A71EF2840CB22D527FA56342E49C71317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139222, "uuid": "0e2368a6-505d-4298-84ea-8f2245a731d1", "value": "5d17de16c76266fd8d910bc0fc0e437c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139222, "uuid": "861824d4-29df-4dc1-a914-0ba4e9547453", "value": "12288:wFawygPKTeXRHBWScJaDxhTXwj/ffIR2fvqXPYErOPn6qCtg2:6DygP9XZ5nKffIR23xEro6ZtX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616139222, "uuid": "0423f149-c58d-44b0-a48b-f7a21d83445e", "value": 511488, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616139222, "uuid": "065ed5b0-ae28-4265-aaf3-2c15865a8aeb", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139222, "uuid": "ab7be185-2c7c-4a49-9809-88150349483a", "value": "936466131852d20a20fd9b06eb3ab077.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6adeadb-8846-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616112393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616112393, "uuid": "b962a8b5-ddd9-4bf0-982a-1f93aad6a4ba", "comment": "Malware payload (Dridex)", "value": "dc4c35d6e18849db21a2e97fa0d153f4", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616112393, "uuid": "a9723424-0cda-4b2e-9ebc-7eebb757fafc", "comment": "Malware payload (Dridex)", "value": "43aaeab351ea92f1feca95b334528599c9efb746615ff7105823420b14324351", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616112393, "uuid": "d5794b90-116d-4ab2-974d-61041d5f7137", "comment": "Malware payload (Dridex)", "value": "3b2ca65ab31a2582499babb08a3a8eedd859fb5e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616112393, "uuid": "6e0bfd9a-e8e8-445b-a9aa-0793e28ab3ac", "comment": "Malware payload (Dridex)", "value": "5f9a08cb4f5bd2b46a0c2e9768239e16c81c3968ee77aa9403f3b2b8167f49a5a2cdc06cf3c6b2553d8fb1a4143b7454", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616112393, "uuid": "5cb8e39d-d10a-4a09-b870-16cb70aebf18", "value": "ED24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616112393, "uuid": "dd423df4-e25d-4f18-9aef-d91dd5b3945e", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616112393, "uuid": "500fe36b-7024-41a3-aece-9ec9177a425c", "value": "3072:X9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:X9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616112393, "uuid": "e3fb4ef9-1755-4336-803e-aa368c19b73c", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616112393, "uuid": "0373ce61-d9d0-47ff-b1ac-3f46b5767ebe", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616112393, "uuid": "ddcc03c6-b05a-4fcd-bf98-76a6cd2bad01", "value": "43aaeab351ea92f1feca95b334528599c9efb746615ff7105823420b14324351", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b20f8cdd-88d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1616172407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616172407, "uuid": "67a695ef-1b8d-4412-b02f-19b72fd540f2", "comment": "Malware payload (SnakeKeylogger)", "value": "3ea8f239cc873b6d1d9f0b8dc8b5a307", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616172407, "uuid": "fe9ad3ad-a16a-4440-b2e2-1864fe33768c", "comment": "Malware payload (SnakeKeylogger)", "value": "4646cdc649c3d1a2c68fdf4f40f1006b55ed3d30bbe0e07b2e27ac91edcdba21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616172407, "uuid": "e9ade0de-a21b-4710-8078-b2ceeb81d9cc", "comment": "Malware payload (SnakeKeylogger)", "value": "0accdcc90aa14a9c440ada775e135eac9c253928", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616172407, "uuid": "bfae1f1d-a46b-4305-bd5c-581df95ccceb", "comment": "Malware payload (SnakeKeylogger)", "value": "705f51a8ff74590e909748ebc6ac88d78efde8f125604e259f36c8d5c89db8b943ae9f7f269c6d7b51a3a53992dae104", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616172407, "uuid": "83d0bb9e-44c2-46e5-bd1a-118ee9785f61", "value": "7C158D0222A5AF04F5FE0333C8B999129BBBFD015A12CA7D54A474CD49F27A5963B337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616172407, "uuid": "31e64adb-dfeb-4b7b-9416-a53dbb9658f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616172407, "uuid": "cc8aeffc-2856-4ba4-a187-318fc859bd38", "value": "12288:zwvOx9ZQIvM0uDMxCelLPIP5WcnxOWxWbDU+KVtlHvyq2/gNiD5ucgq:gOrymAuk5pxOJboD5F2H5uDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616172407, "uuid": "f0c18016-21f6-4b7c-b9ed-1df197f53615", "value": 910336, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616172407, "uuid": "7d0bd1a6-4699-406d-aaf7-58a6442e3c86", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616172407, "uuid": "4611a996-1811-4173-9a25-8e41b142530f", "value": "3ea8f239cc873b6d1d9f0b8dc8b5a307.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c36340-8884-11eb-abe1-42010a9c0039", "comment": "Malware payload (YoungLotus)", "timestamp": 1616138805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616138805, "uuid": "a051faef-089d-481e-adb3-f390e1a3ac9e", "comment": "Malware payload (YoungLotus)", "value": "71e56e4867c4b375110213dc7c228dea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616138805, "uuid": "f20c5bff-fd90-4105-bf1e-9ec2b47da4e6", "comment": "Malware payload (YoungLotus)", "value": "47418562c100061fe1d3344b769fbbe22e433f079726628ced1ec4f7f845febc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616138805, "uuid": "b70ab772-06c7-4030-905e-38b843a87cb7", "comment": "Malware payload (YoungLotus)", "value": "219736599f32f2f00bc6b734ae648011994920ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616138805, "uuid": "9b957a46-a5db-47c5-9a57-db521675019f", "comment": "Malware payload (YoungLotus)", "value": "2fe6e54cb1afdbb7199d48db2955a41251c628a653e24d4c58b800bfd9b588138ef073ebed49c6eb4c6536db0cbf8b56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616138805, "uuid": "f2bc0b2e-39fa-4ab5-87dc-ffed8622d835", "value": "4DC3286AD907D187C49E827449B10AB707766CD3BB92E9CF81ACF85EC2F23C1257560E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616138805, "uuid": "deb4c746-34d9-4cf3-b07d-33780323d517", "value": "2dcead8bb5a28c61e755a24b8fc38e4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616138805, "uuid": "95cbadd3-18c5-4a7c-bb01-35d45e1f0944", "value": "1536:mtadNkjTBfEN/vJZCSgLqreZwTjZC/9ArOM26ZCYYCoI:m0dNkjTBfYpZCSgLqyZw5C/98OD6Zck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616138805, "uuid": "4aef529d-4f14-4377-868a-b4af4d0c20f2", "value": 126976, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616138805, "uuid": "78d9b3ba-7588-409e-8930-77c9bf9daa8e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616138805, "uuid": "1bf9e983-77c3-40ea-863c-f7378165ba42", "value": "71e56e4867c4b375110213dc7c228dea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c55a96d-884d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616115140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616115140, "uuid": "66d33690-11fd-4db3-a4a2-aadb1b4681a1", "comment": "Malware payload (Dridex)", "value": "6baaf4c47ef2364573456ccf6f326754", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616115140, "uuid": "2a05012e-457e-4cd4-8f92-d0e41c4e2061", "comment": "Malware payload (Dridex)", "value": "482bc48ba8e00e23af965145596120d35b1a1dbce1da67b270476af58d916dcb", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616115140, "uuid": "825398a6-85ee-4faf-80df-6c3cc65168ef", "comment": "Malware payload (Dridex)", "value": "69695cbd1ff036d86063bae06dff7c1f6ebdafb2", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616115140, "uuid": "84b16dc2-3d44-44d1-b5c2-9ae68059a04d", "comment": "Malware payload (Dridex)", "value": "456762ec7dad3bff380f3d8df555ab1e565629fd00b765fa50a34432d30e88e4ca4b0f82da11f28cb91b8e2d20089d58", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616115140, "uuid": "7c431d9a-87c1-4e61-91ed-018fe287ed2d", "value": "BA14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A6FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616115140, "uuid": "1e470ed1-4635-4c0e-99a9-dbf8eda15ff5", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616115140, "uuid": "961d0988-c05a-4de3-a6d7-b1423bc527ed", "value": "3072:N1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:fi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616115140, "uuid": "0f66e1a2-116a-4061-b086-72e0a231ac9d", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616115140, "uuid": "ce8ec721-af31-4612-9f24-ac5232792167", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616115140, "uuid": "6f965d00-9d3b-4b57-a7f5-726b0bc0dc50", "value": "482bc48ba8e00e23af965145596120d35b1a1dbce1da67b270476af58d916dcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ddf9d1c-88da-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1616175621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175621, "uuid": "4a7902d7-35c3-4b41-a7c0-8af1adeefab0", "comment": "Malware payload (Formbook)", "value": "bae9bd0964e923c54618d8903d28cc42", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175621, "uuid": "4859bb43-b81a-47ab-aba8-b45f4bd554e8", "comment": "Malware payload (Formbook)", "value": "4baffc4b9abdf9e2949a9df0a93ad091865389a25d0b3466d74b38743f8a04be", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175621, "uuid": "8b8dd595-4483-4bc4-a273-9160dce6cf43", "comment": "Malware payload (Formbook)", "value": "5c643317cf068a7c1bd4adb1dd28be291ae9f3ac", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175621, "uuid": "5dea9882-c7d2-4440-917f-45879d42464b", "comment": "Malware payload (Formbook)", "value": "56536992e3e43c0f39e90033a81e76d5cdd19a11c25b4f69a740b5590764118998515e2e9c1420f4ea238f86d8ab0105", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616175621, "uuid": "a329c6f0-a6e7-4dee-843b-1bf6fa36bb73", "value": "A2B423B3B7DF0106E065445A4686C8CAF796064B673E771079C6B872E86B78C0BC5E0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616175621, "uuid": "3454ac73-17df-45df-9c05-973e5bbf2e13", "value": "12288:1WuLag7WAC7svpDjk9bQtTwhS18cKKWw4RnYsX8Csg3GTDaNe8gItDNT5kSueZCT:1WuOg7Ysvhk9bQRwIjbwnrUmVkaPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616175621, "uuid": "bad94d8a-7749-48c6-9693-9421a1998e1b", "value": 508947, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616175621, "uuid": "0ba70177-7441-4fd6-8ccc-2049b39f7c1e", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616175621, "uuid": "aa878a02-1f8d-4691-8b00-d93ad3cc9be1", "value": "DK Purchase Order 2021 - 00041.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671d5212-8889-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1616140928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140928, "uuid": "5aaa1225-399b-45b0-8428-b3b86cafb88b", "comment": "Malware payload (NanoCore)", "value": "dfd64ed73bed3b9a4a7e6e61510d9129", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140928, "uuid": "0f32e866-c127-4044-8362-f146399d61f2", "comment": "Malware payload (NanoCore)", "value": "4e3d69c6a349cb94e4ab760758d6fc26607a4ec8729814c858553d25ca9b84d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140928, "uuid": "7f7f38d8-6c31-49d5-9b73-22c675c8f0c5", "comment": "Malware payload (NanoCore)", "value": "74e113d32af333fc58c21a7c45b828f341b963df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140928, "uuid": "514679f5-a917-43f1-8db1-921d05b4aa4f", "comment": "Malware payload (NanoCore)", "value": "adca80248ebea0c1a3519c5a517296c77ee4c5ef2eb9a410628621be859a0f2f8d4c36d7b40ea9e399adac76c343651f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140928, "uuid": "a06cfb94-f33e-417a-8e1d-9c98926e1471", "value": "72259EA513171A76F1663AB41040F3B53BB0DEE5607AFAB19DD47CA3B8813C0A97AC74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140928, "uuid": "54fc8b2c-754e-4397-bb3f-0e363d042255", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140928, "uuid": "9a892c19-19db-4f69-a1c0-3d28de0b345e", "value": "12288:ddrg4ce4WiSwb96Ot43CvrFkffN1AURnTNl/doBfBcX9FkpjAykW8JfM9Vp8OuW3:r0pn6z9RnTu4t2prLOfA8OuW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616140928, "uuid": "9d4568dc-98c9-44b3-821a-f5df82552946", "value": 995328, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616140928, "uuid": "ee71ad23-b779-4365-968d-ae027d48323e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140928, "uuid": "a6d31be5-aa9f-4844-b67c-2812d7117ea5", "value": "dfd64ed73bed3b9a4a7e6e61510d9129.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44723cff-8885-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616139152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139152, "uuid": "15c3dc99-98cd-4117-8591-464ef1ba198f", "comment": "Malware payload", "value": "4902dfcb86d758b00bcdbc68819056e8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139152, "uuid": "7087bba1-bfd3-4720-9a20-7b65a5f65dd5", "comment": "Malware payload", "value": "4ebbf6e570d757b270ad34adca16513745243cbfe21b5d0da79f9e736ccb5ca9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139152, "uuid": "64693ccb-fdcb-451f-a589-bb88ff648983", "comment": "Malware payload", "value": "d01242e1d07d4a84734ed84a060a77aca21c9faf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139152, "uuid": "49ff358d-fa6b-4a40-b4fc-49b2caad7e87", "comment": "Malware payload", "value": "7fab2ffbccaf5e07876dc984e06efaf860d72db6b642ae8b8595faeba927262c4baaac46ec1070b0217b8172922593e9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139152, "uuid": "ca7a091d-d41a-444a-8f34-d2f85bd5192e", "value": "67F49E33B1A08472C526167DDD0B67A8A72ABFF4691DBA467BFC384C4FBE2413819153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139152, "uuid": "a6d83b81-f2b3-4e9e-b785-8f028b32eba6", "value": "e7ae7ffcda7d4193849b4f8788876ef9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139152, "uuid": "5cdf45a1-94b0-484f-b096-a20c5ea7b82e", "value": "12288:caN/eueXDVtaZclsVCMx6mtn/GVeUOQQ5QwlW8atnvaITKMD:cm/8VIU26s21O5TatSITKS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616139152, "uuid": "af7331a0-ced3-40b7-8b54-d1f42e660e07", "value": 786432, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616139152, "uuid": "c2df1655-f6eb-47b6-856c-35a1a3a1a382", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139152, "uuid": "e43bf6f1-a222-4bae-9575-2b32b86cd9a5", "value": "Payment_Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56fa14c-88bd-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1616163420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163420, "uuid": "486fd2e3-4e4d-4504-be8e-d592309f47a1", "comment": "Malware payload (GuLoader)", "value": "6ebeac7ad95f433b0700033d06d668b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163420, "uuid": "7c760aa9-9eb0-4de5-b986-fcf9d004c825", "comment": "Malware payload (GuLoader)", "value": "53180a35165cd2b407bee274b9872b94f849e73c7b42dbd9370eecf0f4cc00e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163420, "uuid": "1e201937-531e-4d9c-be19-23dd9d258af8", "comment": "Malware payload (GuLoader)", "value": "a6cbb19cf2685d01b46aa1dd80145924d75ec0ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163420, "uuid": "6913a3b1-6406-4770-9618-15ca5119499d", "comment": "Malware payload (GuLoader)", "value": "6024c1359a49bd99a6545c8e73f623532f6de012bfb2600248b56848f338cc841c6b3ae5cc917f085a6c6e2231066b68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163420, "uuid": "0f4083c9-c338-408c-b296-8346d91f3042", "value": "488317C2B164BA31CE84C2BC9E35762B49DB187015D38A7377142619EA77FDA843137E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163420, "uuid": "c5cae51a-7e19-4ad4-aa1b-c9b3032eca89", "value": "875f8529a889275b5af25a5458b66f8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163420, "uuid": "a6d4f66a-3f2e-46a0-a264-68e5f54316cd", "value": "768:uTpR7MsTycuL75tQSh/NWAUuGK+3geazVcgcGVwAw2wl/P3UalyY+DB3CgiTaamG:uTpRQ8BO3Q4NbU1AGN4mlVU4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616163420, "uuid": "d1e87750-e0c7-4f5e-b365-94f7decf8a7d", "value": 81920, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616163420, "uuid": "72322e53-0412-4d3b-a80f-e47bbc1bc2bc", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163420, "uuid": "119d0f11-0b52-472b-9161-7ccecde2270a", "value": "6ebeac7ad95f433b0700033d06d668b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e3c342-88bc-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1616162934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616162934, "uuid": "49092867-3a61-47db-827c-d630682348eb", "comment": "Malware payload (SnakeKeylogger)", "value": "1e3429c107598c6b08a761d0aa711d2e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616162934, "uuid": "d7abc217-3f01-47df-9f5e-5d8fe0dc498b", "comment": "Malware payload (SnakeKeylogger)", "value": "5470bda3414709c736c8c627a293b98455e064870e2d6ed3087b8a843ec95e1c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616162934, "uuid": "b2354eb9-db15-4082-85de-3c6ccbb3dbbf", "comment": "Malware payload (SnakeKeylogger)", "value": "37b24e8b9bc870d54e2533b4f5bf75700c86e48c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616162934, "uuid": "da940def-91e5-48d1-83e9-b1638fdb1386", "comment": "Malware payload (SnakeKeylogger)", "value": "43b770a7cbd12c8a0f8f8a0d7cff92f037134583c6ce3d86fb386a59e6bc94288e91f0eb1ca4ceced4ae4000306a0c56", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616162934, "uuid": "5fd2ea8f-76d9-4581-a86b-bb6448b8299c", "value": "8255D0F51602F789C1935E428A23F40C770BF42382E1D89CFA9FD77E6BEE9849646518", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616162934, "uuid": "abb63a62-09ee-41bf-9297-bb0a51b539df", "value": "12288:DtRYtRYtRYtRYtRYtRYtRYtRYtRYtRYtRYtRYtRYtRYtRYtRYtRYtRYtRYtRYtRL:DwwwwwwwwwwwwwwwwwwwwwwwwYV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616162934, "uuid": "ac5a9b90-491c-4c5e-9994-ef7bea348463", "value": 1407564, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616162934, "uuid": "974ab96e-b44d-447f-b166-a91101a5b847", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616162934, "uuid": "a075fcdb-d632-4f23-a490-559bb488689a", "value": "IMG_724_Scanned_603.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9610011-88a6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616153629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616153629, "uuid": "b1c5e2e7-021e-411b-b128-92a83fa43851", "comment": "Malware payload", "value": "eeb057f118eb17b969f3579acd37cf3f", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616153629, "uuid": "88b17a84-2452-4f11-84d5-b72ad3adeef8", "comment": "Malware payload", "value": "56580a86516ca06756bcc80d5b4ff4a2c94e768a8bea105261ee5c4550a2752e", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616153629, "uuid": "0c54b6ec-cb36-44ab-8d4b-5f384dbb2549", "comment": "Malware payload", "value": "84e2587ce7049519cb129d48f57d7157219c461b", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616153629, "uuid": "28aa5bed-2283-4a30-aed7-2c1ff8b13865", "comment": "Malware payload", "value": "9fcc22f7404b3ef93d41a7aad43650e83ba157e8a97fde25c82873feab60c4223e7dd5a302efd1ed819e46679101995e", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616153629, "uuid": "20e09213-a71e-49f9-b897-0e7deb66d69c", "value": "761712A7F3989C19CBBAE232853413B2B14B5E507B17A1725D44B2A42CF74F4E609FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616153629, "uuid": "b71df0fe-d42c-41f0-9f0c-79f6c554ed96", "value": "393216:PhdQkRlwcUrn3CNOYtxWbh8BrUA8ctZMRPeAPHvzi:XRlwcnNOKFl6PeAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616153629, "uuid": "d62156d4-cf9c-4820-9535-03f4b77c7ebf", "value": 18969983, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616153629, "uuid": "86797171-930d-4c2a-aa9a-f1fba3e19aec", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616153629, "uuid": "5b51ac3d-c1ae-4efc-966a-696ea89ad9a2", "value": "com.camerasideas.collagemaker_6686_apps.evozi.com.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a21f1f32-8880-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616137162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137162, "uuid": "11f5f649-b629-43b1-8d5c-390611309f39", "comment": "Malware payload", "value": "30c2b17d12868ff1dcd3519e030a43ae", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137162, "uuid": "5bac5f49-1656-49f8-b84f-67e2a0138df0", "comment": "Malware payload", "value": "59829b460bf8c24e06dc9c0545b1541fafb20b52a101a21d841dba14051dd81d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137162, "uuid": "da12ff44-58d7-4b9e-8491-cbb5a56ff312", "comment": "Malware payload", "value": "b2454b095fb660eba7e0614250687a1063c85d34", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137162, "uuid": "2bfe5039-7680-4151-b977-529b82cf9bd8", "comment": "Malware payload", "value": "ffae3319f433d1f3b525d8a99ea7ce869f21542735a61d26860512098f03a8fcb8c3aa047a8faa9d116c412c4587e5db", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137162, "uuid": "b2574c9c-32ff-409c-973f-780bd2330263", "value": "6075F1F0055994D8D7EBADC22A56B0582937F93A58D05398F2EED77F337B200E82AC51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137162, "uuid": "23791de1-2eee-4c76-9324-ddbcf9a2a28b", "value": "12288:hqVqVqVqVqVqVqVqVqVqVqVqVqVqVqVqVqVqVqVqVqVqVqVqVq7ovj5Q:hYYYYYYYYYYYYYYYYYYYYYYYY9r5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616137162, "uuid": "6156e48a-e0d7-459d-a5ca-cc71b87cdd11", "value": 1592362, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616137162, "uuid": "720d75a6-8595-45c5-b818-8a9b44b1fd58", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137162, "uuid": "3faebc89-2817-48cc-94b5-f0521e7584d6", "value": "PO 848394.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35433d02-88df-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616177781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616177781, "uuid": "5f9a7e9c-0035-47ca-a544-26c2045690c4", "comment": "Malware payload (Dridex)", "value": "57a0fcadf50e421141710ecfc58216cc", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616177781, "uuid": "cc0424f7-b218-464f-a56b-fa8f7205bd7e", "comment": "Malware payload (Dridex)", "value": "59cd9e8774a956a7d4225b4218c134bd75c08063989143d15a6e799e8518197a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616177781, "uuid": "922e2ae7-9eed-4248-a249-8d23d24e20e1", "comment": "Malware payload (Dridex)", "value": "d70f2acf8d017a10d0addaba41b808b2bfd71954", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616177781, "uuid": "56e93272-2cf8-473d-b707-d15e5cc9fcf2", "comment": "Malware payload (Dridex)", "value": "79c5f5afd7bec93b9f4b8ea296350ebedf28013c1d343774330443708eafe187c8d93d9b126516848cce94dac8df163d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616177781, "uuid": "eb13d366-0ec8-4255-87f3-cb2be6faeeab", "value": "4614AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D164D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616177781, "uuid": "496333b6-8eab-4965-97eb-25451377e966", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616177781, "uuid": "ee83e7f7-f2b5-4c09-94c2-b62978d7594e", "value": "3072:s1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:oi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616177781, "uuid": "a126ceff-608d-488e-a0f4-c54c47a71371", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616177781, "uuid": "f1b07ea6-94e7-43da-bdbb-73e0c71ca1ba", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616177781, "uuid": "4bf195b3-32d8-4681-a418-5b34cca8ddc3", "value": "59cd9e8774a956a7d4225b4218c134bd75c08063989143d15a6e799e8518197a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6523b069-8882-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616137918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137918, "uuid": "245d5f6f-9dac-4baa-8e0d-ec15d522fdec", "comment": "Malware payload (AgentTesla)", "value": "326bb24b7f2cdf7faa01750091d8ba81", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137918, "uuid": "455eb4ae-35e6-43ca-a28f-ff9da130fbc0", "comment": "Malware payload (AgentTesla)", "value": "59d0ce5b855a9cfc9ea7d1dc399a1308c00385ee2c13ce057e1eb509123b692d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137918, "uuid": "b1f3e519-3eb4-422a-b416-d2a69ec281c8", "comment": "Malware payload (AgentTesla)", "value": "191a54fe6464fea4b3b72c314249050fdedc4665", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137918, "uuid": "ace168dc-1f6d-41c5-a501-97ce4d4640b6", "comment": "Malware payload (AgentTesla)", "value": "1bc629ff9504f1b07e53a0f2aca455996798d739ba77e7c70e482f36ae451690d20f0320dfbe169faac0d9f997fcb549", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137918, "uuid": "b320dd16-5f66-45db-a5aa-3051372dd9e6", "value": "0AC5334BF6D37F05D5BAE135D7D9D09800248D052A119C8B62ECB31839BB7B526F8BAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137918, "uuid": "2caa26ed-3316-41da-8bed-bfadc31b78ba", "value": "49152:h4IRWYngCqjsgSNe4DWCOxr+0gii8BER4P4cVwhXuvCzf91:EvCqjWLWCYr+nBiVWevCzf91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616137918, "uuid": "4cda5d1f-0a56-4d50-8401-a2ee926ab662", "value": 2520064, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616137918, "uuid": "6ba30da9-2b1e-47c4-86b4-e4d5addea3da", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137918, "uuid": "48b673ef-d5c1-4079-a32a-59c0f3907cda", "value": "FebRevisedSOA.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b305f7f9-88e0-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1616178422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616178422, "uuid": "8d902b0e-51f0-48e3-8286-4c4001f7f514", "comment": "Malware payload (TrickBot)", "value": "e41235a49dc61eed4e646cbb1e753269", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616178422, "uuid": "43f76e07-2c94-4f6f-bc75-803590857e23", "comment": "Malware payload (TrickBot)", "value": "5c097be39146bcc3f26cba610fb420ac6ff5b3d9ad8f145e801eeba6facea50c", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616178422, "uuid": "5c6da750-c64c-4e9d-b387-a7fbf8183ac3", "comment": "Malware payload (TrickBot)", "value": "f112798b52fa845fb04531dfd49d825cfbcfcb30", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616178422, "uuid": "fb6b68b9-5650-46f2-bc9f-40658c4b3e66", "comment": "Malware payload (TrickBot)", "value": "e326800bad07a402bf906ca114f39d78abb162c70177470720bfc253d2891d7952799901d0b4108d0ba1f7c4746f1329", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616178422, "uuid": "53f9d11e-a9d5-40fd-95e1-476ebb04d8b4", "value": "7083AD2DC6043E84CD55AE3FC20D19F537BE1666646BE1DEA3126A04BC625B3CB8F05E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616178422, "uuid": "cc28e94b-c7c2-4315-827c-7fc5e62649cb", "value": "1536:v3aJOH8N7gUvzTTy68etZiJ3G4oiS1+KsYeBoKKY1mmq4E:yxv7y6GJ3h+3sYeBo8nq4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616178422, "uuid": "f174adc4-a212-455c-8ec8-1f8e88485255", "value": 80742, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616178422, "uuid": "5e94ee9f-51b5-43c2-99ae-3cc6b4750f94", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616178422, "uuid": "21e270a2-dd02-40a6-bec7-2d696a9897ef", "value": "Attachment_.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d2ea21-88b2-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616158460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616158460, "uuid": "a7f84778-47db-45f1-b762-f2db22810e04", "comment": "Malware payload (AgentTesla)", "value": "bf1f9bd058413cbd3b287a14e7c1dd91", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616158460, "uuid": "6d9e1193-5cc2-428c-86ed-9fe6709978bb", "comment": "Malware payload (AgentTesla)", "value": "5c8868a67798f2d72ed1415194fd3b2f32c8faef8fa3c2851d4bf2fdd3e41b5b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616158460, "uuid": "818968ab-916c-4787-bbec-1f9148e0fc95", "comment": "Malware payload (AgentTesla)", "value": "7e87982a148a1be25a5213c853e3aff528eda08f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616158460, "uuid": "3478e858-5256-4cce-8486-6fd3c7ed06a7", "comment": "Malware payload (AgentTesla)", "value": "0ccc79ee09ca0bce8156893ca1895c56816eb6477517fae84d1e90c137c4addcc1393072dc0f8b7c9851c380fd557f01", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616158460, "uuid": "4a8a64b1-c15b-4b05-b0d9-375d19ad910c", "value": "95C533F62D419500EC9F68385BE6ADC383325133BC28F2BA4E75BEC557A57302425E7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616158460, "uuid": "a4564855-159b-465d-b987-456272d2cd38", "value": "49152:Ayo/Qzro9e9AWnJyGHBWbRy+ewni9A7bGhFSewyOGGGnG0GGG7jpP7OGGGTU5dUD:AyVr2SNnhKvemi98bW4ewyOGGGnG0GGM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616158460, "uuid": "5383688a-b7aa-4682-8a08-444fcd0f6b9d", "value": 2496120, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616158460, "uuid": "a698fc9a-7585-425e-9dd2-8fb591d3822f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616158460, "uuid": "a5bdbb75-beb0-4441-9f9c-1426dae00dfb", "value": "FebRevisedSOA.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58cbef1b-88bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616162379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616162379, "uuid": "33234105-dbb2-4702-8358-f95a6604f5f1", "comment": "Malware payload (AgentTesla)", "value": "e4688bf04465c2b33cc6bd0acdf20ff7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616162379, "uuid": "2b81b649-f258-4599-b442-a7a65ab7a364", "comment": "Malware payload (AgentTesla)", "value": "5dd92be22d005624d865ddf07402eb852426fc97baa52bbc58316690d41adb74", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616162379, "uuid": "4c8fda11-6ea6-4c7e-896d-393abb05945f", "comment": "Malware payload (AgentTesla)", "value": "0a29d3b4703563504e6944c7043e22f9b0a742ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616162379, "uuid": "010e7db2-1b2a-4ae4-9502-a8e419b33e85", "comment": "Malware payload (AgentTesla)", "value": "87d01f011a0a24b200716be28c5d5d3c3d106dfc66cae9e1e4150dc20d514b9801f6bf6250591950f994b2b9043d7575", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616162379, "uuid": "42073aa0-8d2b-4444-befd-e09e22bf19b8", "value": "1DF4BE01A3B6AA18F33B13788274120297F6BA46D73AD77DA89050DE1EB3745467B337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616162379, "uuid": "4cdb9759-6518-4a53-967c-cd19f86412d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616162379, "uuid": "d8b4006b-8a69-40e5-85ca-90aef1e4af44", "value": "12288:Pq5jCt37qhxSwqY8rgIBmLXEZ76l8PEbKt41T0VfIAMGmcvu4Yfb+Yxt5:PwjCtLqr3SuEsutlgemSu4Yfq+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616162379, "uuid": "df689b8e-9b57-46de-94be-4f90759d6946", "value": 789504, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616162379, "uuid": "45c02575-4daf-43c1-9b1a-400f5ec76bff", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616162379, "uuid": "00164f73-635d-48de-a484-566af0611d1c", "value": "documents..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9dfc18e-88e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616178970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616178970, "uuid": "07158757-5fe3-4a51-bedb-bda273e8bc4d", "comment": "Malware payload (Dridex)", "value": "ead2f524591501d0eb880579b0ede114", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616178970, "uuid": "fd5eafe9-e085-4c5e-92e0-6682879b2589", "comment": "Malware payload (Dridex)", "value": "5f770796b080edd9baf68754879b6150e7958c5a14e123f6f9b4f7f4f596adde", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616178970, "uuid": "1287c95d-9c5e-4a4a-9e00-a5020b0f08ca", "comment": "Malware payload (Dridex)", "value": "9139fa32c2056a2c878a513021ffc33d3ee42837", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616178970, "uuid": "736e2565-cf9e-409d-88cc-9d9567ea1a26", "comment": "Malware payload (Dridex)", "value": "f8e92ce93af5c6faa33f020a8b3d258ec28015866b300a41adb94d2ee90f6ebe8e9a32c312e792bd31551a35bf93cb20", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616178970, "uuid": "f500026e-ba5b-4566-a9a6-087a5fdf4b97", "value": "6024CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616178970, "uuid": "580487d1-b0e7-45d6-89d8-77d614680afd", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616178970, "uuid": "5b35701e-49a7-48e3-98f7-5a41e33bbc6f", "value": "3072:S9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:S9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616178970, "uuid": "f0aad966-ee3d-4394-b039-c535d83ec1ae", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616178970, "uuid": "b48892e5-f878-420f-ba04-13c8a0fece65", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616178970, "uuid": "bec219c0-45e7-4706-a598-bd8edf2a2503", "value": "5f770796b080edd9baf68754879b6150e7958c5a14e123f6f9b4f7f4f596adde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0281bee6-88d9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616175119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175119, "uuid": "23295a2c-710b-4f8e-87fc-c9dba307d1fa", "comment": "Malware payload", "value": "1308478b9dfa9544e127daaf4edd18f2", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175119, "uuid": "cf59053e-8a57-4cf1-b5b9-b1bae6e47716", "comment": "Malware payload", "value": "5f8e3b19cd4d25ac396cf64f6f448d88e301cf899142bdb03a28cec42eb71389", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175119, "uuid": "35dc5623-a630-428c-b81d-e985e2f2b22b", "comment": "Malware payload", "value": "264e2ecaeb06c43d13b3861d035671873ab4885b", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175119, "uuid": "b58849ca-1024-4ee6-8aa0-0031da50ef4e", "comment": "Malware payload", "value": "7b45d6f6daba8f8e7899f16c7f62f207f24cd6e323a57959c0a0913166cbbed838c4b7ccca8010dc4abf8613eaa14728", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616175119, "uuid": "f4b73160-b45e-4993-8ed9-a0b983846622", "value": "638539819550A624F7392B75B8A20C29C2267FD1FDBDEDDE2D04F22597BA6D2F0006F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616175119, "uuid": "8b1fc017-c92a-4926-baf4-56e4243119c4", "value": "6144:8FyUkR0wjvF8W3I7qDGvJZqrlh8b5IoEanrmmBTNiZLiss9dYVMRacqMvWvtMN7C:+ZmMwZ2vYMRsM5o46nfpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616175119, "uuid": "37643832-90c2-4a6b-adde-07a3785bfdf5", "value": 1756160, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616175119, "uuid": "fb6a31bf-eab3-490a-b643-38e328788941", "value": "application/vnd.ms-excel", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616175119, "uuid": "6251ed16-c147-435c-adba-6fb72d77165d", "value": "attach_1278162880_2791882709.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e00bd8-88e1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616178915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616178915, "uuid": "18929a36-52a3-420b-bf01-5dc08eb4a68b", "comment": "Malware payload", "value": "1759c59d56048c47ad1869fe6d42f9f2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616178915, "uuid": "bb778b33-b66d-4a67-bec4-3e6b708d7eab", "comment": "Malware payload", "value": "6180ddcb76aab87fc44cfa5d1dd8ca3b824a6a8b83f67a0c549b0e7e1debf5ba", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616178915, "uuid": "72e9c146-7f17-497d-8d96-22cdce020289", "comment": "Malware payload", "value": "0177afe0bd6aa84fbe9c1c3e67d106c793ea0368", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616178915, "uuid": "ab424aea-b845-49bc-a045-3a72538d8c0e", "comment": "Malware payload", "value": "5599dd05cb48ceba35cf565a4815f669bc76ffa5f685ade9ea3975220e5244939d7568841449d10940397bef508afb03", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616178915, "uuid": "2a8e9bff-9334-4303-b772-1b1025c464a9", "value": "A9444B04625A5EF6E86383BC4813D312FDE774806728CEB787B449392E071D67A6DFA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616178915, "uuid": "d4c6f2a6-7573-461f-b141-879a5097ad3b", "value": "76c0dc0a717911e0096fc05553ee5500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616178915, "uuid": "922dc069-7a6b-4b21-84b1-240b3ac39000", "value": "6144:w3XnDg+ka1Aa1iBN/g4+vTaGd6SALohvSm:w3XnDmo1ONY/vMSALoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616178915, "uuid": "aa2c69bd-6b5b-4242-8108-58baf1cef392", "value": 262144, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616178915, "uuid": "87bee765-e93c-4701-a136-7e5c587f8ab4", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616178915, "uuid": "ae776cca-44f8-476f-aa98-464a88d2f982", "value": "plain.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c596513b-88c1-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1616165138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616165138, "uuid": "5736f869-19d0-4426-a5d9-799780fdc87f", "comment": "Malware payload (IcedID)", "value": "27f9968a69662b25ac670e921446dd60", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616165138, "uuid": "bbf17852-2eaf-413b-9c70-11b2fe3429ea", "comment": "Malware payload (IcedID)", "value": "64025178d67fe7f49c10af7a51f6e950eb2f97280344d3c01a521a9b725d16fe", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616165138, "uuid": "bdc5c673-8cf2-4bd6-ab0b-b9cca5caa59a", "comment": "Malware payload (IcedID)", "value": "300f87c4a591a0452e2c027eafdbae70f35cbf0a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616165138, "uuid": "50cdf321-62b0-4efb-b91e-04aa7eec433d", "comment": "Malware payload (IcedID)", "value": "47233b1eca4e57ec540b13a0f6a950b23c01b175ddf64dcbe47f79fe1be164c09db1b15d8484d25cca3bf7ad7cb9da50", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616165138, "uuid": "118e3200-527a-4612-8776-d0640bdc2f42", "value": "55847155B5668936EA460F7394FF8DF40677EE50961B4E4B3F8AF3085F313402A13A8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616165138, "uuid": "cef17c4a-6c32-4a01-ae71-a328a82eddbe", "value": "3072:XzxQ3STSAt/BI/s/C/i/R/7/3/UQ/OhP/2/a/1/I/T/A14mn1t2ftZrq:jxQ3STSAt6Uqa5DPdG9uS9QLM4mnnYTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616165138, "uuid": "93655efe-0cfb-4a79-9c59-b25b91843602", "value": 387584, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616165138, "uuid": "b0324998-97b5-4efd-b752-07064411293e", "value": "application/vnd.ms-excel", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616165138, "uuid": "6fffadf0-26f3-4638-addd-802f3dd14e8d", "value": "document-1620311824.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "182a187f-88c6-11eb-abe1-42010a9c0039", "comment": "Malware payload (BazarCall)", "timestamp": 1616166995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166995, "uuid": "769afbbd-4d80-4803-bbfc-27daa9b35906", "comment": "Malware payload (BazarCall)", "value": "3b741d6798735efdae2d18c80716ee4b", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "campo", "colour": "#B79F18", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166995, "uuid": "b99ed21a-885d-45bb-b331-c8cd19579068", "comment": "Malware payload (BazarCall)", "value": "64bb301a1ef092d05ce99b282df5d6967b01a4598c292d14608137a180ecaece", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "campo", "colour": "#B79F18", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166995, "uuid": "96f056db-9b33-437c-98f7-5b8ab2b5ab92", "comment": "Malware payload (BazarCall)", "value": "97628ead21544a7b7a065df10c2829207b5c4911", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "campo", "colour": "#B79F18", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166995, "uuid": "e98d802a-e50d-4c6e-914d-62acc33eab32", "comment": "Malware payload (BazarCall)", "value": "a519766aab63778125cb48309e7e1ac9912b23596dae6f01cf3a9a43422ff9bb3413a1bd4d259106931d61daee472d45", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "campo", "colour": "#B79F18", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166995, "uuid": "f54accf4-b595-4204-a06f-c8824c4aec11", "value": "0F64BF78B6502CE5EE7F427FC9926C99637239128B97DC8E8064A7D30E63371EE16D04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166995, "uuid": "8122d8e3-71ed-4ae9-9f3f-3d85ce50068d", "value": "7babf25e4ed6abf9b92ec07e1cf261dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166995, "uuid": "9b6467bf-b601-48f3-b63f-6be438d177df", "value": "6144:FK5opSaFD8d2KXgPLxLNIafPHBfXbMd0xbh/8N9FFxeOTSsJKalmTT:k5oprFD8d2vwoHBvgd0xo9fxs+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616166995, "uuid": "b8b0f7e8-a799-4037-9312-4043ce9d0d7b", "value": 333312, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616166995, "uuid": "e5249fc7-a0a3-475f-92d9-26c79ac6c948", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166995, "uuid": "c6c08e02-fa19-4849-abd8-3f4c289853c8", "value": "fkt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b96c8e-88c5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616166773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166773, "uuid": "35a3ed41-4803-4ed4-9001-a2b95116b4eb", "comment": "Malware payload (Dridex)", "value": "55d61a3057a1710ccf03b6ed01184a84", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166773, "uuid": "9bd19a78-64ac-4a30-a1c6-5df7dc075260", "comment": "Malware payload (Dridex)", "value": "655ca6717f11eacade50926a94d9e2143f9910ab8de0e32d49eff8949e71f87b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166773, "uuid": "a41a16af-af0b-4e19-bbea-0452b5324eeb", "comment": "Malware payload (Dridex)", "value": "4fa8c0f3ce3fe428ddb056c886261ab3f5b572e4", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166773, "uuid": "d00c2107-0a0f-4ae2-92fa-2cd2faf440e0", "comment": "Malware payload (Dridex)", "value": "85a960e30c751aef42849f8734d6bbaab83dcd4d770a5a7ed2e6b24de57c245d5ce175ec7153840bd2d8fb3a801073fa", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166773, "uuid": "cac4cc18-7deb-4f93-8e64-3ca24f3cbe3b", "value": "4714AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D164D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166773, "uuid": "b697bfbb-a9d0-49f3-91cd-10951fe1d764", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166773, "uuid": "a77d6947-e38e-4e02-a4bf-eb0a5862b0d4", "value": "3072:P1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:ti78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616166773, "uuid": "58a13b03-400b-407e-bb10-5d7540a6c86e", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616166773, "uuid": "56bcffa1-57a7-40ab-b1d7-6a15cb2fa2b8", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166773, "uuid": "52955fe0-ff64-42f3-9fc5-cc7d43f1360d", "value": "655ca6717f11eacade50926a94d9e2143f9910ab8de0e32d49eff8949e71f87b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a177738e-88bc-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616162930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616162930, "uuid": "a46d553e-4cf2-4126-879a-304959025923", "comment": "Malware payload (AgentTesla)", "value": "a3c96ef493a18ea6e5d3a6d52b7a3cca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616162930, "uuid": "6ddb8dc1-7ec2-4ccd-b87b-5c0ee8831ae0", "comment": "Malware payload (AgentTesla)", "value": "677eac0c1be46ba1f945b06b1905fd0f098aa3dbc5d37f1f575dcb7612a120a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616162930, "uuid": "85e3a488-f047-484f-9dc8-82e9108e1158", "comment": "Malware payload (AgentTesla)", "value": "485f99ffd78072a05c05260481858f347542a61f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616162930, "uuid": "e0c1bcbf-e9d0-4999-aa51-2fdc23af31a0", "comment": "Malware payload (AgentTesla)", "value": "4f96ea794b2e0266d32635b362ee6a3b6204122b3fe1e8293704f9ce9412da19b1e51765f0fec5f74837b991f9872ffc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616162930, "uuid": "caaf4c57-2a54-417e-8218-2ab03cf891a6", "value": "46D3A0F875046DE6562F576BDA5AFCE803B627628ACB64CD5078B7C306B3365FE02804", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616162930, "uuid": "ea1cc493-7754-4878-9a57-220c9798b35c", "value": "3072:595ebQyCDhw4CwJwxXYJZF3cw0dVcD33xmcu38E/eMA9c9/23LAFBkbgyvAztlmR:59cIDhw4C3XYlKo3BmZmjMoeDUUwm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616162930, "uuid": "39bcea86-2013-449d-a9c9-466728e5af53", "value": 130393, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616162930, "uuid": "9348541f-0a96-4fc0-ae6f-90d9ada0debd", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616162930, "uuid": "b0c6eb7f-3ff0-4347-a345-e1778cb833ef", "value": "TT - Order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51d2036-88d7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616174613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616174613, "uuid": "45e4b904-f279-4bba-8817-e52297342548", "comment": "Malware payload (Dridex)", "value": "fe8b13ac3312da42e3ee5b74ffd1b984", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616174613, "uuid": "d0d409b5-e31b-41c0-b3bb-c9f93989f658", "comment": "Malware payload (Dridex)", "value": "6907995a6970e96a100f28b48f88bdc36303398aeea8faef5795a0e21178ab02", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616174613, "uuid": "ec2a8126-b1eb-45cd-9b64-7e815c50e374", "comment": "Malware payload (Dridex)", "value": "5bbebc8d28867ec9777fdfe975f155b59c0911e2", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616174613, "uuid": "6ee83333-6f75-4cdd-b7e4-9fb6a6c45350", "comment": "Malware payload (Dridex)", "value": "aeeb38812d554f22a4401a93964e41d54c374222ffe9a8347ddb1415cb112c4c2c6d056ae54a9be9a75d2fc45cf54b99", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616174613, "uuid": "1dbc3622-85ed-4da5-a367-e34d4ed7982b", "value": "2A14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616174613, "uuid": "5fb7a6e3-80a7-4047-83ad-c17312a68c5e", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616174613, "uuid": "d97cb7ac-cd4e-4666-b100-3467014e1e4f", "value": "3072:+1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Wi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616174613, "uuid": "5de7b9b1-4604-494b-b538-8787221598c0", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616174613, "uuid": "c1f38fa9-bf26-4a4e-89d9-4efdc68ccf8a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616174613, "uuid": "aa7ca55c-37e7-48eb-925a-8fd07c711522", "value": "6907995a6970e96a100f28b48f88bdc36303398aeea8faef5795a0e21178ab02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa73c70-88d2-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1616172430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616172430, "uuid": "e70c8da9-c32c-4989-b0e5-f5a8760923bf", "comment": "Malware payload (RemcosRAT)", "value": "0ffc2fa4405ccafee0472e351799dca8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616172430, "uuid": "bd4b15a1-f04f-4bb7-9d3b-09f07d6c0ae0", "comment": "Malware payload (RemcosRAT)", "value": "6b6d820ce1c8df1c795e938995133201a5c75ad3989cd51568323b671ecf8109", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616172430, "uuid": "59351bd9-bd8c-4aed-8f1d-23329fa3dbb5", "comment": "Malware payload (RemcosRAT)", "value": "9fcda13ed9fbc784a8cafa3f96edcc819e60ffbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616172430, "uuid": "843bb3ae-41c7-4e72-a7fc-ced6c699beb2", "comment": "Malware payload (RemcosRAT)", "value": "37e065b3bcbc211c18eb4b8b902d4593b0f3f85f60c17ed0ded8fba4e2380847027bbd65179c0f57ce76dbe1daef27de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616172430, "uuid": "c1fd3cc4-1b1d-4bcf-b94b-f41f6f461c17", "value": "E9E49D11A3A5AB48F33B53B4817811029BFAB946D736D77DA98050CE0D73A458B7B33B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616172430, "uuid": "cd20c22a-266b-4aec-b20e-96fce86fe175", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616172430, "uuid": "1737ddfa-41cd-4c35-b8c6-4fca903ada03", "value": "12288:Piqqh8QqSxiPeDMfTw/eLAO6X7FOFc8Q5:PPqhzqVer9LrFOK8Q5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616172430, "uuid": "6fe326d5-d569-4518-8c99-4cd0a4809669", "value": 679424, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616172430, "uuid": "db3a7bf4-aea7-4a74-9722-689bddc502ec", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616172430, "uuid": "f3582c35-6257-4ef8-8d78-5f97117fc838", "value": "0ffc2fa4405ccafee0472e351799dca8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1178fabc-88be-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1616163548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163548, "uuid": "58f2907c-af36-4bff-81e8-2671a0b9fc2c", "comment": "Malware payload (RaccoonStealer)", "value": "b8f70e364e9e6370d015cc36c2ffda0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163548, "uuid": "32d18626-ca93-4429-bccc-6c5cd1121101", "comment": "Malware payload (RaccoonStealer)", "value": "6c6ab740e7d1e69bb05349e3b27b1a52a4e0bad10ef8b019147c9d87755f95cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163548, "uuid": "b01cdc31-14e9-477a-9f04-17f20407a3e6", "comment": "Malware payload (RaccoonStealer)", "value": "8817babe4471ecf866d30f2b585e38d3d24b3007", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163548, "uuid": "0c3858d1-463e-44a6-ad54-590481afabdd", "comment": "Malware payload (RaccoonStealer)", "value": "f8890787f7b4ef349cca701d6b28dfb4e41f6bd5b37ef179e0624b35c0afe4a49884fca5875e1e2d34fb2ef3b3b9c7b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163548, "uuid": "7bd11b50-44a4-4d03-a731-adac6bc3968d", "value": "4BA4011176E6C133E46906B24865C7710935FC705F359ADB3BC42B2AAF367C1AA3634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163548, "uuid": "e1ee0db7-1a26-4245-a465-bd9d75ed882b", "value": "c44af05e09fe671de192a7ec549c097a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163548, "uuid": "9ca57df1-9faa-40b9-bc13-e1fd84c8c0ea", "value": "12288:QYAGRMbNEIhGS3CMJTm5Y7hG543mhAX1t9xtxE:Quk6+GS3CMmu7VHntx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616163548, "uuid": "f91250d4-5da4-4a18-ab65-f1efbb07d408", "value": 455168, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616163548, "uuid": "0530ee1f-d19e-417b-8fcf-c4a892aa9dbb", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163548, "uuid": "905aa65e-183b-468f-b02f-bcc9ef88391c", "value": "b8f70e364e9e6370d015cc36c2ffda0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a836c9e-88c6-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1616166999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166999, "uuid": "7a518757-6619-4c53-9f16-f94038c6cd73", "comment": "Malware payload (RaccoonStealer)", "value": "a6faaf165a712f58eec277d4e8599a0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166999, "uuid": "0295b8f5-b53d-428e-9abd-72fe34ecdc57", "comment": "Malware payload (RaccoonStealer)", "value": "6cf7b8a22a4350220cc796f28cf8ad0c7b63e62c8d3c93e5772e726ca23496ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166999, "uuid": "661169b0-5d44-4a00-9628-3d2446209784", "comment": "Malware payload (RaccoonStealer)", "value": "c4b643424ea385e2fedad88fa0e52459b2964e31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166999, "uuid": "dd359046-51dc-461f-8b0c-9bfa8cfe477a", "comment": "Malware payload (RaccoonStealer)", "value": "446ff42f2eaf7676d230278cffc3003ac40be899da613b9da049c4153e287ee3aef8251edc69116f1b0ec2161b86f947", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166999, "uuid": "a07f9f5d-9079-46a8-8c89-39235a2c8198", "value": "B345124176B37AA8D03A8776F056C1430BF6BC1AC253C877B9E5B2CE08B6539967D132", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166999, "uuid": "910a17ec-1f74-477d-943b-958428dd9ac0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166999, "uuid": "af923dff-b391-4ebe-bda7-44ff7ca53924", "value": "24576:r7lwve5WmLZU3fj2L8OO43yJRoIP+Mcf4ETE8lut6oBL8Tt:HlN5WmLpLg68o5dlTE8wt6oBL8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616166999, "uuid": "f98facb5-0c4c-48b6-93f5-b1f7379dfcf6", "value": 1199616, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616166999, "uuid": "faf85be3-cbc9-48d2-a89b-eb45b93ba1d8", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166999, "uuid": "e80f162d-4c5c-422b-8fd6-f25f2a7f0f2f", "value": "a6faaf165a712f58eec277d4e8599a0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "230f0d9c-8888-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616140385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140385, "uuid": "6fc8412d-e3a5-4e16-a257-0fbfc7ad1c4d", "comment": "Malware payload (AgentTesla)", "value": "0c96b6d6a636b92a46aa05d3a8537b0d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140385, "uuid": "f0a3246d-317d-4a0e-a1d7-f24ed9b185ab", "comment": "Malware payload (AgentTesla)", "value": "6e5df6c6740f348f8bbf7fc4ca4ed16f32b7d69cb50610bdc205d5c177075cf9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140385, "uuid": "2de6b03e-666d-430c-afd3-f67cec0fd66d", "comment": "Malware payload (AgentTesla)", "value": "1166bd580b78d755b20fbe3dab7fb09636b33b98", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140385, "uuid": "fbba900f-f47e-4a45-a11d-7795124a0d52", "comment": "Malware payload (AgentTesla)", "value": "3326d5f85e97f2acf496c8efcd06217be3c37f6605b7797a6c9686c0d0428368f7f0bd68687fb00a3a4874f89082d499", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140385, "uuid": "42174930-ecf4-42ea-b07c-3851fca10a3a", "value": "37059E1363D06F89F17E677E90A8451153F2B85AE336EABC3CA541CE55A1E80C7B07B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140385, "uuid": "2b3ce008-911c-4037-ab42-bb5904c07f53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140385, "uuid": "faf03fa0-af53-445f-91fa-298cc3e8aba5", "value": "24576:Kx5WgKMULYM6NnwZOw3jDen69LqYgYqQe7z+CDNoWD6ldDpbgU:Kx5WgKMLM4nwZOw3un6IZQe7zdRTD6FX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616140385, "uuid": "e844fb38-1374-4aae-b1fa-a95cae847049", "value": 869888, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616140385, "uuid": "bd047118-f4b4-492a-b729-e093ab20e9ec", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140385, "uuid": "188fb80d-12d4-45e3-a3a9-ac2c27c2c346", "value": "0c96b6d6a636b92a46aa05d3a8537b0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a7acccb-887b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616134948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616134948, "uuid": "cd586e24-85b3-49cd-94d3-bf7fd68c381a", "comment": "Malware payload (AgentTesla)", "value": "ab664951189788dbd7a9ad194ecee65b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616134948, "uuid": "0631fd9f-8cbe-41c4-bb26-b0feb3a5ff49", "comment": "Malware payload (AgentTesla)", "value": "6f2a8ab32b0665d4fe5e10e0e777107d5dafc553d2dea12fab6f6fd2c9be3ad8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616134948, "uuid": "1850467c-577e-4fbe-ba52-2f52f40402c0", "comment": "Malware payload (AgentTesla)", "value": "60b1ef6ae99e2295451a5d90804565f937ea2bac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616134948, "uuid": "c4364cb9-9e19-46e4-b6aa-d589a3e48dad", "comment": "Malware payload (AgentTesla)", "value": "2c9857ccfd44e45c59dc37dae51202777fc13b22b4fd5ec1d4838e76ab7ead59f2065caf63c9637bb0b8f69b2ea25bc5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616134948, "uuid": "2f66e958-9e1e-4a50-932c-e8058efc8091", "value": "E1A4232B72864FFBE967BBB38C7235D77219DC468F26C00F10453E9D7B7AA096442618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616134948, "uuid": "a58cb38f-ec10-4e22-b8da-3f244c5d794d", "value": "12288:4qkiox1PQL4mh/iwkN6uewfYJgk1DjaNMd7mc:xkr1P9m4wi6uewmgS5pmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616134948, "uuid": "4f484015-032f-4f42-a74c-d18b0f2195de", "value": 482304, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616134948, "uuid": "3462f6f9-e5d3-4296-ba77-fdce6e362052", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616134948, "uuid": "3ef555ac-2d08-4f15-9a9f-8c429426a723", "value": "PO_4500515522_20210317_060435_10010533.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f19aa98-88d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616171731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616171731, "uuid": "e06cd5f3-4039-442e-93f4-6125a856bc3c", "comment": "Malware payload (Dridex)", "value": "d810e2b830b358d08c25aaf303ca28d1", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616171731, "uuid": "4496483e-8a6b-4f55-b5e7-a3ae44324d84", "comment": "Malware payload (Dridex)", "value": "6fd7f870b7b9ca65c3765f05919e4fefe1ffa125aa2afa10f5559ca16dd108e1", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616171731, "uuid": "eeb2c1c0-a7d9-4d92-bbbd-75dc3ba968c5", "comment": "Malware payload (Dridex)", "value": "18926e5b8a389544ca47cb2e96544c8ec63ea62a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616171731, "uuid": "f6385249-ff3e-4681-bbba-f59e4c91ff29", "comment": "Malware payload (Dridex)", "value": "bf8bb2086e721edc65d853c1142849271295380ddc3f83c35a6611472c611c52f6055b213eab2b46643352ab33676d47", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616171731, "uuid": "e6f8d77b-d24d-4c77-912d-45c898fa7bc7", "value": "D724CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616171731, "uuid": "71a1abf3-7edb-4f34-aafc-fdef4d95d227", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616171731, "uuid": "dc4de3d7-682e-4129-bcd9-171588c3d45d", "value": "3072:k9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:k9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616171731, "uuid": "d113f545-26be-4dff-bc58-acbfe6521d9a", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616171731, "uuid": "47a1c14d-8ddb-49fc-8816-4352ab0426d9", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616171731, "uuid": "7b9c32c9-3504-4741-926d-0e81f5bce38a", "value": "6fd7f870b7b9ca65c3765f05919e4fefe1ffa125aa2afa10f5559ca16dd108e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d70c2671-888d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616142834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616142834, "uuid": "4005e43b-0e13-4082-9019-9cbb266d6916", "comment": "Malware payload (Dridex)", "value": "defb4a81a2fc68b8831c884382ede2fc", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616142834, "uuid": "2aac6b2d-7c91-4fd8-a226-8eecc0bf4264", "comment": "Malware payload (Dridex)", "value": "7146c18ce51aad748fdaafc76121aeac2e748ba2d663493e046181bdbabb6d41", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616142834, "uuid": "cabd98ad-fba5-467d-a829-5da51bef7ac8", "comment": "Malware payload (Dridex)", "value": "30f9717782ceec26d2c2bc18b105afadf9b685a3", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616142834, "uuid": "ba2a1578-b081-4118-bdd2-58a7586af75d", "comment": "Malware payload (Dridex)", "value": "91a4fe9ca32ef2e0883cf5e283cc6a15fff91f01d84f3406c4f2b6eee21cf78d3831f6334447652fe048b2299252cd65", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616142834, "uuid": "7e9d57ec-6591-44c9-86e6-7857a85902b5", "value": "FE24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616142834, "uuid": "b827075c-8cc8-4439-9127-aa702e234554", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616142834, "uuid": "e88d0473-a537-420f-be0f-41dd74552702", "value": "3072:a9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:a9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616142834, "uuid": "92933e26-a4a1-4832-bea7-27442d89d34c", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616142834, "uuid": "8eea7bb3-ca7b-4229-ba8c-2f8366d00e4a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616142834, "uuid": "a1f2dfe8-f96f-4b82-9833-cc158d8f6be9", "value": "7146c18ce51aad748fdaafc76121aeac2e748ba2d663493e046181bdbabb6d41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68fbefb2-8901-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616192471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616192471, "uuid": "80409859-1fea-43bb-92f6-bcb131b2d042", "comment": "Malware payload", "value": "c7d5f5c7b980ed645d391b7a815c359f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616192471, "uuid": "cf0a8bbc-abda-406a-9979-35219a84e925", "comment": "Malware payload", "value": "726de7a359a281ab458a76ab5dc032962a3ff783eb5eb1efdc26a8c997ceecf3", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616192471, "uuid": "27cf7aae-d59f-4a7f-9cf9-ce597bfee00f", "comment": "Malware payload", "value": "25fcdc64ec8d300b4fba81f4027172cf3f38e443", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616192471, "uuid": "79dc9cd4-8127-4d3e-b601-cf5f99f033a2", "comment": "Malware payload", "value": "67e3c57b6da1438e94a250ff46a200b97be8b0e30c33b38737da414dc70f418594c7a5643c14021aba12d2d6512e52e4", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616192471, "uuid": "d1695c1f-fb17-4bc0-8022-3cbb8290be7c", "value": "2C14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616192471, "uuid": "449b76ef-0b84-4c05-a4fa-e4a8da136556", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616192471, "uuid": "ea2d51a1-bdd7-4ebc-b0b5-d80a6b059dc1", "value": "3072:E1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:wi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616192471, "uuid": "bf41567d-51bd-44eb-b25f-599a1db51da6", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616192471, "uuid": "1b737eb8-f115-436a-b4f8-f394eeae5fa8", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616192471, "uuid": "66423182-bd22-4056-ba54-b7aaaaee714e", "value": "726de7a359a281ab458a76ab5dc032962a3ff783eb5eb1efdc26a8c997ceecf3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5bbd51d-88f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616186238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616186238, "uuid": "4b8bf740-80e1-45b9-bad3-59c9d1828622", "comment": "Malware payload", "value": "0a9d4ba9da722bac095cab98d4c4c7af", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616186238, "uuid": "fbe214a9-17a0-4d41-83d1-3c7d042e1ee0", "comment": "Malware payload", "value": "737fb9ad090922349b10e080c98812e879368f3141bb07a26410e681a7e4b58f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616186238, "uuid": "f853c22b-a606-4de0-8a1b-5edff36c4e27", "comment": "Malware payload", "value": "87f1222dc6abcd3800a6bcebcfc04547dfd91754", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616186238, "uuid": "509df8e3-37ce-4005-9b4d-7d0ba385681a", "comment": "Malware payload", "value": "604915b391fec3eb133bc38d323e5a112cfb5e4e7ce4bde0c67b19b0bb2805f8641107263e1ddc2f9d7373c0413aa07a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616186238, "uuid": "0553894e-92c5-446e-962c-0a354ea2af4d", "value": "F824CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616186238, "uuid": "ec727c31-b56c-4562-b3e3-6aac2c74ad41", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616186238, "uuid": "3f197338-1512-498e-a9ce-3f27e5b84fee", "value": "3072:s9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:s9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616186238, "uuid": "a768b58d-2e8a-4b4b-8024-8bb7d1b86975", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616186238, "uuid": "9a6d776b-3d1b-4a9c-bef1-0b7d2a361d28", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616186238, "uuid": "7350bb4e-7c44-44cd-9d18-ff74a46d8d27", "value": "737fb9ad090922349b10e080c98812e879368f3141bb07a26410e681a7e4b58f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bac1bd4-88ea-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616182624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616182624, "uuid": "3a501838-6159-4413-8e67-aa2b1c2efcb6", "comment": "Malware payload (Dridex)", "value": "26e5c84c63309358aee4759861675105", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616182624, "uuid": "edaf16ad-628c-45ee-85ac-2f48f4bfed41", "comment": "Malware payload (Dridex)", "value": "73e4a1a2d0bf0ec6419fade20399c9e306df228c6affca4662a32a38782ad8d5", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616182624, "uuid": "1b8a1def-422b-4333-b808-676a90954da2", "comment": "Malware payload (Dridex)", "value": "e228c2a6a2cb36e4c535f3bfcdf173c79eba24ef", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616182624, "uuid": "6b34acb5-c817-4fda-8ae1-c675d33ce487", "comment": "Malware payload (Dridex)", "value": "e4aa4f62f489995be9df009eaf55c03fee761694fa5689e8207ae72cc3c9f05d8674c8f358cfdcc6b5f8fa0c164d3b6c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616182624, "uuid": "b61cc534-a9c1-48e1-b8a2-84a00077a2b0", "value": "E224CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616182624, "uuid": "14f58438-e71d-4722-873f-40c963b74830", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616182624, "uuid": "a1111a48-3dc8-4c76-bc87-a45946315bfc", "value": "3072:E9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:E9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616182624, "uuid": "c8fbb08c-49d3-4b4d-bccc-64e9a3421cc0", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616182624, "uuid": "ecde8b25-9f93-4f4f-95f3-4f13509124d8", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616182624, "uuid": "5da72a8c-402f-43a8-b45c-aa2c030e8533", "value": "73e4a1a2d0bf0ec6419fade20399c9e306df228c6affca4662a32a38782ad8d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c7e5baf-887b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616135005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616135005, "uuid": "215b2b62-ed79-48fc-ba3c-1f60543a238d", "comment": "Malware payload", "value": "a98e8d934f36ab16f9bc4ae0310a1c6e", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616135005, "uuid": "c3ca794b-18cf-4157-b0a3-7ec3771c499a", "comment": "Malware payload", "value": "74107ce87a3e3a3fa24f387fb974de38b8484a3b459207674730ba2b89ba5ff9", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616135005, "uuid": "3dd009aa-a50a-4419-b23b-dab6947f5a74", "comment": "Malware payload", "value": "95c0e37392dedd6b16830e46347a4dd17aaa4305", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616135005, "uuid": "7ac3c753-2f20-4589-91dd-937d499787bc", "comment": "Malware payload", "value": "fcbf0946f6887ea7bb684265d515bfda095119c033f8411186204ea95ab99de0a5da60da6870fc04e83d501cf20efa15", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616135005, "uuid": "228a0089-671d-4caa-9394-a6ab2baa0582", "value": "FBE42348271E03DCFE360BBCF64428EF1CFB945699862C4F6B6D6024D157DF93AA6029", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616135005, "uuid": "e55ef577-5497-4a1e-b54a-5fbfc14ae74f", "value": "12288:vn/gIqR+eDmPjjiQd9/r0NgWVXrepT5tKT7KxQVVEn+Q:vn/LihWviwrogWVXrk5YEIV2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616135005, "uuid": "11c4ac4f-7bed-4071-bb71-48bc6c06a0f0", "value": 718268, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616135005, "uuid": "021800ff-7a16-41fa-aca0-68460bb9c8a9", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616135005, "uuid": "cb838d51-6866-426f-8dca-2779a9bc10a2", "value": "Request for quotation doc_pdf.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d6c7ce-88ff-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616191472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616191472, "uuid": "8e18ac84-ff19-477b-bf03-c8059c4bf70f", "comment": "Malware payload", "value": "ef3c5092ccc110e96a95de817b7837fd", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616191472, "uuid": "bf6ede27-42c1-4852-8d90-1ad6ddab660c", "comment": "Malware payload", "value": "74953327811382444b2d98ad47f65e180245b1d320d5727337d0d3c5563abbc5", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616191472, "uuid": "defd5620-dada-4076-b3b8-0bf5344eea52", "comment": "Malware payload", "value": "99b89a2a14a710f512b6654aaedd0e8f1f8956f7", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616191472, "uuid": "54e71640-8c94-4947-beab-cf8e89ed3725", "comment": "Malware payload", "value": "0a008979863195ed68d80e56d2eb34a39e1de338c358339fd2ba7fbe157aa5460f68d1cbbaf8a0707a0ada012e408be0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616191472, "uuid": "daca6185-38ee-4659-98eb-49a5b98e2663", "value": "EE24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616191472, "uuid": "a2d94d16-1e1b-4685-bce8-a5559c2d4d5b", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616191472, "uuid": "9782f42d-f71b-477f-a040-8a30fc97e3e9", "value": "3072:e9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:e9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616191472, "uuid": "74168bdb-340f-4008-8aa5-9429f7cff9bc", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616191472, "uuid": "b1a58b79-8de5-45d8-b536-1fc205099ef0", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616191472, "uuid": "e8e7da10-06d2-4841-9208-12c0f00f201b", "value": "74953327811382444b2d98ad47f65e180245b1d320d5727337d0d3c5563abbc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f0a913e-88be-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1616163571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163571, "uuid": "6c88ecb8-fbdf-46bf-b977-744c08486225", "comment": "Malware payload (Formbook)", "value": "593168105682fb59c28c17d35e5a4fb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163571, "uuid": "f299ae4b-e414-4711-bbae-77615d553825", "comment": "Malware payload (Formbook)", "value": "7748f204ff121013eed27db34f51177e44c653962e5e88558c03a92317ac239e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163571, "uuid": "36b476be-bbbd-4cb9-9db7-39b96943fd1b", "comment": "Malware payload (Formbook)", "value": "f7708a03ba293bed2ee1c341cf35320a033fe744", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163571, "uuid": "24f0cf10-2bee-40ba-835b-2b3e993ae90e", "comment": "Malware payload (Formbook)", "value": "54245f4e26692445217ea453787434cacfb42aaf6b0039c9e7381ed0d8a8f5fb183d44f1c2fdc6b264404593c22e179d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163571, "uuid": "50096326-df52-4cd6-be8c-66bcb162b546", "value": "C924023636E1C8FBD52796712EF3D6BADBB6D20102206A1BBB305F3625212D1D856783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163571, "uuid": "dcc80f98-9811-41f8-8025-5d0f7c94b152", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163571, "uuid": "a59926b7-3c5d-4adf-bcce-85878548da0e", "value": "3072:JPA6jXFN2Mc+mkz+VT1x7Dqz1sScEVDs+5/o0PvUXxLy/NVcmOXqCiv7njO:Jhjm2mq+Nn7MaSVdHPMBG/NVcmiqL7jO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616163571, "uuid": "5950f487-9221-4572-8fb6-e81ff729ea96", "value": 217226, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616163571, "uuid": "69b9e05a-df5e-4134-b090-ea5e3b610741", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163571, "uuid": "fed7e6f4-da5f-4e30-9d5a-55fb41261edf", "value": "593168105682fb59c28c17d35e5a4fb3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8092c636-88b5-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1616159869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159869, "uuid": "d76fe57c-56ed-47fb-84a1-629cf7397374", "comment": "Malware payload (SnakeKeylogger)", "value": "5c2cd6d19381ac5a4a517c2165b29813", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159869, "uuid": "38a75083-08bc-412c-be25-d5989e21ff5b", "comment": "Malware payload (SnakeKeylogger)", "value": "7a9db6042869b4a1f8e6a9d147c2abc763ba2ff35821ac572949307bb9857c18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159869, "uuid": "862b21c4-2464-424c-a44d-0f2459df6269", "comment": "Malware payload (SnakeKeylogger)", "value": "ecc8a3a80c79f37d81bda23624804f98dbc487e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159869, "uuid": "15d4be72-5e94-451e-b51b-cb367998a3d3", "comment": "Malware payload (SnakeKeylogger)", "value": "51357f729a63c353e23b42e35f31bc106418217bcc531837abff3736de63a4448ac8a3e1b32c0aa5e2d126ff0ffca1e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159869, "uuid": "57136960-55ef-4caa-8a0b-c1820eaceeac", "value": "C0D3E1E43CEF9AD1D449EC7A466D30512AE20D02CD034359D4D9B1A8BDF3CD6AB88E5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159869, "uuid": "506c4427-41de-4f44-a1ea-fbef597ae1f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159869, "uuid": "aabab485-8afa-4d48-a291-daeff968d2da", "value": "768:cOSvogqMd0UJUu1hK6tf0EKdLE2AeoD9SIV:cOSvogd0K1hxVKdAeoRSIV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616159869, "uuid": "9df1d59c-a42d-4522-a048-dd71af2d323a", "value": 130048, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616159869, "uuid": "dc15f44f-8346-4e88-8029-04a3d6d26876", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159869, "uuid": "ed8c76d1-1e22-4822-8c36-560ba418303f", "value": "IMG_724_Scanned_603.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8760c34-88c5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616166861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166861, "uuid": "f8c436a0-8141-44db-aa9e-4648e6a51f2c", "comment": "Malware payload", "value": "abc000444d75760551c14e3d04473a39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166861, "uuid": "40feacbe-f921-4d24-b27e-1b430e51e42a", "comment": "Malware payload", "value": "7bc379fd5f28ca0016ae282820d517d7719cad2742a22968cc3c9d3434ff469d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166861, "uuid": "3e9bb878-31b1-4cf1-ba2d-de5f9f79fa9d", "comment": "Malware payload", "value": "a08909295bcf9d98edc709c5b7e3101b4c1630db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166861, "uuid": "315767c0-9055-4b9d-8f7c-b768bc78a7a3", "comment": "Malware payload", "value": "8b93857480832935241445ca0895b83c86ed55c63377ad4b395838c5a228d8d1bfd30ea7b68045fd775e739de686bffe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166861, "uuid": "9c0c5e8b-1f46-4291-97fd-b6407fc24f12", "value": "E2C5334EB70A815BE89008360C7B437247D6AE118C26DD57E90C7BBDB624BB7573D81B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166861, "uuid": "0f59ddb3-e197-4a16-9c01-b685465aaba1", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166861, "uuid": "1f550f68-590f-4947-ae85-27331f99d65f", "value": "49152:R1utX+L8/5pENLsSDXlia+bQLnrZ9iEpMLQK5EN4S+osUEf:rutDpENLsSBdDDr+/L3EN4SH4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616166861, "uuid": "a5722b64-da90-49b3-aea0-017c6fe9009c", "value": 2559872, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616166861, "uuid": "65c64f8b-96a5-47ec-b313-86707e8e0298", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166861, "uuid": "ef0f8e56-fd75-49b9-bcd6-04ae5ec3b083", "value": "abc000444d75760551c14e3d04473a39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "298b0c0b-88be-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1616163588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163588, "uuid": "5fd2a037-f1e6-4691-ad55-3c998ca432c9", "comment": "Malware payload (RaccoonStealer)", "value": "9daa3af86c3f685af35cb0d2bb0d42a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163588, "uuid": "37103fe8-1522-4947-a4e5-c6b8f3f24213", "comment": "Malware payload (RaccoonStealer)", "value": "7ca4eb9602b54dd5a1003cc83c39d0cc07aeb041cf8be6562f656675a40e4ee8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163588, "uuid": "c57683fe-d184-45b2-8cf2-4f72fe1db7e2", "comment": "Malware payload (RaccoonStealer)", "value": "3673e6d730b4f05be13da48ec1d8f017963e5866", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163588, "uuid": "a435bfef-c8bf-422c-a77e-35ad4aeb86f8", "comment": "Malware payload (RaccoonStealer)", "value": "c83ec36fbb94c4207c34bbf77c09f8e126426a6326f25a06831d47266797fca5a9c706c115291e9a069c37801156c57f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163588, "uuid": "ec885421-230f-4c26-95c4-58d4f71e9ead", "value": "1DA4020132A6C473D21656F619AACBB20936FC709B2596C737945A2EBF313D18F3A347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163588, "uuid": "9591ecb9-510a-4738-acc3-460a16f0601c", "value": "0329daedf7410b851c763de6fe05fcee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163588, "uuid": "82170421-c3bc-441c-8a9c-57b69fffbb3c", "value": "6144:Qrx1HTVou8CW93ekKp/PTAL0htmAfKldbiY1tC1OZt8UDRCED0L1iQqCxyAFEV:QjHTVou8C23+y3WYUQpDcOIrq9AFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616163588, "uuid": "bbaf516d-95df-4c96-86ae-822a89139830", "value": 458752, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616163588, "uuid": "e2b4a570-3711-4e28-a938-6a7952384f42", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163588, "uuid": "6bf6ca0c-0fe3-42b1-b768-ca3c985b88a1", "value": "9daa3af86c3f685af35cb0d2bb0d42a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5312b53-8880-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1616137167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137167, "uuid": "1a7f64ab-d982-4e39-8445-f074b4a60254", "comment": "Malware payload (Formbook)", "value": "a244b37ecf0155652bc62110a9ff647d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137167, "uuid": "b2aaad39-e29d-4dba-9e02-885aafca5954", "comment": "Malware payload (Formbook)", "value": "7d964cfc67d19b66eab04bf9fac5cec92f1cef183ea2609009415f0cb5752b50", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137167, "uuid": "a2694e64-8d9a-4076-9337-a43081aa8b91", "comment": "Malware payload (Formbook)", "value": "d5820341f47b38674a7acc722abbcf4482e3d9a8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137167, "uuid": "eac154d7-e8cd-46d5-8b77-742edb1c69f4", "comment": "Malware payload (Formbook)", "value": "7d245694fb79239927f6ea14839ba7eee6b097603c654807cb31c53d49610e58f0de97a7c5b9648f1f72f238736525e8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137167, "uuid": "66bc26e1-272b-4b18-8b4c-0ba74e925d5b", "value": "BF45AFE4234465D2DA9D5F96A609B8482627F177ADC62488F04FFBF937BB250CE0DC81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137167, "uuid": "9beacf9d-9e27-418a-a04c-39b3b08900cf", "value": "12288:v+rmUmUmUmUmUmUmUmUmUmUmUmUmUmUmUmUmUmUmUmUmUmUmUmUm/2VBR5f:vXzzzzzzzzzzzzzzzzzzzzzzzzQf5f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616137167, "uuid": "42a95ebf-86fb-472b-9434-a3e331046f59", "value": 1239697, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616137167, "uuid": "bdb86cf1-f6e1-4482-b679-7dd7d994d351", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137167, "uuid": "2f438bf5-3459-4fc1-b3d7-45f6d888b6ae", "value": "Payment Instruction.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7010fbd9-8886-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1616139655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139655, "uuid": "194ea734-4c0f-4ae0-b1be-ad4ce16f2ca3", "comment": "Malware payload (RedLineStealer)", "value": "0adaabe4a156ee49011937d128b7bfec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139655, "uuid": "f5aa863a-6f10-46b2-94e1-65b712be0b8c", "comment": "Malware payload (RedLineStealer)", "value": "7eefafe85ed6277d9c6abd81fa1ef7969c2ce6767c609baafc79206f78d13685", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139655, "uuid": "767629d7-2037-4b0b-87f0-cada5f84b15e", "comment": "Malware payload (RedLineStealer)", "value": "bb2bbf24fd2cdbe86f16c1bf08563886b73170bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139655, "uuid": "690a43c3-e64f-4bb1-91b1-06a2a0759da8", "comment": "Malware payload (RedLineStealer)", "value": "8bfc3b32a495aad6521175556683e076b529c6a8b1276c77218548f66ff1f4781c90f034cbd76f1485673eb57760af02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139655, "uuid": "8bf85570-e6d3-49c7-91ec-2f52351bd53e", "value": "2554E011F2D1C432C095267E4861C6B66936BCB55F21CAC77BC43F5E8EB12D29A3634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139655, "uuid": "cda1e4fa-f9cf-4db3-baf2-40c13f3bc319", "value": "fadb03432906cb0b1086222508551a23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139655, "uuid": "9b7a1352-56c1-4ec2-abf4-a81130a82137", "value": "6144:SBdn9R0mV8KABQQSIeghx5Jo9FbDv+5Elmr:y0m+DFsuO/OE8r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616139655, "uuid": "12c740e3-dbe2-4b86-8535-a1e4950ba5df", "value": 293376, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616139655, "uuid": "f3e74b1c-c7fb-4388-9a84-3fc680834c43", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139655, "uuid": "e3e9a047-b443-42bd-905b-90a18c2f6075", "value": "0adaabe4a156ee49011937d128b7bfec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3275aa7a-88a5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616152866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616152866, "uuid": "263dfe40-6b83-4345-8448-63955e7ca2cc", "comment": "Malware payload (Dridex)", "value": "e62e4d56942ffaae8e2be9bc20bdca25", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616152866, "uuid": "9ba9223a-967c-4a08-9fab-05691ebefc4e", "comment": "Malware payload (Dridex)", "value": "80906f5d094b272df8f1429b6da514157bc00b577042bd930df76a0010fb5b51", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616152866, "uuid": "e4611052-ad85-4591-8a31-772a46310b9f", "comment": "Malware payload (Dridex)", "value": "734c5bbbebe81043ac049dc9c4bdff8c8ec94f22", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616152866, "uuid": "c961f2cd-ff0d-4a64-9a62-06bfaf6deca3", "comment": "Malware payload (Dridex)", "value": "921bef631a7e1e562295f8208e0325ccf26409b9204f24036090a1dad3aab044b7b6ca096fb4753eff1828482f42c95c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616152866, "uuid": "702a9031-265e-4636-97c5-dbdc2b3b43d6", "value": "A124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616152866, "uuid": "84b454e5-07c8-44eb-9b1d-601925b47922", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616152866, "uuid": "db30488c-3e3b-4122-87d4-32c4c3f91091", "value": "3072:l9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:l9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616152866, "uuid": "cc5b593e-f1ce-4fa9-9612-e0839ef5fcc1", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616152866, "uuid": "81e188c2-f77c-44a5-b100-5dc777432956", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616152866, "uuid": "87e3eb7e-09e4-4043-a5ba-949c1d1761a2", "value": "80906f5d094b272df8f1429b6da514157bc00b577042bd930df76a0010fb5b51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3311e6d-8880-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616137164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137164, "uuid": "3828af38-44fa-4a4f-a3c8-3678d5ca402f", "comment": "Malware payload", "value": "aef725687a66f949526fcca96062cdbc", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137164, "uuid": "9abcb6e4-33a2-4760-838c-e64f647a5741", "comment": "Malware payload", "value": "825ee75e04472089a03654f4770b9bb16048988fd12c19b23fe99ed125b18329", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137164, "uuid": "e16e23ff-db0a-4cd2-8355-ec416f43bb9b", "comment": "Malware payload", "value": "36f9b160d6ba2ba013e641c935098f428ef9263b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137164, "uuid": "d334667f-23cf-4abb-ac35-eaa026581f4c", "comment": "Malware payload", "value": "aaf3430812ec485d790e7709ad479b63225a73ea20b8c9aab27da3e31e9bcd5f9f51b7e67f20d442c0e08d0a665199ed", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137164, "uuid": "1ee61fe2-cdd5-434d-84a1-0921b2f36ef5", "value": "2C63B0BC79083DE5AB5F4267DA877CD813B9666286C7A0C960BCB7C70563376EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137164, "uuid": "17a1d931-e598-4dbe-a56a-bc38b89c25b5", "value": "1536:cLzMcBTPZN7VjELoH2KQKOcmJgjzqhYFS6dWRiKcBfXSgJtut:cLXTiLoHgbJsqhoS6gcBTbut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616137164, "uuid": "c08d1f53-c254-40f1-be87-a550e6624360", "value": 72357, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616137164, "uuid": "d1c93cee-582b-46f1-afac-ef00a6eca3e8", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137164, "uuid": "1b48f66f-7d40-4785-aca1-6fab9c0cd6be", "value": "DOCUMENTS KTS3 .doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9add5156-8886-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1616139727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139727, "uuid": "b6facba5-4bb9-4f5b-b4e1-703741a05f93", "comment": "Malware payload (RedLineStealer)", "value": "3eebb91a074c7020e3f3563066761ddb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139727, "uuid": "af1f5ebd-bf3b-424f-82bf-1ac4884a0c41", "comment": "Malware payload (RedLineStealer)", "value": "834feb87d58ce3fa6ab779e6ddbf0e920bc94ec4d001e9af25d503bf00422607", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139727, "uuid": "58fc2c0f-ff0c-4f60-a129-2dd7bb94d4cf", "comment": "Malware payload (RedLineStealer)", "value": "dfaa7c3312e836e63013b3904134327d78783b34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139727, "uuid": "236fc1d4-e97d-4177-9331-f5e84ec5d97d", "comment": "Malware payload (RedLineStealer)", "value": "61acef5fe119eb008aed25d9127cdb5ae4cefc39b72dd1fddafdf7fddeadd0198a211e62164a48225132bbd8abaecaf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139727, "uuid": "7946daa8-5ad1-4a11-9fcd-6d20d69eebf4", "value": "CAC25C3577E4CA36DCDF177888F196548AB1F1491502FB278DC876827E23B914A233A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139727, "uuid": "8c3c1136-296f-4c54-a472-6003cca58ae6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139727, "uuid": "416559c7-7813-40d7-8c7a-bad0f6a8e2a1", "value": "384:MwnzdD7eNw5ARbf3AbvETTW1igKOkEtRurnF37PWTiUXwRl:ZnzdDyYARzwaq1LK1guzF3am", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616139727, "uuid": "6bcab90f-2c2a-4e83-b2a4-f43a7a7444d5", "value": 26624, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616139727, "uuid": "ebd284c1-8b72-4fd4-a1b8-f41b7a5dc3fa", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139727, "uuid": "6fcc412c-6504-44ca-9e63-ae8d107e5d60", "value": "3eebb91a074c7020e3f3563066761ddb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f760171-88c5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616166658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166658, "uuid": "12d14d4e-05f4-48d5-ba45-90c186ed0f27", "comment": "Malware payload (AgentTesla)", "value": "c7a6d988c938e4f251cdcd967dc97cfc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166658, "uuid": "463ac799-9499-48d3-8f84-ac0f7a692539", "comment": "Malware payload (AgentTesla)", "value": "85c23641539a99ea860c03d787b65de3860e5cc2e8fadc88cbfa9bbbb94b0fbe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166658, "uuid": "480bef23-7f6a-4a6a-8b93-74febc993a23", "comment": "Malware payload (AgentTesla)", "value": "c4ad1082bc5fc59fd6c6a9a1bf022d8103276755", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166658, "uuid": "bce9f6c9-9abf-4840-8084-b894b85ae391", "comment": "Malware payload (AgentTesla)", "value": "7b485cf41b4907ae6d4c7202cc211c013612b46c1aa85d34c06f0c0316676d210792c6da658c6e64121ce75070dd7c3b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166658, "uuid": "55ab7a55-4443-4f59-833e-7cf9fed24346", "value": "BAE4CFA92640AB4DCE360E79C8423950E7E0DAF79217D6C32EE214DD554D7AC8DFB2C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166658, "uuid": "d0128376-bad4-4771-9155-f1d076b9344c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166658, "uuid": "a5d71b03-5462-4874-9ea6-043064d1772f", "value": "12288:bCpqd4lTQyM8DEhJ4sdp36oiQFjH/16Ev6/s5pTkwI7AGkoF0mMjT0JQ1v9vDNZF:bhyM8DEhJ4sJN/NiiLIEGmj0JQ1VtP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616166658, "uuid": "16b52d28-ff00-428c-9a26-d09f7e6f9f69", "value": 713216, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616166658, "uuid": "07b7a73f-ecbb-4054-9096-0aa5b66116ee", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166658, "uuid": "9456772c-547f-4431-9188-91ce64ef9892", "value": "c7a6d988c938e4f251cdcd967dc97cfc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6bef40d-88b5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1616159986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159986, "uuid": "4cccbde8-4df3-4a55-b4a8-772d1eb9e241", "comment": "Malware payload (Formbook)", "value": "9c1b0aedbbeb0c3fc4c3650dcaf8ef20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159986, "uuid": "8bf03326-d509-4d79-b8db-91706443fb1d", "comment": "Malware payload (Formbook)", "value": "85e3d87034ef45bfd5cb1234cde6b6c66543e1a77426dadd6a75b01f2c5ab502", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159986, "uuid": "09a37f06-2f00-4e0a-8a03-a1cc4b6d32da", "comment": "Malware payload (Formbook)", "value": "596f511f36b45d2955262e6ca2b973c2fbd4782d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159986, "uuid": "4e866e61-c7bc-4e62-8461-879c5f25b297", "comment": "Malware payload (Formbook)", "value": "7d5474e71aae366af1566c04b3e6305fcc2ba53f0d8f39317014e6bacf7ce3dea1dc085b7d42984f1175a19516a08fbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159986, "uuid": "fcbc0245-676b-4e14-bd2f-9cd9bdf6d0ee", "value": "E6E4C0EA2301AB4DCE364E79C4423800F7E0DAF6D217EA975EA214D5554D3ED8DEB2C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159986, "uuid": "a2e80190-40dc-4816-835b-e45d068c1539", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159986, "uuid": "e87cdf7c-98ab-4c34-93ff-6d87173ad862", "value": "12288:VMLbNxcOVDdr65SXclWFMPokdAWxXbQMmFZR2BDGpR2naWhQeB097u4tP:ANqEDdr65SXclWmAkdAOXbQvR2BDgR2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616159986, "uuid": "46c48b73-d3a8-420e-b961-a0fbb6368c6f", "value": 678912, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616159986, "uuid": "a9af3c46-de9b-4e35-bed6-9bc06859edf5", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159986, "uuid": "a7e7e1f2-275c-4a16-b6d8-8e74a85b5e07", "value": "Documents for DHL Clearance.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc25c23-8888-11eb-abe1-42010a9c0039", "comment": "Malware payload (CryptBot)", "timestamp": 1616140483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140483, "uuid": "92bbc4df-2119-494e-921c-7cb513b8e48d", "comment": "Malware payload (CryptBot)", "value": "368d9636b8b46966fb1ac05b79085138", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140483, "uuid": "9330ea57-13ed-40b7-96c8-80713a9af450", "comment": "Malware payload (CryptBot)", "value": "8bc19406bed201b4542e99bde492c87d9840a7d745d6feb0ebde6eb529dcea04", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140483, "uuid": "41032cfa-b829-4f19-bb21-f336a3ec573c", "comment": "Malware payload (CryptBot)", "value": "891dac09f2256d5ae9069336e583e13a877210fc", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140483, "uuid": "1577efcc-98ce-42f1-a0bd-cf3b7dd28827", "comment": "Malware payload (CryptBot)", "value": "6f7beadc93c73557cc7702af0f65b3f388c8ae1e398fbe56ca9b7f71ad2031dce471e2ed35b668fc235e0cbcbe4897fb", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140483, "uuid": "51f0772d-e810-420c-8af2-5cce45b79560", "value": "A19533522FB492FAD3FA7D7018603791B5BDF33A1B1615CB27E025132D625D28E390AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140483, "uuid": "a491d275-1236-4516-bb5f-efd2bb30f3c2", "value": "a1a66d588dcf1394354ebf6ec400c223", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140483, "uuid": "9b9e6134-5b6d-40a3-9c79-b60f8c8a17a7", "value": "49152:m5+hF+6PNFrfkkWjn3KiVTtXIn9etlvdF5BPY4NmrwOm:m5aFNFr4ThInUtlvhBPbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616140483, "uuid": "ad1b523f-aea9-4972-9baa-623a4de1fb62", "value": 2044338, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616140483, "uuid": "769a0849-ad78-4bb3-b603-2cae65a76175", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140483, "uuid": "eafa527f-260e-413a-852a-bed212e265eb", "value": "368d9636b8b46966fb1ac05b79085138.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a06a722-8882-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1616137927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137927, "uuid": "a47c2371-f790-47dc-b5ed-afe6c9b859b8", "comment": "Malware payload (Loki)", "value": "cb4c6f32c1179c8010855cfbda4fd7b9", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137927, "uuid": "b5a3e87f-0c45-4be5-8fdf-52c4a84947f9", "comment": "Malware payload (Loki)", "value": "8d9a21859f2dc21ebb860cb24a214a62e9d025055494b44b1cbe6aebdf187c46", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137927, "uuid": "f8556e51-551e-4a54-8d90-fc70bd631b1a", "comment": "Malware payload (Loki)", "value": "274a5de9bafd348f72b799815cde0faf2cd8c9b6", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137927, "uuid": "25d3f9a8-fd42-45d7-a27b-59d64aaf6174", "comment": "Malware payload (Loki)", "value": "3062468104e481f353bee895f6e39fadc0c97e9eb778be5ce8b46927e9d0736886fc87c1a8b5af81f7786b1699a39663", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137927, "uuid": "e2bfb5ac-fe77-48dc-87e4-3d598164e272", "value": "6FB5336AACE3CF4AD85E61B15A5B67A021AD4C0C3F16982BF38C303D347BE1169D131E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137927, "uuid": "6987f4c0-5495-42f0-99fd-7396cd61b6ec", "value": "49152:piehkq4BkCOkfpaARbXayTzZz5/q22eyGebEh86JRIdH0UwEA8T5v1Hd:7hD4BkCQARuUXGDbu86zIZ0UwEdTF1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616137927, "uuid": "0e8f0f2d-07f4-446d-bc1d-511b5e492dee", "value": 2485760, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616137927, "uuid": "37cea7ae-36c7-4fbb-bb53-de88bff65072", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137927, "uuid": "3a566790-1402-4c1f-87cb-ae8897cf1f33", "value": "payment list.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b648ed-88bc-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616162929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616162929, "uuid": "18e92d05-7abe-455a-ad7b-766b90a70f32", "comment": "Malware payload", "value": "868b036161ccd2f09fac9821e2af5986", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616162929, "uuid": "2b9e1028-f7c5-47df-8338-3f8833138d9f", "comment": "Malware payload", "value": "8f1db486c43c5492f1c6fec1a50d2ed9254534689b7249778b0ae33f93162cc7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616162929, "uuid": "d01dea9f-ef48-4159-b58e-162b7b764b21", "comment": "Malware payload", "value": "fea1991407a9d0259ee46c7452888838330a37f1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616162929, "uuid": "266886cd-7b65-485c-a331-bd182d8b2e9d", "comment": "Malware payload", "value": "a7d5bae9c044b815f29bb8d377c45d8fb04eba911b065c2c3a5f8764cb9a19aa12c923a8e9e20e10be837e1573b6589c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616162929, "uuid": "2a9772aa-f56c-440c-bb4f-e619dc525d66", "value": "C692C5BDC4870A998F8AABB9670B1F04414CBA2DF384A53379B4A73466D1C7B4123D7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616162929, "uuid": "f4b60903-c3c0-42e0-a396-202eee07245a", "value": "384:iIhKHMffnIae4muuzWicvFlsfKPZWhXqF+vsYI8W3UU3pehKSudnaOdcC:DhsMZeFjSic9qw4E+kYs3UURIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616162929, "uuid": "e696ebdf-a7ab-4d0e-80c6-96469e0939bd", "value": 19880, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616162929, "uuid": "90c28a2f-2ddc-4081-88b4-f824f331708d", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616162929, "uuid": "a38e02d2-3d89-4622-ac9d-01f3b61114eb", "value": "CONTRACTS DOCUMENT.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b852a8f-88bb-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616162384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616162384, "uuid": "42c229eb-9b45-4440-b436-b7b4d1b3fa14", "comment": "Malware payload (AgentTesla)", "value": "559fdff90ea530e4d8d582e67f147654", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616162384, "uuid": "54701004-756b-4c6b-9e49-e1c045a8b882", "comment": "Malware payload (AgentTesla)", "value": "8fe69dbc9665ec1643ac8d065ef765800b6268e97b97243a15cca6d835410936", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616162384, "uuid": "d6849dcf-8c50-4458-af40-83de79084713", "comment": "Malware payload (AgentTesla)", "value": "374b317718f7d3c8b29e7337635c6c3fab3ba2d7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616162384, "uuid": "f3fee90d-6bc1-4acf-b308-1d80075dfee0", "comment": "Malware payload (AgentTesla)", "value": "f0657d11015632022f957d6d3f71fd9d891847b4183c9197cb85ead6d380edce5fd4c61b766e0c59a29922638ceb326c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616162384, "uuid": "8e7f2468-26fa-4fb6-86b7-8fbbb9eaaea6", "value": "00C423D4D7B7948EBE5E4B40E0909892CB791C264FAAF014F973AD83772B0F121526B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616162384, "uuid": "207050ee-6857-4f68-9eac-8ccae9d400fe", "value": "12288:QYS/jwCTqY8HgIBmNXEZN6l8xWbQt4170DfIAMGWczu4Yfv+YxfT7:/SrwC3YyEmgtNgeWAu4Yfmk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616162384, "uuid": "7f65dccf-9bf2-4115-9efb-b69ca0ea3c9e", "value": 543403, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616162384, "uuid": "94ed68ab-8e40-4389-95c2-845a3c5a1ead", "value": "application/zip", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616162384, "uuid": "ecba28e5-d80f-42c3-b752-137b3c689c13", "value": "documents.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d822e1-88d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616175346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175346, "uuid": "f1f81867-bdef-4300-9c89-58e2434bc696", "comment": "Malware payload (Dridex)", "value": "9344de2cc61d3332fc277d0bf5c4004f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175346, "uuid": "132f53e5-9ad2-48bc-a660-06dd7398df62", "comment": "Malware payload (Dridex)", "value": "9007e0006d688f1b514ca975e201705ed472e1ee634eac11f403305ae5feb4f7", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175346, "uuid": "01c358ba-bfab-45a0-b132-e5152e495652", "comment": "Malware payload (Dridex)", "value": "1d7be8a0e8dd2a4ca2524bb351c1248a7ea44aaf", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175346, "uuid": "2351b1ec-0c7e-438a-9bb1-21344406c14e", "comment": "Malware payload (Dridex)", "value": "1a123913579cb9091645344371201dbc2702e523c644911818ee2168474ab1c9fc6a9f9d203cebf96506c7781fb531ef", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616175346, "uuid": "b9d2b8fb-d775-4bef-85aa-06174ddc8089", "value": "3124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616175346, "uuid": "bfccfa96-5211-47ce-b849-295ef4d9c41f", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616175346, "uuid": "f46ce270-9242-4ad8-9d67-bbd1483ed2c0", "value": "3072:v9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:v9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616175346, "uuid": "3254b818-60d0-4fc4-a444-c99659444219", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616175346, "uuid": "b6573744-9116-4d6d-80ef-0fef7a8538b9", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616175346, "uuid": "0636fb76-56dc-4abe-8105-02c30579f9dd", "value": "9007e0006d688f1b514ca975e201705ed472e1ee634eac11f403305ae5feb4f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "487fe766-8885-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616139159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139159, "uuid": "6c41b83c-db9a-4a83-8976-f75668149d1a", "comment": "Malware payload", "value": "d5eb22350cce5244d53274d0c414420c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139159, "uuid": "7bf78508-83bd-4de6-a396-b0fb9527c3ae", "comment": "Malware payload", "value": "91866bfe262cd400ed320bc99ccfa60d95bc6a10da34d89d73a94cf23b95f367", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139159, "uuid": "712f1e2f-0655-41d0-96e3-903aaa987c65", "comment": "Malware payload", "value": "5111efca8953538e58b40f001ae4db3887cdea88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139159, "uuid": "58ad69d7-4674-47dc-8c5d-76233490530b", "comment": "Malware payload", "value": "68935cb90beed5812896251aae547715e33c20a24cfbfa62a58878aa7aba0a4d7743f0cf452645caf62e1cc73e868c93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139159, "uuid": "485dbdf3-9fb0-47c4-b04c-909c96d67686", "value": "FDA36CE3A54952B4F31511B1F428AFE9068466780E1B49E1FBCBB82F74C98D3C5613AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139159, "uuid": "5c34a432-ad83-40fe-b825-95857d578e27", "value": "3072:aEtCn+2++6B+JIcQV6klt6Gbd2f7W7Yg2D:3U+2+J+CSklsk47pFD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616139159, "uuid": "945f75ff-dba4-4fc4-8957-1f86b21d99a3", "value": 106730, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616139159, "uuid": "2b1ec745-6c33-49de-8406-bbb082488057", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139159, "uuid": "e60b1bda-9e72-4869-a1d4-5018d8f38ece", "value": "d5eb22350cce5244d53274d0c414420c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c182c27-886c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616128347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616128347, "uuid": "511c53f2-d865-47bd-9ff5-b019cb91d205", "comment": "Malware payload (Dridex)", "value": "e171e09758b8a48e86113197883010fe", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616128347, "uuid": "6041e54d-8592-490a-8a55-9fb4e954f51c", "comment": "Malware payload (Dridex)", "value": "91e8f861db67861b96192bbadd5521579907c1512eb0baa4289a9b46006dbfa8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616128347, "uuid": "33b8f054-ea89-4817-850f-9fa823b26e7f", "comment": "Malware payload (Dridex)", "value": "1b5096967ae704530d9993afebe83161298876a0", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616128347, "uuid": "6dec086d-72e7-4e6b-9056-64180bf667b5", "comment": "Malware payload (Dridex)", "value": "a5983ec820fa88f9ca72a0a814feb16326a6cd8767e19b137a2a29de53829a328cc75282150dab1b535b7ac280fbea30", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616128347, "uuid": "d9870b5a-92de-4795-a9bf-be652145a933", "value": "C124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616128347, "uuid": "ae9f8782-2458-4b64-b7a4-2da608b5dca6", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616128347, "uuid": "b8805a63-bc84-4b8f-ab6d-dea573c69a4c", "value": "3072:j9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:j9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616128347, "uuid": "10032dc7-8876-4f01-a306-0f63115a5ea8", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616128347, "uuid": "fa25ebc9-7be4-4682-95a6-978ea81b529b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616128347, "uuid": "a5bf082a-28cd-4e8c-a0d1-dfca0b08535f", "value": "91e8f861db67861b96192bbadd5521579907c1512eb0baa4289a9b46006dbfa8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "385b4f2c-8885-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616139132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139132, "uuid": "b1d06671-8757-410d-af22-59d32a090b6b", "comment": "Malware payload", "value": "8c8dc5f35bdf12d4051c5a506e7fb072", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139132, "uuid": "cefecef6-2e83-4638-82bb-109051766747", "comment": "Malware payload", "value": "92d2144b7decac2b353200c7cd0a31377aad9da6a1d9cc444eb2e69eb47630b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139132, "uuid": "0c663ce0-df7a-46d6-b9ea-4afc8304a68f", "comment": "Malware payload", "value": "f28fafd1062c3bb89e990ab7aeafe8426fe28a98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139132, "uuid": "890a26e8-162f-4163-997c-394fb7b3376f", "comment": "Malware payload", "value": "475e7b4b8b19b933ad3581f3289f0660e7edb8c882d9373d2bfaaeacd5369dab85b5e4d814dbd170b67f7cb3881ce1c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139132, "uuid": "23f0b646-c2cf-4775-9f55-7ccbbd71e4d1", "value": "74058B0273D1C036FFABA2739B6AF64156BC79254133852F13981DB9BD701B2263E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139132, "uuid": "7c5f6f5e-0f2a-486f-ab4d-3616132092a2", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139132, "uuid": "1c0d9048-8c61-4e18-9680-288f119b71ca", "value": "24576:0AHnh+eWsN3skA4RV1Hom2KXMmHajAM5:Dh+ZkldoPK8YajD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616139132, "uuid": "a4e19195-450d-4570-8e8d-e96bda8380bf", "value": 867840, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616139132, "uuid": "f3070aaf-e2fb-444b-80b6-3ce4a0cd9ed6", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139132, "uuid": "cfd3a39b-b370-443e-97ae-0109a537cbd6", "value": "8c8dc5f35bdf12d4051c5a506e7fb072.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d05ba1-88e2-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1616179339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616179339, "uuid": "53fbfbaf-eed0-4128-9d6e-c573153f2ec5", "comment": "Malware payload (SnakeKeylogger)", "value": "e69aac465b85a7784a486e05c02421c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616179339, "uuid": "1422be1c-d42a-4616-b99b-caee5873ec80", "comment": "Malware payload (SnakeKeylogger)", "value": "93f833fa8dc84bcc6ab6b643f32f83527b881ea85a33d6729427951a412144dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616179339, "uuid": "a1ba3522-45fe-444a-a8df-261fe312c348", "comment": "Malware payload (SnakeKeylogger)", "value": "2273e7ce5f176beeb641e031e8f5c5481cbbf6d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616179339, "uuid": "9bc8d07d-22a0-450b-93d1-8d2562c81747", "comment": "Malware payload (SnakeKeylogger)", "value": "5335e6ac0d66d12124593460b9bd23d19a963a629ac8b7e0da63e11e09d3d242364d37942aa31023c0ea77813908604c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616179339, "uuid": "860c88e1-b702-45ce-b96b-90937c9a9f6c", "value": "2115120076A7B699E4394B72E046C1934FF6BE18C397D9BAFCA4719E04B2075C27D236", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616179339, "uuid": "957138a4-a648-4f54-96e4-30b10fd6b8fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616179339, "uuid": "b90719ad-f512-43b4-a5cf-014c763fbd04", "value": "24576:/kYldUGY6jwfYfU+v5HIUXLvBavrk29PLHjqoBjRTh:1PMfYfzv5oUXLvMvrlhL2oBjRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616179339, "uuid": "dcec2e57-4e39-4947-aa8a-0d995de712ca", "value": 961536, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616179339, "uuid": "6fbd3127-f095-45fd-a8c9-1222ef7a2758", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616179339, "uuid": "b2f03a90-aa18-4c14-90c0-5e6c318354f9", "value": "ordre de paiement final7654.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b45a1495-887b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616135045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616135045, "uuid": "bca3446e-1eff-402b-88be-0a40c4e25e29", "comment": "Malware payload (AgentTesla)", "value": "cd9b1577f63995e5ebdb0afd073b6297", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616135045, "uuid": "2fa997e1-ae34-4253-bd56-a4412a093c7f", "comment": "Malware payload (AgentTesla)", "value": "94b3e37a5c039221040999418b83ab8338b165db38255ec81bc41f3a8ad2e6df", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616135045, "uuid": "4b1fbf40-2798-4529-8695-bba8e63bf3b2", "comment": "Malware payload (AgentTesla)", "value": "4c655912a26717da52cd27388152e3560cdddba2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616135045, "uuid": "fdfeb32f-fb54-4a1f-b467-40f8db3f8bb6", "comment": "Malware payload (AgentTesla)", "value": "f5ce64539d045da941aceec5afb24a4ced7677c5b5d832c20fffdc12d6e0b634982e297f9295f32b1f7740be4d5ed980", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616135045, "uuid": "918db8f8-9456-47a1-a5bf-d3a167648f89", "value": "49E4D0A52340EB5DCD364F79C8412910F7E0D9F68117EBC35DE248DA498E79D8EEB282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616135045, "uuid": "aca0741f-b24f-4be7-835b-bbfde78ac2de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616135045, "uuid": "609d7240-8aa8-44c0-84f9-0a64998d82b2", "value": "12288:V1N3p65fWJfCOT9rKi03ElObcsEVoRRrW2UAedWA/KDxhnXfc/xUWtPR:zNo5fWJfCOxGihs4roDrW2UAUX/Yhna7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616135045, "uuid": "04593d58-d403-45d3-994c-f6e7f361307d", "value": 703488, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616135045, "uuid": "5b2d1d67-e92f-4530-9e82-f868b22eca81", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616135045, "uuid": "3d05bfbe-d32d-4126-9a6d-2fbbf4dbf9c7", "value": "Revised PO..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511f50ca-886f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616129724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616129724, "uuid": "b8ac03bb-fe46-4ebb-a844-080b7b133795", "comment": "Malware payload (Dridex)", "value": "f0cf89afe54243e67ac18151114719fb", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616129724, "uuid": "252d6e1d-b8ca-4e47-b8e5-3111ac969106", "comment": "Malware payload (Dridex)", "value": "993932ae22587a64a556741fb5f5a610c6e42a068c5a2a33476a89eb575e0f15", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616129724, "uuid": "aa0197c8-bc3f-41b2-a03c-8ca34b4530c7", "comment": "Malware payload (Dridex)", "value": "a9d8649ae9589160ad4fcd9bd4dc341ffaf0278e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616129724, "uuid": "baee5b7d-f01a-4147-9394-cce94bc856e9", "comment": "Malware payload (Dridex)", "value": "716fb0c66f3c834e0f7624de14b925ca915810f33bc8edd8a10394bfd9012834cfb4977c6de3f033238aadf57d183085", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616129724, "uuid": "3e44fc61-bef6-4a9c-a1b4-7f69b5fbed06", "value": "D514AE9DD729E464FAF3D9F104359A1210BB6C49892F914AEAE0A6FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616129724, "uuid": "72c15085-ef4a-4331-8160-4a2a534d9bd4", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616129724, "uuid": "9d056893-1424-4343-8c95-2ad759aa72f1", "value": "3072:r1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:pi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616129724, "uuid": "993d2a50-28a5-4fec-b53e-56e259c2e096", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616129724, "uuid": "eabce615-e5f4-4bcf-ac00-fc231668a4ca", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616129724, "uuid": "cd8ff0cf-0969-4e35-839a-a55426be1985", "value": "993932ae22587a64a556741fb5f5a610c6e42a068c5a2a33476a89eb575e0f15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8623ca2-889e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616150084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616150084, "uuid": "cd8636b6-6ccc-470b-8355-7858cc6241ff", "comment": "Malware payload (Dridex)", "value": "7ea9a64957e76a9f1a8d33df211d9f3c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616150084, "uuid": "f18c0204-3eb0-40f5-8921-86d2ea85a8ea", "comment": "Malware payload (Dridex)", "value": "9a4bbc52cb46f1d9f864a8d95ee53dd6d2bee67c94e8f35e3b673cc8fde95444", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616150084, "uuid": "9d4fac04-b0dc-43b6-ac4d-7b305b3209a5", "comment": "Malware payload (Dridex)", "value": "16b2ffd0618cf0ecace7f03225e16b319469f1b8", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616150084, "uuid": "83e9e954-956a-41c1-a510-e6168dc3ed31", "comment": "Malware payload (Dridex)", "value": "022d5d1dacd8b39c056e6b41a2c5c92c55b0e636b9d7b3618ca5c4da20bcecea578392741b45a9959b93ff3ed1d4e437", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616150084, "uuid": "2cc8a9f7-2bbd-4a15-8ed2-d4fa89ae0fdb", "value": "6A24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616150084, "uuid": "54f1b986-9a23-4cd7-8823-b6a63903c204", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616150084, "uuid": "e1ecea1a-f2ea-4458-bb4c-31d4036e75f8", "value": "3072:f9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:f9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616150084, "uuid": "ee2c2fd8-32df-4eb2-be57-334d99c72f4d", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616150084, "uuid": "fae949f9-fec7-43e9-8114-2505c2dcea36", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616150084, "uuid": "b58a3b45-d42f-473c-ac6e-b5d42e5af5cc", "value": "9a4bbc52cb46f1d9f864a8d95ee53dd6d2bee67c94e8f35e3b673cc8fde95444", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac935236-88bd-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1616163379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163379, "uuid": "555bb799-daa6-4a8b-bbfd-7825c32a0cee", "comment": "Malware payload (IcedID)", "value": "2efc5c6c20958e184b0a48799227c8b3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163379, "uuid": "c1351d25-8ff7-4757-8ce9-607dbb8431b2", "comment": "Malware payload (IcedID)", "value": "9afa296e62ab110bca0b69f927b25c1b14e050b735130b7b7b5a0b5d71ba2b79", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163379, "uuid": "c51bac5b-5bc1-4b93-89cc-544282d8547c", "comment": "Malware payload (IcedID)", "value": "0f9f770488f97f0ed4f68c29bc227eb0fd4f1d5b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163379, "uuid": "52062665-35a4-4446-852d-db33a19d5cfe", "comment": "Malware payload (IcedID)", "value": "9811623e4ca55a5fe3fc26e1516034bae3299aee403526f37fae23c6efa366930212783ff5d99c309685004332c2544b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163379, "uuid": "4f71c400-05e5-4e04-8415-28ac2ffc3fd2", "value": "7E533AAB12F3273AC4F02179C4C64218C43B5D061B2DF17BF9D28BE169317DD6A82A6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163379, "uuid": "848d9f7f-568d-4169-9b5b-3328f817f39c", "value": "0fea243ddb12b477b6b4ab25be7279d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163379, "uuid": "b193e431-2273-4c29-b96e-f87434d87f79", "value": "1536:roBHSfku/TguqNKM6C6E+YUv3EXmYOiKsU:roBS8Q0R68Xys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616163379, "uuid": "051efb26-c1d8-4117-8315-cc8da79e526e", "value": 65536, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616163379, "uuid": "fe75c787-f5a1-4358-b33d-27dffc15f5d6", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163379, "uuid": "1a003402-c07e-4844-9a6c-4807c3cf2fdf", "value": "2efc5c6c20958e184b0a48799227c8b3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9837909f-88b5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616159908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159908, "uuid": "bddd4536-ae50-4d48-b915-fe4249984900", "comment": "Malware payload (AgentTesla)", "value": "4d32360eb1a7e7ed2e3fd99edf32fcfe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159908, "uuid": "d981f0f3-17ab-4b70-af46-756452d5cfa0", "comment": "Malware payload (AgentTesla)", "value": "9b5951f3d4ebf6032918474592e08065b513e5fa68c1bd26fef40128eed74379", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159908, "uuid": "01c66eaa-7a0c-4970-abdd-bc0347c552ce", "comment": "Malware payload (AgentTesla)", "value": "ddca9c44ba00ce44323c97a8c9427f1dbedde564", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159908, "uuid": "33999743-b28f-44e8-b6ed-0ea01cabc8f0", "comment": "Malware payload (AgentTesla)", "value": "13f6c95d26f0beee1e04838688ec5296da31cfa2cb8b394207779c24564d363d0823e789f0fe1c8187f02984c6238b16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159908, "uuid": "a76b6539-0f9d-48af-a0b6-f6831acb71d3", "value": "40F49C9C3650759FC857C93A8AD83CA0EA1060664F0BE7E3901711A99A4F5B7CF173FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159908, "uuid": "220d620e-2d6f-4751-8301-6b581fd73de9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159908, "uuid": "736c4cfe-1fbb-4921-8007-2b3ae7a39c0b", "value": "12288:sROOTdkF//0Rwc3PclwQxhaaFF3qom4IqoxcDjF/FoeFnz3lyqUJnEE6OoUI8db/:sJk12fclhxLFF3qH418cD7K/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616159908, "uuid": "23d71f2a-12ee-4760-9e08-49edec64c4b1", "value": 785408, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616159908, "uuid": "f752180a-d86d-4a9d-a224-da1b18668ba5", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159908, "uuid": "7a414321-1190-4330-8adb-6b3c89767085", "value": "Inquiry from HASMUKH CHAVDA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0fa006d-88ce-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1616170741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616170741, "uuid": "ba47fa57-516a-4f6b-8278-1d105aed6fd4", "comment": "Malware payload (RemcosRAT)", "value": "67e80af59f8b36749d5fb711141a5f65", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616170741, "uuid": "0a5531e1-7038-45f4-84ca-a5d624ada5cc", "comment": "Malware payload (RemcosRAT)", "value": "9b9a03add59199d08af6095e168e6b4bca3916774291603b4582d14f6078fa15", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616170741, "uuid": "f7ba68e4-d729-45bc-b4f3-8e76b911367d", "comment": "Malware payload (RemcosRAT)", "value": "4d458a0b27e58ab7cf930c2ff55bfe4f083aa52d", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616170741, "uuid": "be9882c6-388d-4cbd-9511-6b83c6b439a5", "comment": "Malware payload (RemcosRAT)", "value": "558cb12d264528cbebb852486bde932349a7bd0eb7a0116aa0fc9a8cd7c4edbf63ba04c7e4e6a4fbdf1848eb2ae7ba60", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616170741, "uuid": "df0b9e69-1f8c-4005-b240-7fd3219cfbd2", "value": "F913E10A26A6E5D1C2B47378C6CBEFD5BC48499043CD8BE527B4F967BF191AC1D88209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616170741, "uuid": "764a7b85-ead0-4bb5-bc07-3896f71a4359", "value": "a5aba3b732b91fb8e31b6708fb30299f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616170741, "uuid": "f1c07a12-df6d-4b0f-bc80-d296f33a1a53", "value": "768:QSJGwLWVqc6KePAza+t2SQ4TgCDad/BOr+QdBg3irr14d4:QSJGzDnePAzDtzMQftrKd4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616170741, "uuid": "a52607d7-4794-4bc4-88df-1811812f9aba", "value": 42496, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616170741, "uuid": "b3671858-65cf-45e7-993d-06e2677e674d", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616170741, "uuid": "a27da953-41af-48ea-bfdf-de46b6524aed", "value": "yjyhphbjziyg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "283c6cdd-88c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616165304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616165304, "uuid": "b1c99bf5-09b6-437c-9f38-9f1cdfd21803", "comment": "Malware payload (AgentTesla)", "value": "139165aaa8ed864ec9e148760238933d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616165304, "uuid": "a43c8887-8503-4726-8de4-b2ce5e0c033c", "comment": "Malware payload (AgentTesla)", "value": "9dda99d4534e9cd648c348c0d64cd1447c997411c7712e9e9bedb30810c508e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616165304, "uuid": "2072194a-d51a-4f73-8685-37338c865867", "comment": "Malware payload (AgentTesla)", "value": "96486116fa75889702415f3f65a576d794571690", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616165304, "uuid": "b3899c0a-3e02-4dee-803e-b40707b0ebe2", "comment": "Malware payload (AgentTesla)", "value": "c56c623c581a328fedff619c0d8ba05295ac861f9c3abbf4f5fabb6a131dd1a6581aba8d135098b6a83381576507ee9e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616165304, "uuid": "b95c35b2-e18a-4faf-bed7-04adabd4ac8f", "value": "C3242A166714D520CB5F417FC016821831F1D707972AE38F5AA6D8FA2F822CEF92B9E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616165304, "uuid": "5acfb226-4466-40b6-aba6-11737ffa2d62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616165304, "uuid": "335c93c4-b51d-41ae-819b-2bc20c880fae", "value": "3072:E9WDIu+P3myaWRaXLkFBVF8ta9N+iUiDEym2AwgT3r/GZ/vvoZvHkc9O870FX3Cn:E9PVDRUO3A3/WWpB70RuTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616165304, "uuid": "4ea0ebee-4460-4756-b338-526725a4cda4", "value": 221696, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616165304, "uuid": "1db5d825-714f-4ecf-be16-7b376076db60", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616165304, "uuid": "57754595-53d0-4f5c-8562-44bb16100f13", "value": "Provide Quotation For The Listed Items.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841cf123-88dc-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1616176625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616176625, "uuid": "97d4100a-e941-4779-bcfa-ce78c8391c5c", "comment": "Malware payload (TrickBot)", "value": "3f2f5684f03696cf02b94d1b2ef0b976", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mon156", "colour": "#773815", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616176625, "uuid": "e7dd2c4b-e563-4a43-a3d2-370dc6033c8c", "comment": "Malware payload (TrickBot)", "value": "9ec541b1d1a6f3ed344bc9fb87448608c338036edf2a50dcdfd16905bcae9110", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mon156", "colour": "#773815", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616176625, "uuid": "6270199b-9862-4eae-9c36-506be117825b", "comment": "Malware payload (TrickBot)", "value": "b3fb1b73b75cf3387e6188654d5068ffacbf0e34", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mon156", "colour": "#773815", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616176625, "uuid": "1b4b0e6b-c109-460a-9ee5-f7b8172572c2", "comment": "Malware payload (TrickBot)", "value": "24e42d35bd8a6c583a98bea9b539578aeeca78f0f9fec4a324e4523a34f9dba845b95dd602bab233289ce27fd257e18e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mon156", "colour": "#773815", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616176625, "uuid": "38addc95-3595-4c86-8660-70838227425c", "value": "CF9412119130A510EDEA16B166683FF5E93848111B7E4FAB337F7811CF49AE6A3093E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616176625, "uuid": "5c95409a-ebca-4013-8493-fe94515c8c10", "value": "4f0c2c904283b81b81368f0a41d1a1ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616176625, "uuid": "00e87b10-d6fa-4986-8f61-62d07a904fd6", "value": "6144:GLxEipndZINSqPnWrhKsA0RoQQ651PVc/u/DcI8nOatDe9JYe8HVFT8gAPwyDq5Z:OBn3bZrhjoQQafcY4eTg3yDq5epFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616176625, "uuid": "b76af5e7-de6e-48d7-9d2e-601e75ddc319", "value": 443904, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616176625, "uuid": "ea8f20d0-d821-4e45-b036-d97a1e3ca3c1", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616176625, "uuid": "a1d8b115-342c-4fa2-be5b-3fb13d34aaee", "value": "156.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee024c0-88be-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1616163597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163597, "uuid": "5ac3f968-6dd0-48a0-8ccc-bb739d9aabcf", "comment": "Malware payload (Loki)", "value": "ccbc6b3eb409f759aecd2cdfe30c0afc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163597, "uuid": "a0fb27e8-09b8-47f0-b1f3-4497ed919147", "comment": "Malware payload (Loki)", "value": "9ef30cb6330a1ab0be38496703362c301e625ff4937e72bb22b23affb75c06c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163597, "uuid": "ba92849d-4ff5-4f43-a322-1ee85d8a567f", "comment": "Malware payload (Loki)", "value": "7326d28dbea7796870ab30f86f67e385fc9d7bd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163597, "uuid": "d41ac473-ae85-4053-b775-40db46fa7ca5", "comment": "Malware payload (Loki)", "value": "f26bd94eb77b475d23634fcbe917117281f3ed03a99ea1e6a97a4d0c0271d3abfa09ec4e17c6472dc6eed06e737d6b3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163597, "uuid": "bfbd6fe4-8c70-4f28-958d-031d6080c605", "value": "D5E47DE12300DA5DCC274E78C4326553A3B2E6EDCC17C64A2D927E8A3D5A39E4CE7587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163597, "uuid": "09fbc869-cc20-454f-a242-1798d9e6f6a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163597, "uuid": "eae36360-ed64-468b-9cc3-0a969b69246c", "value": "12288:SoP2I2xLfWSqo5GeZ+45438iONmD65y9twA1sdhaOEsEjfIL6AxpMQOhtPpdAA:8xLfWSqMGef5aaNme55B/aqEjptPTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616163597, "uuid": "363ca2b8-7880-4455-a3e9-776208c2c7f2", "value": 681984, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616163597, "uuid": "e3fa49ad-9f94-4987-bc7d-d50490f4f316", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163597, "uuid": "7928d155-84a7-428f-bc9b-9426c9113139", "value": "ccbc6b3eb409f759aecd2cdfe30c0afc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33346cc8-88da-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1616175630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175630, "uuid": "a85b65d3-cb25-43e0-82eb-368db3be6106", "comment": "Malware payload (Formbook)", "value": "7cfbd883e03ddec71682789798e6d9d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175630, "uuid": "3629122b-8308-4e37-9101-7be4a5c0ad24", "comment": "Malware payload (Formbook)", "value": "9f1090c3e94e75b134c1aa55b5e8e2b6ac9b706cd27e0bb1cc44ef4b49f27c66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175630, "uuid": "cdf0dbe9-0c89-4e7e-984e-2704e56e35e8", "comment": "Malware payload (Formbook)", "value": "801fde75fd1bd0aba6b991127f193e04582696e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175630, "uuid": "bad0bed9-7e40-4716-baf1-ab6a0960a709", "comment": "Malware payload (Formbook)", "value": "7c13f9ff9b9d3cc8d689f6aa65c8696626c04586f783897c5ec2cba7f8cf08c97f7c84cf2dc9dd9392a4123f5f9a6011", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616175630, "uuid": "6e68d4b4-83a4-4008-aa7a-8e7535ac1887", "value": "3BF4AD11A3E6A608F23B13788579420287F6B596D23AD7BDA8D450CE0DB3B454B7B337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616175630, "uuid": "27cea2be-1d5f-4e2c-a378-96f6304e3808", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616175630, "uuid": "d1a32c32-99ab-46bc-9fce-eed87841ad9b", "value": "12288:U1kRlG3WOKqDxNyC/svpNjY9bQt9whoD8cKoW+4R/YUXcgs430TD+Nc8gWtDNTV4:U+lGuqDtsvfY9bQXw6Nbg/3a4puQhw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616175630, "uuid": "dbc95a0f-d600-48c6-abb7-2c09b2929cfd", "value": 754176, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616175630, "uuid": "9599b624-8bb5-4f65-95ed-0b8198bd3815", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616175630, "uuid": "0e9147f9-085d-4455-9644-e1620fb22c73", "value": "DK Purchase Order 2021 - 00041.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52999a45-8886-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616139605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139605, "uuid": "88a6143f-2acd-462a-aeb5-05daf3cb53bd", "comment": "Malware payload", "value": "24992f26d5a91f1d5857a13db6439b8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139605, "uuid": "404ca525-c232-4bf7-8ef2-56b05a0be410", "comment": "Malware payload", "value": "9f270ac39c512c05aeb9e502738dbbc438a6f95596ec041333b7ae7e334e9c2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139605, "uuid": "c5c70378-57ad-4ac7-ad31-3ef2c4b3e096", "comment": "Malware payload", "value": "2f82c98c97bccafd8144d9cbdf26f1ee2d66f3d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139605, "uuid": "d719c1bc-b34b-4077-b806-5f103c6e6043", "comment": "Malware payload", "value": "89f5a7a97bc9037cfadb2c4cdb908f8825f96be536716e78eb819e5ffcd07dbdaf54211aa5fd98f6471f590d02df19dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139605, "uuid": "4165dfbe-93a2-4bb8-8485-08709a5e5b6d", "value": "D795331EC7941C68F857F7321462F573A702BD804B899BAC161EB18E6EFE351034AB5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139605, "uuid": "a31206b0-ca37-4cbd-86b8-e059bf5aab24", "value": "a781462b9ac82bb340f6d3cc965c6b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139605, "uuid": "2324248d-cef0-4d0d-b846-88c5290a09ed", "value": "49152:kFircU7rxdytOXGROPMACuCGrHJVTPuItXMGVWOn5Rcn:ksf7rxdyY2OEMCarltVf54", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616139605, "uuid": "4dcac187-873d-40ce-8cc7-e0c8384a03a2", "value": 1949168, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616139605, "uuid": "b799b4a4-5408-4371-aa20-90b887033c59", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139605, "uuid": "92056e90-f2d0-4d77-a9a1-d721d73caaba", "value": "24992f26d5a91f1d5857a13db6439b8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f7b565-88b5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616159685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159685, "uuid": "853465ad-2bd7-4244-b22e-6f7546228325", "comment": "Malware payload (AgentTesla)", "value": "50878a91d7771a3ecdd405b7e67fec42", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159685, "uuid": "f2c8d832-4116-4f48-a8e2-0f1034753db3", "comment": "Malware payload (AgentTesla)", "value": "9f8eb6ad902381309cc7c6ec879569cbe597d4744e36f12688de5a9d3d7c93d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159685, "uuid": "ab6e20fe-2423-4b1d-906e-594174eac5bd", "comment": "Malware payload (AgentTesla)", "value": "f01817eccb560c39579cecbc45e4bdcbd7b95e88", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159685, "uuid": "eab93ecd-0d98-4033-9985-8fe5e36b2cbe", "comment": "Malware payload (AgentTesla)", "value": "7c0389030cac85c162d49f727dee1fcd9df2f2ec66421c55dc38b917fd4281b05fb80f6222e2ebd4f9e5f29f250b843e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159685, "uuid": "619494b7-4671-484d-a55a-816f1ce33046", "value": "25E4C0A62344AF4ECD364E79C8422800F7E0DAF6C113E6976EE215DD454D6DD8EFA2C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159685, "uuid": "96869bf5-fe55-4062-a3b0-4146c1bbcbe9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159685, "uuid": "fc4b8e97-b3d7-448c-9b09-a5927950bc4c", "value": "12288:HMMzTYa60Fdm0ieF607FNnqI6VkwUYOA5UnoGnjtivMJ7/SvrkeqttP:HMMwd0Fdm0ieF607FpqIKkVA4FBiIHtP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616159685, "uuid": "81f3de30-e76d-4733-9cd1-7f1c6c7534d4", "value": 706048, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616159685, "uuid": "757b9cb3-b1e0-49ae-8af5-06f4b71acf5e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159685, "uuid": "c0cd0e78-96a7-4aca-9dd6-82f45073b353", "value": "TQPHHyjqoJdMHyp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "486eb52a-88c6-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616167076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616167076, "uuid": "eeeaa3f1-7cab-4303-9c8a-9c0bb6526e81", "comment": "Malware payload (AgentTesla)", "value": "85112f2333006263e0c741e1c8505650", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616167076, "uuid": "d9767869-a548-4d66-8ba7-c2a16e53612f", "comment": "Malware payload (AgentTesla)", "value": "9fafde1fd648f3f319d37540890efe551c439689c168374afbea25695d2d4033", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616167076, "uuid": "c5c8fa5b-47bf-43c0-9a43-e9b4080cd1ce", "comment": "Malware payload (AgentTesla)", "value": "8c7269e44802c30679d961fbc07d559431f8129d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616167076, "uuid": "ddbaf823-c20c-4ed2-b632-a3bf8d883619", "comment": "Malware payload (AgentTesla)", "value": "fd94d9b96c51b7cdc2f6b7b0fd2a1ac859f72629307ffeec3449b60626bd8a2f86aafc77ebbc36f9e133961af2d2fdfc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616167076, "uuid": "c86984ed-0478-45a3-a0a5-d45d9f5175f6", "value": "6205E0ECC9291663D86927BE41E736D0CA2666291C51FFF649C9B0C21663370DA433FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616167076, "uuid": "6d73575b-8115-4187-8ee3-1c93c444f3da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616167076, "uuid": "e6f2db78-1c9c-4a39-b6a6-4494507335c0", "value": "12288:7INRqeuej15KMoLpG46plJA/jP6ISEIxgh2wDo0FcTQ3TqMz+eYFm4mXIWo:7IZuejyLI4QJlvrx+to0Fc03TqtFf/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616167076, "uuid": "979e9d58-24ca-4948-b083-68e63c2cd3ef", "value": 822784, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616167076, "uuid": "3cd8d738-84f1-4608-b8ae-9441da46169e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616167076, "uuid": "2b1624a2-7645-4069-9f22-1e92e00ce4a9", "value": "85112f2333006263e0c741e1c8505650.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f9b6214-88ac-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1616156029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616156029, "uuid": "b7e594a0-48b7-4d6c-9a3d-205577ec475d", "comment": "Malware payload (AveMariaRAT)", "value": "d7d22a8cbc1fca7a9cbc31c1483114e6", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616156029, "uuid": "c1fb5da0-1d1d-4adc-ab4b-190f35f853af", "comment": "Malware payload (AveMariaRAT)", "value": "a0d988206c1aec4ae4582c27d02ac896e9b0904ea4264b8d766337741514b5c9", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616156029, "uuid": "b9801219-3809-4021-9918-23f49444446c", "comment": "Malware payload (AveMariaRAT)", "value": "7050f7834832034fc2ebc90a329deb27758810a5", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616156029, "uuid": "14db24a9-8c11-497f-9f6a-26a21c3c7ed1", "comment": "Malware payload (AveMariaRAT)", "value": "a374c99932af839304123b678bd04f2719e135a6902916449bf4cc9ec91ae76051f76410d93cfd74f2580a2580e02f0e", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616156029, "uuid": "0cc3e05c-6bd5-401f-8057-c8ab3d44f5aa", "value": "FFA3B79E84700F96C75DF1368E71BBAB51E05AE22B10EEC756450B8384A2D41EBCCE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616156029, "uuid": "088d38fa-973e-4d3e-b9f7-a5fb5608dd52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616156029, "uuid": "521c7d68-af02-4d07-8661-e887c1f769a3", "value": "768:s8/zIf0769arBJSp47IFA3qvmy/dFW2RyHD+75kGflcYGflvx/FIwJGun51uDe2N:b4MzBJSbFiCNbRGfCe2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616156029, "uuid": "dd77a863-0b33-4655-a2e5-2e9226a4de1d", "value": 98608, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616156029, "uuid": "05dd4a46-0773-4694-bd81-4155aa95013a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616156029, "uuid": "6810b9e0-9a9c-49fb-abc6-fb3ec4e0f5f7", "value": "SwiftCopyDetails_18-03-2021(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d53122-8887-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616140154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140154, "uuid": "02052e1f-f91b-4610-b92b-d76c6d4d3a53", "comment": "Malware payload", "value": "aed29e23f01dab295f973ee35bf42248", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140154, "uuid": "5d4f19ad-3e73-40b0-9e5a-dd8ca39f8880", "comment": "Malware payload", "value": "a1b2f18b48cbae1df244f074c9a7f1ccfd369aeb981c6a4964b36d5d9e0c487c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140154, "uuid": "63d702ab-29e3-4a65-81e0-5560fa2b8c0b", "comment": "Malware payload", "value": "94a3eccc392cb47d7bc6dd3bf8fd0bf103018e0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140154, "uuid": "51ffa52d-27f7-46aa-982a-0bc6e311786d", "comment": "Malware payload", "value": "6a52770bbee183071bf7a5d4474b4bc1113304f7c6560a2719d449641e8344defa8d795db082c7f015cdfd7bdd97f216", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140154, "uuid": "a51247e4-f730-45e7-8e62-a5ce58e11270", "value": "7B56339AA9B550F5E46B41B88AF6D64BEF73B4438311E39B0071C3F21F137A1AD26391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140154, "uuid": "aa838f5e-430e-4948-8ebe-9e24c39297a3", "value": "08fd62a9d05cc8111782017958ea975d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140154, "uuid": "c6f4b94e-4f7d-4b7c-ba46-7c1ecc30a2fb", "value": "196608:cg5gwBrrcVTBKJePVw1Q85pGgbIbThc/KIfr:cg5bBHUfY+gcThc/KM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616140154, "uuid": "1549dd93-7189-414a-b72f-52a1815427dd", "value": 6461760, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616140154, "uuid": "7f9a4787-b2ac-4577-bbec-035661fc5dae", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140154, "uuid": "d5b2ef40-5894-421d-9aa0-6303048f131e", "value": "aed29e23f01dab295f973ee35bf42248.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b799af7f-88fd-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616190885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616190885, "uuid": "d7cd4c68-9c71-4298-8751-76ea77832e2c", "comment": "Malware payload", "value": "a803976201f70dc710d8905ee255b69f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616190885, "uuid": "f6a926d8-5b8e-4bfc-a16a-dd7fccf59aa7", "comment": "Malware payload", "value": "a2eb6953099c308d3d0e8f9ae255aa2c5f3a08b4ffed15224646f3281415dd52", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616190885, "uuid": "ea966354-6ff2-4419-b1f8-b9626ef69588", "comment": "Malware payload", "value": "8dd3ce0829dae412694fd353924aa706186f66b1", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616190885, "uuid": "a8d436e3-5e0f-4141-995e-b15d2b982241", "comment": "Malware payload", "value": "d4ae94355bb625024edf1b9ac457c2dd9113fce2fe12093b86a7611ba0235c500d62a149ac4dd3277c0d06b2e6f335c0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616190885, "uuid": "55280209-99fc-40b2-b3dc-7d00ead53ff2", "value": "5724CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616190885, "uuid": "a82ee6a8-d821-45fc-beb1-12d3ff980b9a", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616190885, "uuid": "c6c4e04a-87fb-46d9-9ce5-386e5f374226", "value": "3072:69Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:69Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616190885, "uuid": "19374859-f5c0-48e4-a882-f535806397a7", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616190885, "uuid": "dda4e58e-81a8-4828-93e1-6ecb261ef482", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616190885, "uuid": "80ee1430-5e75-450e-973f-ac52b8f08a66", "value": "a2eb6953099c308d3d0e8f9ae255aa2c5f3a08b4ffed15224646f3281415dd52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d3a2dae-8889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616141019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616141019, "uuid": "43484b08-16e6-4ea1-8d87-3a730f40026c", "comment": "Malware payload (Dridex)", "value": "0a8c9d7800804391fb2bfd0b932cabbc", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616141019, "uuid": "272e2747-69b7-455d-b945-163b166d35c0", "comment": "Malware payload (Dridex)", "value": "a35160ba6cc4d964926a7cdddddcc807e540bfb837be7aa337f308771a4607b3", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616141019, "uuid": "1df47e99-47c8-455e-98bf-275950b109d9", "comment": "Malware payload (Dridex)", "value": "da1a8c39c485b14923ffbe30fa554a1c83021bfd", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616141019, "uuid": "813df8bc-8f0a-4903-b1d4-d9981712dfd7", "comment": "Malware payload (Dridex)", "value": "6cc86402ccdfdfecf5af59542a15751908f448502ea1d674786dcddcd06875dca5dff7baeeb7af429d75ac21cdca4608", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616141019, "uuid": "be463b13-c551-4dad-ac6b-068cf22946be", "value": "8814AE9DD729E464FAF3D9F104359A1210BB6C48492F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616141019, "uuid": "742ca6bb-0a85-487e-95ef-614a638cef12", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616141019, "uuid": "f415b905-15b6-47f8-ad53-28c66c6ba7c3", "value": "3072:11i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Xi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616141019, "uuid": "1c560dd4-050d-48a1-8dd3-9a825148b3e8", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616141019, "uuid": "4f7cc624-360c-4b8d-b2d3-78a61b58f33b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616141019, "uuid": "7364425b-97e6-485b-9b26-45e8dd8513dc", "value": "a35160ba6cc4d964926a7cdddddcc807e540bfb837be7aa337f308771a4607b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31156a26-88b3-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616158876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616158876, "uuid": "199f03da-d956-4c50-a3f1-7afbf2484e5b", "comment": "Malware payload (AgentTesla)", "value": "10c1d0f518ca7dfb1b0386f1f009c131", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616158876, "uuid": "cea7dcdf-e17d-4651-b5d0-ab8218392f52", "comment": "Malware payload (AgentTesla)", "value": "a3a2246ed1e8686530d8fd67dc931f926851eb874bcf4eecd2aadbbaf9f81112", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616158876, "uuid": "77123f21-b746-49df-bafe-48907be7da00", "comment": "Malware payload (AgentTesla)", "value": "bf6d0f6caa21100a58112037b16fb4985336f5fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616158876, "uuid": "b6410e4d-f7e6-43a1-9b4d-c2d61cd3a9dd", "comment": "Malware payload (AgentTesla)", "value": "c968f9c3725ac2138a238312b0764d04372d3a766b882f6bdb50bc97afe69d8f7fb782cd27091c9a74c4b75c13af16a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616158876, "uuid": "a67563fd-9ef6-4208-bcc0-247c90806190", "value": "02E4D0A63340AB8DCD364E79C4013810E7F0D6F6D523E6875EE255C9594CBED8EEA2C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616158876, "uuid": "aef5927d-6bc9-49cb-a21b-b1c49136e32b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616158876, "uuid": "ae207cbf-2535-49c6-aba5-1a97ade8ac6d", "value": "12288:p+sEvnK5p5+hU6kLsK/56mnXztAFyLQIEfXv3m3kyssxUXJSyJNp6AXYy2xk0dTL:p+vK5p5+hU64sK/5VnXR0IE/v3m3f6J4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616158876, "uuid": "f75abbc0-b5d5-4b81-bda2-6592df488ca4", "value": 714752, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616158876, "uuid": "585a4126-35dd-4190-acbe-54221ed24ce5", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616158876, "uuid": "facc9542-1c5a-4607-91b6-1ea8c9c8661f", "value": "winlog.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b45d6f-888a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616141216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616141216, "uuid": "bd5987fb-6d0d-4bdd-9f2d-15cb5daddee7", "comment": "Malware payload (AgentTesla)", "value": "1884a1d1b95817221894d06969fbfbc0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616141216, "uuid": "e91ea7ea-41f4-4f5d-86f4-e01f43aaf0df", "comment": "Malware payload (AgentTesla)", "value": "a3a2ad325fcc84f63b237101a71e7ebe6dbfd52c9fd44fa076700777d8969659", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616141216, "uuid": "332b8904-e4e9-4e45-91b2-839296b96996", "comment": "Malware payload (AgentTesla)", "value": "ee42fe7b7650c402142034bba8a88905e32ace49", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616141216, "uuid": "52ad5ddb-9997-49e1-a9b6-3097e0d497ba", "comment": "Malware payload (AgentTesla)", "value": "b65e67935b49ba354ea106574fc5dfb52ec225b333f0a2ec9d451a34bb01b2450e7654d9429372d4a78ebb5fd166880d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616141216, "uuid": "24db24b8-fe65-4592-ad91-35858af238e4", "value": "68E4DF6912459F4CCD7B0D7AD8563860A7F0CEFA8527E6979EE110D8044EBAC8DF31CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616141216, "uuid": "ee74b1cc-a1f5-4d09-8d45-9f279db85187", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616141216, "uuid": "7e057daf-7f81-46bc-9b28-10f0b3f88588", "value": "12288:gJ4Iyk4A5RThvlOwN/yo9MszkL10SKFRKGricvyPV0j2pAKQOu6yPXpKww:i7Oe/yo9MySKF9rxvU076yAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616141216, "uuid": "1c45419e-a8b3-49ab-8837-9efaf766d67c", "value": 696832, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616141216, "uuid": "c98b2be8-5d92-407f-af19-5a7b1cad7546", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616141216, "uuid": "71442e94-d1c6-4fc2-b8ee-55ed75f8ee7d", "value": "PO docs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6a8664-88a3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616152081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616152081, "uuid": "abd34a18-efa6-4224-aa53-9acc4f0b487f", "comment": "Malware payload (Dridex)", "value": "50573c34d30f07ac908ecc6a5d1f0774", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616152081, "uuid": "8c8d1680-3a96-4e11-9aed-22cb7aa84021", "comment": "Malware payload (Dridex)", "value": "a3ae41607da7afd0b9fe9fc6fa24a94d26158fe8617cbb871dccea1bc06ab53b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616152081, "uuid": "0f2f9c60-6b63-4f8e-90ac-e9fd5bc19444", "comment": "Malware payload (Dridex)", "value": "7508240daef83c5320c90302d8a8466eb258bd05", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616152081, "uuid": "57138c7d-e9d8-4824-a9fb-f93a97922113", "comment": "Malware payload (Dridex)", "value": "5d182dbdef15224e2a3f06ecdb055bd150983074950d9680e539f1ec09dc25feaa8e83a48b7761183b4510ebfecb58ff", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616152081, "uuid": "2483d5d6-b86b-4f76-ab1a-a63a5f4905e6", "value": "D614AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A6FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616152081, "uuid": "d31012cc-e9c9-4088-8121-4267fb2eba6c", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616152081, "uuid": "d42bca01-4021-475b-bbf9-7345d3c15746", "value": "3072:C1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:6i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616152081, "uuid": "53896e62-83f7-4cb7-b8cf-9083917f2f24", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616152081, "uuid": "d31d7b4c-ea0d-428f-beb7-6ae418030dbf", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616152081, "uuid": "a18e407b-1e1d-4cc2-97c3-5f66f7fde2a6", "value": "a3ae41607da7afd0b9fe9fc6fa24a94d26158fe8617cbb871dccea1bc06ab53b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7769a25-88c5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616166806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166806, "uuid": "c3b2ae09-798e-4737-a223-8282df276e3b", "comment": "Malware payload (AgentTesla)", "value": "d0c35cf63ea01d192024c54f676ab3bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166806, "uuid": "b417b9a1-064a-4ade-bb65-b258899eebb6", "comment": "Malware payload (AgentTesla)", "value": "a4f6528ed4920421f4e4b8685fb35e1bb573af090bdd1fccab34f3f2bd269cc2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166806, "uuid": "3ca64fbd-3a03-49ee-9212-2e3e918cfe19", "comment": "Malware payload (AgentTesla)", "value": "7fb3f0d9fe2ba4fadb3b937e7e34e7f040c0a808", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166806, "uuid": "344273f3-bd33-4141-8871-728543c958cd", "comment": "Malware payload (AgentTesla)", "value": "c2132ec39aca3f155e5eb135fc5175f62c317fc2fbf75ee809a3b7fdc09f43200f995927ca511870715c8fe8eb0a4394", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166806, "uuid": "6024acaf-0530-4edc-9d43-463f3b3599e3", "value": "70E4D0A93301AF4ECE398E79D4523800E7E0DAF6C117E7875DE214DA4A4D7AD8DEA1C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166806, "uuid": "abea8ac6-b1ce-476f-8813-d93b5e5be704", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166806, "uuid": "924a5cba-3bc8-4092-9a67-6cdc1fa63182", "value": "12288:ieaOvMFDuqVQ0P2eKC6LTR/BWd9IQ2OCqbvCO8vHiRlP8sFsTSWtPy:iaMFDuqVQ0JKC6/R/BAIQ2OXCOwHKPUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616166806, "uuid": "ae900f4d-1420-490d-9693-2fd9691459c1", "value": 692736, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616166806, "uuid": "ee09c10b-5ccc-4503-a30f-31d12de41ecc", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166806, "uuid": "f3ec3054-33c6-4286-9c36-a3c2083645e2", "value": "d0c35cf63ea01d192024c54f676ab3bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b08a86-88d6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616174084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616174084, "uuid": "59be87a6-e79f-43fa-a6a0-7b848aff62bd", "comment": "Malware payload (Dridex)", "value": "78491a1c0f67a11097b61d66cf558125", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616174084, "uuid": "ba2ebbab-aead-46c5-aabf-842e5078aa3c", "comment": "Malware payload (Dridex)", "value": "a54865f69c50e1a799b8565b8b0e783c9f051a2415df4f8811ed7bcb3aa6f4c6", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616174084, "uuid": "581a9452-7643-40aa-abb1-8601ada8f00f", "comment": "Malware payload (Dridex)", "value": "1b4dfe560b9f5a5601dad8e4bd214843bd9324f1", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616174084, "uuid": "487484e6-542d-4b63-9f36-98cd692eb0aa", "comment": "Malware payload (Dridex)", "value": "75895c8689cd9251a03a96dc87fa2b3538ddc20ea033f19b950cb5f43b53a06e77d71877bd178573ba575f4f576ea9c6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616174084, "uuid": "30d305ac-798a-41ab-afcd-f94cb3e445b8", "value": "8214AE9DD729E464FAF3D9F104359A1210BB6C49892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616174084, "uuid": "fb2fffc0-c778-42a6-bd9d-27fe3f9b06df", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616174084, "uuid": "9db44a61-34b0-4d85-9e04-51764cfd67c1", "value": "3072:41i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:ki78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616174084, "uuid": "60c6c901-be3b-4a9c-97dd-d01b5461aa5a", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616174084, "uuid": "cd31275b-3548-4c36-ad57-afdc9754e6c2", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616174084, "uuid": "5d8c1a4e-04c4-4b85-b2c0-0e7de25d78ef", "value": "a54865f69c50e1a799b8565b8b0e783c9f051a2415df4f8811ed7bcb3aa6f4c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec70d523-88b7-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1616160909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616160909, "uuid": "d5cad882-a45f-4f52-bf4d-53134d42c97b", "comment": "Malware payload (GuLoader)", "value": "8c229ed0bfb0333fa1d6b5e218e141e5", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616160909, "uuid": "cc967473-ba17-4909-81e2-744fd4ae75c2", "comment": "Malware payload (GuLoader)", "value": "a54e55e6c75f7817fec6ec09af784b41b5f6cea2c94aeb8c37adec1f81414f50", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616160909, "uuid": "b7e53f25-f290-48fc-9cdf-78d5fe21805b", "comment": "Malware payload (GuLoader)", "value": "740217eefbd04ef9d65fe7f060bd2f05d9c6e577", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616160909, "uuid": "41ef0b9c-5dc6-499e-86a2-159097abf334", "comment": "Malware payload (GuLoader)", "value": "ba69fe80e96ea42aa349acf38a385cd018fd035a7bb5d08df41e3145aa431cd2789e87795fa62ecb25bfbe2c2563b884", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616160909, "uuid": "e5c54b1c-e068-4b56-a51f-f40b9f36780b", "value": "3383594261989532CA188BB1EE7097BD157E7C331C40CE4735B8265B7F72E939C3626B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616160909, "uuid": "13a198d8-0e86-4832-b707-d1eda1e253df", "value": "31bd1cadb3b25f66b3d33e08cfbf65d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616160909, "uuid": "5ec848a2-4922-4d3a-be1c-2cd0642050bf", "value": "1536:EcnShzF/hV76yW/u8/DGBFy+kA40HPR0MB8:ENUe3k+p0MB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616160909, "uuid": "019c943d-b5af-44c6-b0a4-7a1c4fac40b6", "value": 83080, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616160909, "uuid": "fc7fbeac-11ac-4ad3-af10-d751a7eb8d43", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616160909, "uuid": "a365f720-96a5-4037-8505-6724a128a341", "value": "Doc.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b157b5a-886e-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1616129312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616129312, "uuid": "5f282e12-a415-4196-81b8-ad605860ab11", "comment": "Malware payload (TrickBot)", "value": "b9fb09b1f7881a716778305c8903ea28", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616129312, "uuid": "d296c58f-4796-48bd-8412-33f5b5d5671d", "comment": "Malware payload (TrickBot)", "value": "a68783f39292f23e1dd58bd2581646d15472d2173156867cd06770d6c0afeecb", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616129312, "uuid": "63eef3d9-ff3a-4d3a-9d1e-d6c8b3e1dc5a", "comment": "Malware payload (TrickBot)", "value": "879969506e5b0e85505d8533e853171b11e1f529", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616129312, "uuid": "2b23269b-1ab5-4256-8adf-65284a04405b", "comment": "Malware payload (TrickBot)", "value": "8396bae1e82dc1c5edfcecac070f91c8161b6bce71e0528b6b11a0e730efbea58950e0e4d8ed6579ca97f0edce42bdd1", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616129312, "uuid": "ebe0b71e-2e80-4faa-80c9-6dee4f9918ee", "value": "E825B552F479FE78D99505B82AB6ED1A0102EED1355CE50D292FFCA0A6F3A1131CBCC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616129312, "uuid": "259d03a5-499d-455f-a5e4-51e0facdba94", "value": "6144:OFyPCRxHjSl8El+fwZGvgZpr3J8YUOMfIgpaxDlwUwSxd0XtUmJZ9GxCLfw6cmkp:Ir4Hd5mlC0fFcZ+7Kdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616129312, "uuid": "7d31d247-45bc-472d-a43a-6cfed51cc672", "value": 993280, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616129312, "uuid": "9b4fd676-c820-4044-84d4-29d84ae6ad16", "value": "application/vnd.ms-excel", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616129312, "uuid": "a241b703-9fb3-4f71-a3e7-9ff89250bbca", "value": "Upload_282464973_2113275472.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d5b8e6d-8888-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1616140402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140402, "uuid": "87d78b9a-4350-4d9d-a4b7-dee40c7641e4", "comment": "Malware payload (RedLineStealer)", "value": "0b781d805d90743544803c2159e368f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140402, "uuid": "b4c1894b-5344-4bd6-b615-ba9bc997eb32", "comment": "Malware payload (RedLineStealer)", "value": "a77694d524cba3de7f828ee3c2a19308a6da5fafdb4c3320c083e2f681e9832d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140402, "uuid": "60e07524-dfef-4f4f-9fb1-97da6508cb8f", "comment": "Malware payload (RedLineStealer)", "value": "bdd041b20f5e1a839081ea89ba5a7fe110d7a26b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140402, "uuid": "5f622419-720c-4a42-8f53-f903b7291f87", "comment": "Malware payload (RedLineStealer)", "value": "9a8b4120ff5f45a9dd8070aec5fc12b1394a36aaa38949c15b8c4eb6b0ef22dcd381ebac2efd4d763d53f494964e020a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140402, "uuid": "b148fefe-53bc-4ee1-b924-ad30140fed2a", "value": "BFC23C31F7E08936EDAF07B589B1C6468AB4F1415413FF2BCCC861527A33B929A13396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140402, "uuid": "f8631025-272c-49b1-b451-206fe307acde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140402, "uuid": "3e9124e3-bdf2-4756-a95c-0b7bb05c65f0", "value": "384:H1nzdDyOP5Dzzd3uFCIhIksz5APjLE2WyFJ5xrVsWUX+2:VnzdDph9+vhIkOs3fWyFJ9c9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616140402, "uuid": "c90f7562-9e30-418f-b4f6-0aadfd3037ee", "value": 26624, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616140402, "uuid": "5a5565ea-90fd-4817-9b3f-d603b4117225", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140402, "uuid": "ec14adf0-a70a-4148-a3b7-6af85b1acf51", "value": "0b781d805d90743544803c2159e368f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f9df24-8882-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616137873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137873, "uuid": "abfc0621-6e5d-40b3-aa64-54725c433942", "comment": "Malware payload (Dridex)", "value": "c5c39eb29a3612212098d944f14c3c0d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137873, "uuid": "66ed239f-c473-46f8-bcf1-661f70b504eb", "comment": "Malware payload (Dridex)", "value": "a8542c2ec7ac9bbe6218cd73284f6a62430cdf643983e68894da699f99d8e6c4", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137873, "uuid": "19e02008-e7b1-430f-a96c-b51a9edbf520", "comment": "Malware payload (Dridex)", "value": "7f85d4a32e053d7d04f16daa6694d8b8a9e39d25", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137873, "uuid": "ca170a5e-c37b-4717-9e8d-844b835ec8ab", "comment": "Malware payload (Dridex)", "value": "cf8b8ff77fe732e8ebc702ce9411a8661f5506259907a0f2cbdcb1355d285dc47eea8e98a456a4f5846cc75e8ab375a9", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137873, "uuid": "76b06580-cfa8-4e2e-a1f3-aa525d16cd5c", "value": "E324CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137873, "uuid": "09a4b703-13c5-47e8-b365-4f2eba8871f6", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137873, "uuid": "d4ef5dff-0673-4209-817f-31063f4abdc0", "value": "3072:+9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:+9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616137873, "uuid": "972a59bc-1f85-422a-a4b4-ab3b59fc7358", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616137873, "uuid": "f4c903f3-f454-4878-8c5d-187341763981", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137873, "uuid": "298472fa-80e7-45b9-b905-2fdb29ae5c6a", "value": "a8542c2ec7ac9bbe6218cd73284f6a62430cdf643983e68894da699f99d8e6c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bccb948d-88c5-11eb-abe1-42010a9c0039", "comment": "Malware payload (BazarCall)", "timestamp": 1616166842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166842, "uuid": "222df5ed-abe0-47bf-9d6c-62ab88309acb", "comment": "Malware payload (BazarCall)", "value": "b3fa1f0de303b5c71bd3f95f8f8b7786", "object_relation": "md5", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166842, "uuid": "06703af0-115f-4281-b8cc-f3d7faa96176", "comment": "Malware payload (BazarCall)", "value": "a8a1352e507f41647de5289388d7656cd02a2f6c522753222a1ce1c4296767ba", "object_relation": "sha256", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166842, "uuid": "220e1e84-0703-434e-8946-414a750b927a", "comment": "Malware payload (BazarCall)", "value": "3f181f82a920d5786ab5b36e31a5038950c6684a", "object_relation": "sha1", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166842, "uuid": "f109742d-6bce-4f48-be52-164d1fe8fe12", "comment": "Malware payload (BazarCall)", "value": "f001a4a1e621a0b6a7b4786e8083e5634cb1dac97074153c2b20f74305577f0a53667120c71fbd921845eed6a358f123", "object_relation": "sha3-384", "Tag": [ { "name": "BazarCall", "colour": "#988BD8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166842, "uuid": "ddf32e12-25dc-4afa-81a6-4e0a5a0f51ad", "value": "67C42AC501DA9BCEF91A56B123B8F883F5277EF2A48ECECF51C81105911ABC3635A716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166842, "uuid": "c79cd794-9f6d-41db-a441-66bc44b33c3e", "value": "ae6670dd686f9d530d4808f1361603cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166842, "uuid": "f8031c62-8f42-4abd-a5d8-46dbba939d15", "value": "6144:cMKl6jQvY9BewWwO+PfVL2WlbQBQrbIWT47NxAIY71TC3jrAYJ+kLobrngfoktdA:qLvaBEUIWT4zAIgGLLAuI8hgSSsS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616166842, "uuid": "c13c65c9-dc4f-470e-8461-e7cf98390f74", "value": 589565, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616166842, "uuid": "9b494ea4-8e27-4e5b-81f1-61955fc31ed4", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166842, "uuid": "7d663540-7929-4f25-b4e5-30cddc50b782", "value": "b3fa1f0de303b5c71bd3f95f8f8b7786.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d24ab20f-88bc-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616163012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163012, "uuid": "a6542e19-a637-4547-88e1-2a2c0fa5a705", "comment": "Malware payload (AgentTesla)", "value": "60a49b2f52fa43053579cbdfb34178a2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163012, "uuid": "709752bf-2b01-43df-8d60-a0ac73a76a8d", "comment": "Malware payload (AgentTesla)", "value": "a9bbcac2ad041a5d93be9a5d14073759cd332e0afd122d307098c38818e1aa98", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163012, "uuid": "e7d42618-693f-4183-919e-af7793258dba", "comment": "Malware payload (AgentTesla)", "value": "54bb9e75641bc9e8ffa38d9b20a9e7b7a8d20bc0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163012, "uuid": "e0de3aef-c3ae-4dc0-bba9-c2ab2f1ff12d", "comment": "Malware payload (AgentTesla)", "value": "1b63eeea4929b2eb975044c2791a199c150d3970800e98bd570d5bf1b00e56972e005b51c13176eb07f5db536995841c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163012, "uuid": "ea86ab0e-16bb-4c5b-aaa6-9f4f245b857e", "value": "A2B5339729C6BF70C5A7E0F49C87C04E6E3CAD005AA2FD89770D37B17237D16A662918", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163012, "uuid": "376cc2cc-a710-4a58-8de6-027af0f16c63", "value": "49152:1yyNAErgPNamhc9yVYsujl3Ahg/LAio+IOfnsQwLvc8S7mmXAdW:1/NTssL9BsIQhgzAH+IysQwbc8Sq8AW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616163012, "uuid": "885dc457-26c1-461b-9a7f-d7279d04d00f", "value": 2329600, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616163012, "uuid": "26f599c1-44ba-4350-b287-b722e16644e1", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163012, "uuid": "1ccfa472-424d-4c0f-bef6-37e3184dc970", "value": "INVC AND PACKN LIST.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc68a55-88d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616175376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175376, "uuid": "0d24658f-abba-4bb0-9c50-a50f82956fff", "comment": "Malware payload (AgentTesla)", "value": "11d570dc06b30ca7f438231b9177bcd5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175376, "uuid": "094715a0-b9e4-4fec-9836-e4c924c232b1", "comment": "Malware payload (AgentTesla)", "value": "ad41df394f597f7f20d20a47f5ddf9514bda74b3789afc22105c3209f1ae77a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175376, "uuid": "69bee2a4-4c5c-4994-9a11-7de2d1bbb894", "comment": "Malware payload (AgentTesla)", "value": "5ad9d323d8013359399256e924c092951b5154fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175376, "uuid": "469f456f-b1ee-4c10-8a6c-7b30917f9290", "comment": "Malware payload (AgentTesla)", "value": "fff7fc4f4ee62a0922f4627be81f7bdaca41cf496fe4bbaaf9f45b8c13ceac80fb5807436c17c968fa8398157006e718", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616175376, "uuid": "f7199a45-e79b-41e6-95d7-86ce1d0cf7ac", "value": "78150101BAA3B6E8E0398B76E456C2530FF5BD1DC293E97BF8A5B18D04B2074867D131", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616175376, "uuid": "7e9e13e6-d5ff-4851-8d41-b7d55c190322", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616175376, "uuid": "2aa651de-d6cf-4745-a48c-ecc10d7e8925", "value": "12288:lpjDRu77/uVBTwt04nTNkuq7YoBufaVuw+YtzxDr435UUSYoYDOGRxVxaoBf/TkZ:Ky+t045tvogfaVu5q1IJiYoRXoBf/Tk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616175376, "uuid": "c86ea098-d27f-4c15-977c-a9b284dc3100", "value": 876544, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616175376, "uuid": "e534e707-c322-4f9d-92ee-66c58344809f", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616175376, "uuid": "2b97ed80-45b3-4b7f-994d-f6a547ed7bac", "value": "PO NO-278 HAC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41410b8d-88b5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616159763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159763, "uuid": "2dd2ed25-6fee-4ea4-94eb-d344c01a42cf", "comment": "Malware payload (AgentTesla)", "value": "1172a9bbdc3e52c50d5d494e3d08980b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159763, "uuid": "a8b1a9f5-1a57-4b43-a288-cc6362385696", "comment": "Malware payload (AgentTesla)", "value": "ad6236babcf9fc3f5233b9d4a6851912fe6b62f14b3be2511adcfe442c9e6611", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159763, "uuid": "06bc0112-b070-41e0-b9c5-4a6d7e1c2f79", "comment": "Malware payload (AgentTesla)", "value": "4b699890b42f997652fa58ac31343ee82e836a76", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159763, "uuid": "32e9cad1-d853-40e9-9800-f492ba8188c0", "comment": "Malware payload (AgentTesla)", "value": "1614bfe4ead818e430e80fbb0f6a7b9b3f4c19eaced693ef7bf237a0fd9396b27b8882911e9a29f02a538ccba07eac81", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159763, "uuid": "49c38746-e7fd-4f9c-9cec-861c4b256611", "value": "296445C3A449249FF4EEF23BBAE9896991C2582A1C03480192723FD3BFED59752C4D5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159763, "uuid": "dd9ded10-d1b8-43c3-8f2e-b30ffbfe9228", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159763, "uuid": "3d19f701-93a4-416c-9edb-85ff70c5c674", "value": "3072:c2N/cInQpm9gP0apYgmuqgkQRb0CkGv3oQQQKANTJnNNzkNNmucrNNNuNQNNNEuL:c2pHp9S0c+kRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616159763, "uuid": "cc251906-82c1-40d7-872a-1d0b054fb99f", "value": 328704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616159763, "uuid": "c3d1560b-a8ab-4492-a2eb-2947009a3f59", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159763, "uuid": "13ffe26a-c9a9-48dd-b518-dc0f9a6bc600", "value": "RFO 003887 MTH 888700.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c482b0-88be-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616163666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163666, "uuid": "dea2016b-dcb0-4751-9def-97d8b729e513", "comment": "Malware payload (Dridex)", "value": "74d393fe61e9d43360b4bc397df52c98", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163666, "uuid": "f76a3214-d4b7-4710-aae6-370fc4fde55a", "comment": "Malware payload (Dridex)", "value": "ada6c8cea7615848b5f10965c20743bd9b0ba320c328368c90bb63a1ca0d3582", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163666, "uuid": "b7554ad2-60d9-41c5-ad88-87074e5e6ea3", "comment": "Malware payload (Dridex)", "value": "2835e6dbdf4f877c40c7fa4297fbc433ab0caf0d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163666, "uuid": "ba6e2c78-5676-4199-a9b2-701e774cd64b", "comment": "Malware payload (Dridex)", "value": "55cee5e68c93d2b8d6d48fcf2e6494ef896f6bb48e3ef505d38201c5dde562cb3d9d46acbf9d02b4ece53e97a6b5c4f0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163666, "uuid": "50247454-bb3b-4ea5-bde5-38e20c36f4d5", "value": "83048E2DE2EFD9A4F6F33630293642219F257C92DA7CDD1C9B08964E98F01E4C994736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163666, "uuid": "0155e0f7-e1b6-40c8-8f0a-707f91e53721", "value": "296c5ce0ec7abebda668048df2df9b05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163666, "uuid": "75a3fce4-6a20-43f9-97cc-e5120e4a52bb", "value": "3072:OZ/Aq5HJv6rBXHdH1iF3P74buGdSg4GeLfqMsnwXB:ObRQBXHtq3PUbt3te7Bsn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616163666, "uuid": "54a79337-4713-4647-ab86-79d88420b403", "value": 188416, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616163666, "uuid": "4e8c09b9-e0b7-40fc-a02d-25b566aebde5", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163666, "uuid": "49b4e64b-044c-4fc2-bedf-364a84b59a70", "value": "74d393fe61e9d43360b4bc397df52c98.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad2c1de-88df-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616177978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616177978, "uuid": "1b586d96-02c3-498c-a997-69f9fc1966ee", "comment": "Malware payload", "value": "a80c7aa74e2813864b9796521380d193", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mon147", "colour": "#EB2031", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616177978, "uuid": "1b9e8d6c-7399-425a-9694-3271933409be", "comment": "Malware payload", "value": "aed2b8d91256d038c0452ec74b6757f667955ae2d1488a2c5ab0b97c5fa8b2ee", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mon147", "colour": "#EB2031", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616177978, "uuid": "5739f9ad-fa74-455d-b73d-a0975a97c9ec", "comment": "Malware payload", "value": "ca3565ba0b524ee1600d266335e151a408deac4c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mon147", "colour": "#EB2031", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616177978, "uuid": "d43f56f3-2311-43d9-9b12-6255c68813fa", "comment": "Malware payload", "value": "2f0ed9fedf30a3277b2274d48782cb0661992401bdb668b57f72503d485751cd671f109ff1c834d0bc815184300c0898", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mon147", "colour": "#EB2031", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616177978, "uuid": "a3592f72-2205-4aed-94e2-0233987a9187", "value": "4EF4BF03FA90D1F5D27D647468114B2156E9ECA0EEF5C6C35B85FE8D8E3A2C2622D393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616177978, "uuid": "90fb7cfb-7d25-4eb9-9b55-094be12c967f", "value": "27af48f5c723652212203558f954e963", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616177978, "uuid": "3bdb3756-a1a9-4e8e-9ea7-08bde69b2a82", "value": "12288:/GkcUcJTpz8UmB12Zdf9Mc1FCd+sRvD5tj9yt:jcjpoXf2Z1WaOvRbXjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616177978, "uuid": "1a6e413a-4c91-4ab2-b5e7-c74ef6ff0029", "value": 757761, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616177978, "uuid": "26605008-b577-45ae-9b7b-c8c548cf4613", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616177978, "uuid": "ddd02973-722e-430d-bc0a-c2034363af5a", "value": "147.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef3dc484-88b5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616160054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616160054, "uuid": "2556ea65-d083-4abc-a883-ee6e0dc0c718", "comment": "Malware payload (AgentTesla)", "value": "21ac74d3d80d6c82a25b888aad396b1c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616160054, "uuid": "7c732fe1-cedf-4877-aee1-7f8e09745216", "comment": "Malware payload (AgentTesla)", "value": "af4ea3214175cd3c38158c830dcd1380de07025fc74495ee6517f63fa1093821", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616160054, "uuid": "216e67c9-4e23-4b97-a2d2-33616687c59d", "comment": "Malware payload (AgentTesla)", "value": "cf64a736fdabbe88725bd30abeeffb12db93937c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616160054, "uuid": "b8bd804a-07ae-49c6-9132-86c2126fe0ca", "comment": "Malware payload (AgentTesla)", "value": "a0eaa9fa1c9f897544d063cccb77c6e24950be7fbcbc2486e6b903501ddfeedf9726bfd220d2e0136178db35a8cef66d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616160054, "uuid": "bb9ce13c-e2b6-4455-957e-9b9c82662799", "value": "C1F4AE01A3B6AB58F37B537481B4410187F6B955D63AD7BDAAC090CD0EA3B458A7B333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616160054, "uuid": "9265b1a2-4a6c-47ea-8560-02edf622b69f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616160054, "uuid": "cee7e955-4fad-4af9-adb9-89d12277ad8a", "value": "12288:/IeZx5/S+qfxGz7MT2ML4pwgGqPTf5c02hFCIWNXqWDMHP5:/pZx5/vqy7MKMRyf2sxNXLgHP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616160054, "uuid": "174c603f-d92b-4f54-beb6-82a6c0cac6b8", "value": 780800, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616160054, "uuid": "3014ad07-54e4-4e28-983f-bf5e50ac2539", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616160054, "uuid": "6526a82e-0fdc-4080-b787-e585d6a65a6d", "value": "Purchase Order for March P2209G.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a302b7ac-88bc-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1616162933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616162933, "uuid": "f00e63c5-9c03-407a-a299-490bbc7bc57b", "comment": "Malware payload (SnakeKeylogger)", "value": "9015c20abeb003eff21a1c376c0e858f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616162933, "uuid": "bd71d821-1ce0-48e1-aae1-2a838eb04fa4", "comment": "Malware payload (SnakeKeylogger)", "value": "af649d82b764ad869af9be5a3a1dc85fcaee4fb8bcf65d314244ed4f3f54ffea", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616162933, "uuid": "f869895a-b107-4ff3-a804-1bea3e21966f", "comment": "Malware payload (SnakeKeylogger)", "value": "a99ef24bd1e6f43dbdcc3de3fa7f277a2a7edd80", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616162933, "uuid": "3bfdc147-0caa-4b37-8231-4079e6d4e1ee", "comment": "Malware payload (SnakeKeylogger)", "value": "7c44aae5c99d53a161259e6da7023a726d8199b2f6bd10a4cdec0fdb3ca55c815451c93572dedb64a651fe76908a0de8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616162933, "uuid": "37d181c1-58aa-4887-ad28-09ef2454a603", "value": "6DC3AFF866047DE6562F576BCA59FCDD03A627628ACBA4CD5078B7C309A3325FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616162933, "uuid": "5a6eb939-9ac9-423d-8625-f39d958c1ee8", "value": "3072:sm+yCDhw4CwJwxXYJZF3cw0dVcD33xmcu38E/eMA9c9/23LAFBkbgyvAztln:DiDhw4C3XYlKo3BmZmjMoeDUUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616162933, "uuid": "94263b6e-6c38-405d-981f-cbeed1f454af", "value": 124962, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616162933, "uuid": "a5c7a97a-b192-42c8-af46-07dbc164a129", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616162933, "uuid": "8cdaaf29-bbdf-4e32-8065-8a40fede0da7", "value": "Requirements-0.xls .doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ede572-88b4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616159280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159280, "uuid": "e3d3fad1-c08e-4eed-9769-9910038e57a9", "comment": "Malware payload (Dridex)", "value": "36dbab140282b3e3272a5223298c617a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159280, "uuid": "f5d0cb72-f28d-48ec-9b4c-09e387d680ac", "comment": "Malware payload (Dridex)", "value": "b0494eb21c852292169aa0de2c0d5f897f23b4047778555e203b00ef46b3340b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159280, "uuid": "8da84893-724b-4367-bf08-bbe8abf0415f", "comment": "Malware payload (Dridex)", "value": "755697fd4cc4bdb2af44ea902cd52e7029b2e0c4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159280, "uuid": "a276a6fc-1542-4e6e-866b-36a7e54304cd", "comment": "Malware payload (Dridex)", "value": "960f185766dbe19e17702a13d178bd79e1e8b049d71eae6968eba913f92e1240f30a3c4f74cce32ee70142fb6c37c457", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159280, "uuid": "424f39fc-bbaf-4eac-b6e2-fa5107cef080", "value": "6083F18F866148F9DA2BD47DF67819E3A1BD2980C290B05EB401A7F9430A3C2375F56F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159280, "uuid": "f1f8bc6f-2d71-4b9d-be48-1cfb54f712b5", "value": "1536:if9RTnePYhwmix276QoYsEPffR0/3mK5oYicCUAUH8O:if9RMYidE7jLsEPfXZYiacO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616159280, "uuid": "4b6f3edc-5d52-4519-b854-cbc41ab284c8", "value": 83121, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616159280, "uuid": "53de86bd-dd32-47cd-92d5-45439c480f48", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159280, "uuid": "2c2eae8d-6be4-41f7-b735-09d8acb76a46", "value": "document-1117512603.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe04a66-8887-11eb-abe1-42010a9c0039", "comment": "Malware payload (Stop)", "timestamp": 1616140245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140245, "uuid": "af24d3d9-5480-4305-93b1-4d6f36f398e7", "comment": "Malware payload (Stop)", "value": "c2f2834b216ef788b6c0568d0267223c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140245, "uuid": "8253cf21-dfb8-4aed-8711-1a2f89c117fb", "comment": "Malware payload (Stop)", "value": "b055016e0d82c57b58cd126f26b4b8f4dae1441f0019bdaa42452e815f128944", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140245, "uuid": "e6057e1c-dacd-4964-b3f4-94f2c3db0c6f", "comment": "Malware payload (Stop)", "value": "77629d77891b0e995cbd577c7835d7465e5f8ff7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140245, "uuid": "da634572-cc14-4b44-b172-f96509813f54", "comment": "Malware payload (Stop)", "value": "0e1a09f63683c7b5df4b5f5db012532c5b82663110af59a1344b317826f75946add9475ca4e76fbbce437cefda981673", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140245, "uuid": "e3ed14c3-4046-4836-b8a6-9fa74ce5b146", "value": "78F4120072A5C473E0560AFA8456C6B52931FC71BF259AD777913B2E1E21AE0CF36A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140245, "uuid": "bdb8c74c-858c-4c03-acbe-b2984166b32c", "value": "fadb03432906cb0b1086222508551a23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140245, "uuid": "db603273-b553-43a3-8d67-30e1e100fac9", "value": "12288:AgzgR1xvd+wlVC4/YOJtn7DX+JL8gycwAwF7sGC9rrvnwHf8FgYT2b1px8WrE:AgzQzV+wzC7OJtnOL8gEAUBkm8ST7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616140245, "uuid": "23ce5812-befd-434f-b7a0-7af46ca3386b", "value": 730112, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616140245, "uuid": "932f026f-690b-4474-8a50-8686c8691ed9", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140245, "uuid": "a4bfb46d-a39e-4a48-9b59-2e265bd4c671", "value": "c2f2834b216ef788b6c0568d0267223c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d6db866-8896-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1616146522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616146522, "uuid": "a3dffb46-91c3-4218-be86-fc44a396cb54", "comment": "Malware payload (Formbook)", "value": "c9cec79aa81284754c034dc83a6ab534", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616146522, "uuid": "1bda42cc-5478-4f42-acbc-ca631fd2bff3", "comment": "Malware payload (Formbook)", "value": "b063c6c0eda820bf0ccd1039147bfbc92e0698dfa23e17daab8c11b0dc1e0320", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616146522, "uuid": "f4493174-98a8-4441-8c1f-05b9a53d9f1a", "comment": "Malware payload (Formbook)", "value": "89861dc8dfc836861d93036d70704b859da9556d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616146522, "uuid": "567ec2af-1958-4522-a672-e1606ccf534f", "comment": "Malware payload (Formbook)", "value": "f984953a460b867a7f097863c53a8fc2919101125e625a1d7e2723acf4ab600c31bc3c1d25a780ebf2ed45f3af9ad67a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616146522, "uuid": "189d2590-c9eb-4b19-9bec-d47f0b1aff1c", "value": "3B058D1367D16F89F17E577990A8451453F2B85AE336EABC3DA180CE15A2F80C7B07B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616146522, "uuid": "66bbc71b-c63f-47b0-b3f8-85a565441fbc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616146522, "uuid": "eaaf5c36-0a74-4a09-bfe1-1a83c97bc0b9", "value": "24576:6FZJcibpJMzf1LslClvM3u1bJstxbfcfZweeCWsOlaQ+c:6FZJcibDMZLslClvx1b48ZXekOx9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616146522, "uuid": "51349c50-4fdc-4b42-814b-096cb1a49d34", "value": 833024, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616146522, "uuid": "e40f8f8c-3826-47f6-b4e6-c4ab1132248e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616146522, "uuid": "a0807db1-6b9e-47ef-bfa5-1392057357db", "value": "SecuriteInfo.com.Trojan.PackedNET.591.20800.29505", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b91decf-88ac-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616155834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616155834, "uuid": "467ac3d5-72b7-4e37-8388-21c3e046e328", "comment": "Malware payload (Dridex)", "value": "b61a05ff972fab422089c35bc013720e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616155834, "uuid": "7fd420e3-6295-4d6e-a42a-aa57595a409a", "comment": "Malware payload (Dridex)", "value": "b39c50a8e2c3dd583ed1bcb6ad6ed8d6ddb4228ecf77dab3e57de98f53f94bf9", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616155834, "uuid": "c3f2ae6b-5094-42d8-a28b-255860d29f65", "comment": "Malware payload (Dridex)", "value": "b506a31fea0112fda8a932219a13a2e0b15a6986", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616155834, "uuid": "54ec72ca-d8e1-43b2-a0a8-34611884da53", "comment": "Malware payload (Dridex)", "value": "6dcb223226a485af90ecc2bb3b957ab2c820241770fad4f29f1ed820b701e19ab682ef235c98348103210be5fa48a789", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616155834, "uuid": "0fba6cd3-0868-4c61-b96c-cb1ea1385efc", "value": "AC14AE9DD729E464FAF3D9F104359A1210BB6C49892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616155834, "uuid": "557f8fbc-15d9-4195-a688-a4b5bd6cbcda", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616155834, "uuid": "06733403-d5b9-4f02-8fe9-123f253cabca", "value": "3072:W1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:ei78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616155834, "uuid": "c65d9b53-6d73-4135-855f-b67413c4cb25", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616155834, "uuid": "3a82a890-70cd-4748-ad7c-60ce57b96469", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616155834, "uuid": "88b77efd-7757-4744-ac5f-27bef7afcc9a", "value": "b39c50a8e2c3dd583ed1bcb6ad6ed8d6ddb4228ecf77dab3e57de98f53f94bf9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0081e3c9-88ac-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616155788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616155788, "uuid": "d168c3a1-763e-4a6d-9fe2-ba150e5f594e", "comment": "Malware payload (AgentTesla)", "value": "feb990f2eb7a1b9abbbe4a78ff1687f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616155788, "uuid": "5d359e78-09b9-4a7d-b411-39446e3359f6", "comment": "Malware payload (AgentTesla)", "value": "b53452ceb042eda660c8caf32d410df482b58ef7818bcd013036f54ef4c3be84", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616155788, "uuid": "b64f4815-9d16-48b3-862d-f96aa38ff95f", "comment": "Malware payload (AgentTesla)", "value": "6fcf283702bea9b0ba8d0ea25df9540af4c24f23", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616155788, "uuid": "e9ad46f0-654d-401a-b16f-36c29552c2e9", "comment": "Malware payload (AgentTesla)", "value": "e3c18a62aefd6cbfb55de62e8bd72a6e88abac764e1565cc4ccba802180311adb71edc3e98a9f4ec291c03548cc23b0b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616155788, "uuid": "ecd52e66-1444-4a14-9a17-e1cc490fc548", "value": "3EC4E061AB367FE8E0395370047544511BF7F91E8336DA7A7CAA40DC08E3B4896B6B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616155788, "uuid": "08679c4c-8e0e-4d34-a790-faec9787dba6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616155788, "uuid": "58f5a9d8-30ab-4f27-b713-6b2c5e8c3d7d", "value": "12288:NyBiEJCAqzxI4rTs8wcns7Vg+6ObLIEWBbTSv7wpyTaSCL5:N0iEJCAqZrTWm3WsEWpSTecaJL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616155788, "uuid": "de68dde8-d7f7-4e2e-8137-b5dd6bd3caff", "value": 593920, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616155788, "uuid": "595ed026-7032-4e1d-aaff-0bf34f98413e", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616155788, "uuid": "d0de6f60-48fa-4531-9367-cf1981b6dfc3", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff788d9-88d8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616174954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616174954, "uuid": "d6b4cc8b-c523-4721-bd54-2866559c3405", "comment": "Malware payload", "value": "656cf5de4c9069f743bdca98059291e6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616174954, "uuid": "1c037937-66dd-4c93-a1ca-de312f57e393", "comment": "Malware payload", "value": "b7ce29ffbdf00771b539b28ce01d57cd5805ca3a6ca2eb1b694eed4466912286", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616174954, "uuid": "7df004b9-4bbc-4e08-b3e7-d6aeab0dec27", "comment": "Malware payload", "value": "c7b56f86517576a06e433519d9d07b62884033f5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616174954, "uuid": "d43c78c7-6281-468b-b7a5-73229168fa9e", "comment": "Malware payload", "value": "95f9cab3f6a7d0838e1d56de130be6785f8c5ca58c26c125bdbcc47bd952fdf6206aa29931caed21c0844c8fe02699f7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616174954, "uuid": "a7fee24c-d527-4281-a682-d7b76c0ee656", "value": "E1056102C524A5AEE4B7CAF0DF9AC942D8307509D1384E66E5F7EF2B2C99752F23E504", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616174954, "uuid": "e1f4d97e-ce25-46a9-a1d8-ab5f40778fbc", "value": "0f16affdfe42ed4fc3f1c4c813f7dca4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616174954, "uuid": "44475a58-24cc-4afb-a196-77507b292e53", "value": "12288:S36qkyKCk00wD9Gq47tbDIvk0+dXe9lgp7AoH7wf7BmijtUC:s6qkyKCkNws7t3qgXe96p8YUVmCtz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616174954, "uuid": "6cba45a7-9037-44ab-9a7d-7aee04f4e1ad", "value": 872960, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616174954, "uuid": "9432bb90-e2f6-4e74-b374-e3d6fff79333", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616174954, "uuid": "4ebf4c86-ce82-41c7-8974-bafc9a94ed09", "value": "education.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b120878-8892-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616144639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616144639, "uuid": "62a402b6-856f-4195-835d-bdfb9cf7d75f", "comment": "Malware payload (Dridex)", "value": "ccda1eadfa80a61191e4073adb0a1e35", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616144639, "uuid": "ae6f3168-3694-4796-a6af-553d878060f6", "comment": "Malware payload (Dridex)", "value": "b81acb0126f736b549e4ab24a678dc5b468c3d9a9cc9906b2719c0f11e13d044", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616144639, "uuid": "9e6714d7-e63b-4b83-bf3c-7963f6e8ccbc", "comment": "Malware payload (Dridex)", "value": "4b8ce151540141cbcc13b2cf79e70cf23a7f3cac", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616144639, "uuid": "d5656cd2-d759-44b7-ad93-2531c2ac0e04", "comment": "Malware payload (Dridex)", "value": "034a71820f8d1bc952e5f2da9bead9bcd5af7ed9856e797eb769098e8e2f5c235624a013db934b965f1585ed39c95b16", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616144639, "uuid": "f2c72dee-3816-497b-94e7-098b69bcbefa", "value": "6F14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A6FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616144639, "uuid": "7ff37b96-9b72-44d1-8548-b30ddb7aa2ab", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616144639, "uuid": "0d85f78f-a357-424a-be29-aa902c73b070", "value": "3072:l1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Hi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616144639, "uuid": "ad294717-2083-45a8-9791-408a079bfd5d", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616144639, "uuid": "310e6df5-987b-4d70-8457-f0230a825c98", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616144639, "uuid": "22de1099-802f-4498-8cd5-1e508cd1241f", "value": "b81acb0126f736b549e4ab24a678dc5b468c3d9a9cc9906b2719c0f11e13d044", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80f5307-88df-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616177974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616177974, "uuid": "c15264c5-cdf4-4b42-aa4d-0eefee704706", "comment": "Malware payload (AgentTesla)", "value": "ea98e5d6eca835fdb757bc6fea7a4b87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616177974, "uuid": "0bab914d-5de4-43be-8009-7b1c72944d6f", "comment": "Malware payload (AgentTesla)", "value": "bb5de34eed16e7157d51f93f11e1d135254a429ca8bea94d28e1bc55380ed1ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616177974, "uuid": "e2386e97-6bd8-416a-905f-e1d3829d2ae6", "comment": "Malware payload (AgentTesla)", "value": "fa6780bf67e1789c71ce2edf35e9fd9167a4931a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616177974, "uuid": "213e744b-569b-4c9c-b08b-96c92d49c921", "comment": "Malware payload (AgentTesla)", "value": "c3731dfb04ba8fd13ce1f914a189326a8ed47c584efc0f452be200a5d1a115e26a2fd1bc5ff461235b391404fd601572", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616177974, "uuid": "53fbe385-2ddb-4259-8932-d7030e79efe4", "value": "9225CE1193E0AF48E1BE13B508B985161BF7B59A83A2E77D985400CE0E73A46C77B737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616177974, "uuid": "7d402f0a-0107-4b0d-92c5-38e564253091", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616177974, "uuid": "b4f16b54-0c72-4e9d-81e0-42352a24a231", "value": "12288:PGalExVjpAXi8g2O3YreMNLnpxhgQ8/ehTgXDRSpBIGKX8u5wPEXRAXzxEgx5Eoo:rlYf92kMFThgQVUzKGnhRYzxEgx5kR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616177974, "uuid": "416f9248-5cc2-495f-b317-8d928a76b772", "value": 969216, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616177974, "uuid": "cf44b181-300b-44b4-925b-14fb5d58a200", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616177974, "uuid": "9c1efbbd-0147-4157-85cd-28e382d715ae", "value": "inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac4052b-887c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616135592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616135592, "uuid": "473d8260-2b45-4598-bfbf-15a8677ca80b", "comment": "Malware payload (Dridex)", "value": "ea7f918aa8aaf32a6e68e8c0f8874966", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616135592, "uuid": "f430d94c-eb70-486e-9629-134d57ed08c9", "comment": "Malware payload (Dridex)", "value": "bb8028be6212b137cf3d24e4a160232afadf2c7e4e30a6f2cfa0683d4b145440", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616135592, "uuid": "e122fc51-2d35-4b00-afb0-e84ce29a283d", "comment": "Malware payload (Dridex)", "value": "7c6915abed9360c12ce0780329c86f1610924c02", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616135592, "uuid": "8eb22623-ca09-4ae9-8f71-a2c88d18a325", "comment": "Malware payload (Dridex)", "value": "fc3b7641d7bf3f6150bd2f28a4228758b46c8a01d46e32c79e5a1e80643858395ba0a5099d4719a32cf90aae638074cf", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616135592, "uuid": "82b66a16-7302-4463-b763-6fe401ef3752", "value": "9124CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616135592, "uuid": "114e012d-d7f1-4003-8749-eae1bae57c32", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616135592, "uuid": "8909632c-c608-4be7-aedc-36f3121cc833", "value": "3072:D9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:D9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616135592, "uuid": "4ae21f7a-100d-4182-bde8-41fd265e62a5", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616135592, "uuid": "20f77a37-fc0b-4e0d-a2eb-5ded48d7c891", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616135592, "uuid": "9e6c4a73-9d1f-44f3-af94-d89b144dd0d1", "value": "bb8028be6212b137cf3d24e4a160232afadf2c7e4e30a6f2cfa0683d4b145440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc56728-884a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616113905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616113905, "uuid": "7658c431-546b-45ff-bc05-898db23bebe7", "comment": "Malware payload (Dridex)", "value": "02e879d334804add682705a25e36928d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616113905, "uuid": "8bce6030-8563-4146-aef6-ab3fe3022840", "comment": "Malware payload (Dridex)", "value": "bbf12879cf70bbb599b7c47c19bf2a9d88a0e66b3005d716f0d485b06b26e535", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616113905, "uuid": "62d3331e-8ec5-4a47-9e53-9ec1950c4110", "comment": "Malware payload (Dridex)", "value": "78f1fe425d1eada81bc8c0646e98c154839f24eb", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616113905, "uuid": "a1e6b6e5-60c5-4455-bc0f-005094d98ca6", "comment": "Malware payload (Dridex)", "value": "76f552f50821db425f7b4bec4508355b0abf4f8ec82926719cf95b80a0dc2634cd318fea61d724d3965bf64522471316", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616113905, "uuid": "8f3d84c1-f59f-481f-9f83-6878105b9f45", "value": "B524CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616113905, "uuid": "ea07f231-f60c-400f-8204-81950b6aae1d", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616113905, "uuid": "06f7e83e-fecf-4709-ac88-6e5d5ba73d92", "value": "3072:Y9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:Y9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616113905, "uuid": "d717e6ed-ac41-497e-8aa2-afc1c843bc0d", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616113905, "uuid": "8ad0f776-e211-4483-b958-147df0c96681", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616113905, "uuid": "f7ab9532-3327-41e4-a599-c58af1502b8d", "value": "bbf12879cf70bbb599b7c47c19bf2a9d88a0e66b3005d716f0d485b06b26e535", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46320f3e-885b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616121116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616121116, "uuid": "c7c4c936-40e6-439c-816b-bfc6a9bcfc53", "comment": "Malware payload (Dridex)", "value": "f68f54dbb9fb2b19290de7dd0fa66e45", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616121116, "uuid": "212ddc9f-ea74-494e-9c42-fd4298a5eddd", "comment": "Malware payload (Dridex)", "value": "bd3d47a4b7dccc961a8a5717bbeaeeccd1e840b34282c473902c82ea455a5d0f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616121116, "uuid": "0f81c95f-b0ce-44d1-9062-9fa62e97ac97", "comment": "Malware payload (Dridex)", "value": "64c8fea375f41449bc435923bd9bef7bd7dc10a3", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616121116, "uuid": "5e887d61-94b1-4222-9a73-182c1dfff053", "comment": "Malware payload (Dridex)", "value": "daa37ebe470cf901d5d5840adefd67a3f76242a7d1ce06ff0f5288af00da67c22f05b257fe3cfe89320b3f8fa1e950ea", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616121116, "uuid": "8180bd9c-aac0-41fa-ad67-9f4fb0a176f4", "value": "E824CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616121116, "uuid": "170a2df9-38ef-423c-bcb6-a6d571186878", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616121116, "uuid": "0466b830-33cb-4e71-a7a4-583480f67e5f", "value": "3072:C9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:C9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616121116, "uuid": "fd0419af-fa6f-46df-b98f-9d0219dc6994", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616121116, "uuid": "0f24b625-46ab-4bb7-8593-5f65bb241489", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616121116, "uuid": "f3e5a7f5-2c42-4d78-94ec-0c8f98cf799a", "value": "bd3d47a4b7dccc961a8a5717bbeaeeccd1e840b34282c473902c82ea455a5d0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa9004e-8886-11eb-abe1-42010a9c0039", "comment": "Malware payload (Sality)", "timestamp": 1616139761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139761, "uuid": "ddce3150-2733-4454-9c8c-3949adc5b936", "comment": "Malware payload (Sality)", "value": "c0a877734159fca9da4c7045bd674d01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139761, "uuid": "ef9a701e-4b3c-40e1-a927-3728977f6a67", "comment": "Malware payload (Sality)", "value": "bdb1b6c2151038f1023b551d26ef4eab2d5321066d3352d5357b8bee301b67b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139761, "uuid": "39d09d57-9bea-4aee-99e2-bc56e09381c2", "comment": "Malware payload (Sality)", "value": "2bbb7dea143f99e7e2e4fb8882ec0c290e592249", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139761, "uuid": "72927da7-34c8-4dd0-80ec-799fd96724e2", "comment": "Malware payload (Sality)", "value": "41007c224aec63e393d9f63209d193923766f9d5daeb8a75cbaddad4aef1997fc0875bd8b3dac7e7bca5dbc717e87984", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139761, "uuid": "321d4c84-054b-4ee5-a110-b67a856d4bec", "value": "333633F5A9D0877FF7B4623AC075B9328F161B17108E1E1CE27D692F558B0ABE708462", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139761, "uuid": "7fc96194-cc98-4f63-9996-497780ae97e9", "value": "bf33765b3ad3b105c0b29bcf6093d0c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139761, "uuid": "6ab282c9-9f7d-44f7-abff-f6b2bfdf3f7e", "value": "98304:Xa7k1snEi5p/FPjYuhLTTGgWR8D6yV9xKsTqvGljc7q0YsILgbcyTk/L2fSMaVPV:K7k1cL5p/FkQTTGFm1V9xKqp0ALSk/qe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616139761, "uuid": "7a468cce-af02-4ca0-b0cb-6458001570d7", "value": 5190689, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616139761, "uuid": "f16be103-66a3-4f4e-9940-338041ea0a14", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139761, "uuid": "ea2b8351-2778-45b7-bbd2-1f1a537b5d97", "value": "c0a877734159fca9da4c7045bd674d01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d32da6-88a3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616152115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616152115, "uuid": "124da26e-3341-4ae2-a6aa-a90a5a9e7353", "comment": "Malware payload", "value": "0d7a178a0c0a7d2f2cc63e16dad95b45", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Raindrop", "colour": "#53C12C", "exportable": true, "hide_tag": false }, { "name": "UNC2452", "colour": "#DECDD7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616152115, "uuid": "3f0fe3ce-576f-4953-a4dc-0d267aaf59df", "comment": "Malware payload", "value": "be9dbbec6937dfe0a652c0603d4972ba354e83c06b8397d6555fd1847da36725", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Raindrop", "colour": "#53C12C", "exportable": true, "hide_tag": false }, { "name": "UNC2452", "colour": "#DECDD7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616152115, "uuid": "665ddb25-d5ed-4c31-bc64-0164a3b614eb", "comment": "Malware payload", "value": "df98c2dc09cd881c440171abbfc016bbd2924dbf", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Raindrop", "colour": "#53C12C", "exportable": true, "hide_tag": false }, { "name": "UNC2452", "colour": "#DECDD7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616152115, "uuid": "f10151a3-a71b-4304-b0dc-eec9308c701f", "comment": "Malware payload", "value": "3c0f21a96460243c4270b9c86ad74821d4dc24b974ed96ab3d3674dbf564ca939115e23149f24eb465818347b0043da1", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Raindrop", "colour": "#53C12C", "exportable": true, "hide_tag": false }, { "name": "UNC2452", "colour": "#DECDD7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616152115, "uuid": "4d13c8dc-3063-4adc-ba9a-75f5888d1549", "value": "B874BF59FBA44CF8D0769078C4B3461AE2767C550B619E5F2768026A3F33FD1883EBA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616152115, "uuid": "3e1133e1-43fc-4f5c-b970-4dff5daf635c", "value": "049ffe83fd7b228659c01ae8f2f8e154", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616152115, "uuid": "6b81ec89-e105-4a2e-a918-266682a0baa9", "value": "6144:hLE/TyirUcFowwhMFLedBltBVQa/MlXHW5jgtoDSz7h+ls:KTywUC3whMFoBlvf/MN22t29s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616152115, "uuid": "aabc22de-ea70-41b5-82e9-8664b31f1a94", "value": 347136, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616152115, "uuid": "234c9a70-82b2-4a14-a47b-0583aa64093b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616152115, "uuid": "348a80f3-adef-4eaf-948f-4438638953e3", "value": "be9dbbec6937dfe0a652c0603d4972ba354e83c06b8397d6555fd1847da36725.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed00642-88d1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1616171919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616171919, "uuid": "e58a735c-5552-4571-b3ac-f8ef3d44db3b", "comment": "Malware payload (Mirai)", "value": "728d657112096c64b0ed92db2e2946c6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616171919, "uuid": "da0b4d89-4b0f-485c-a3c0-4557284c51c4", "comment": "Malware payload (Mirai)", "value": "c0571eee3ef8830218dd7bbfd7b915cf5516ba91691e1019b2699191ab3a332c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616171919, "uuid": "5f8714f6-a0ef-4226-b0a3-69021652fed6", "comment": "Malware payload (Mirai)", "value": "adccb109cca6810d914e6251d2614ce1cef644ea", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616171919, "uuid": "19f1a9e7-2226-4862-90d8-e91681c8fe24", "comment": "Malware payload (Mirai)", "value": "11675d3e19cf432188a0bc2daa05a39fa2ad783b8c05c627dd3dc00bcfad79af128936256d7f1e2b30f9daf56b1a0c86", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616171919, "uuid": "c641885c-de54-4822-b1d0-7858343abc95", "value": "3664F1CAEA01AD7AF9CA47B9696B0B0973F1CBD8D3C3B140E224C6543DBD2459B645C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616171919, "uuid": "0ce3dee6-d0e9-4272-ab6a-55348138ba19", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6co3qwPa5POdOQ33Q:7O/QJHZweEL/NOjCHm7FZZncoqfPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616171919, "uuid": "9806b047-889f-4c95-a450-47be87ef8ae3", "value": 307960, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616171919, "uuid": "7eee96b2-6ef1-4dfc-b6dd-3f7933ddf80b", "value": "application/x-executable", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616171919, "uuid": "effdf73f-057f-4798-83c2-fe94f5d41080", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2b5fa1-88f0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616185207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616185207, "uuid": "e527d0ab-9e10-4a98-9d76-df9c61a9820d", "comment": "Malware payload (Dridex)", "value": "8cd6a226d2aad9d65282fa7f9aa5fd87", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616185207, "uuid": "0eab122c-6584-4164-a39a-8910f12c480a", "comment": "Malware payload (Dridex)", "value": "c19acbf0ae4e7c9c80f82135ab9316508d7d0d7c8be7705f07117cb5d8db0bb3", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616185207, "uuid": "3c5e5c30-6f20-4e78-accf-a34f69b0a724", "comment": "Malware payload (Dridex)", "value": "73f4746319d765bc1a3c7fa83a2888da1c11c7c5", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616185207, "uuid": "b92402b8-1047-4389-ba30-0601c5b9ce62", "comment": "Malware payload (Dridex)", "value": "8a3b65ccd2c7517b9aacca6bb160df8fb69ed88f6dfac008585a0e79b3516e653cc24611452557a8a23cee57565d5df3", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616185207, "uuid": "326839e5-3494-4a5b-af53-583af79f486f", "value": "B014AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616185207, "uuid": "c49fe535-678c-4aca-894a-c3e23365c47d", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616185207, "uuid": "9ca75db4-00ec-4c82-8b4a-1a5eaab34ee6", "value": "3072:f1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:9i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616185207, "uuid": "2fad51f9-ece1-48ac-9506-739e1e6fb5bd", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616185207, "uuid": "1c27e7b0-165c-4281-a70e-cb1f1ce61e5a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616185207, "uuid": "2ac53042-1550-409b-ab62-2a820c24c159", "value": "c19acbf0ae4e7c9c80f82135ab9316508d7d0d7c8be7705f07117cb5d8db0bb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0069dcf4-88a7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616153641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616153641, "uuid": "9d43d582-06d8-4b4a-a5e2-120f3b9c74bd", "comment": "Malware payload", "value": "b63932cde2143b739551fa5501394146", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616153641, "uuid": "4b76502e-824f-4cb4-ac3a-34f85920a835", "comment": "Malware payload", "value": "c592d92f14fd97f4f4b29a3c71ec2a119d4cf5df4750f76fc455e1f82bc8b798", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616153641, "uuid": "521c0ec4-72f9-472e-ab13-477ef6219c75", "comment": "Malware payload", "value": "3d64abbc533021eb46a860d13f8465d2e448fcd3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616153641, "uuid": "517e86bf-b6ce-4707-8214-e9a6591380f3", "comment": "Malware payload", "value": "d6acc085b2a8a0b41bcc5a416e672a74730dad481c9b0d9725a5a4de61b3bd85209e370c92c009845b6b74cada086b27", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616153641, "uuid": "bc8ab822-9ecc-438b-81d5-9b91167727a5", "value": "ACA5221075A18471E2B616354CF49FB51ABABC264F305AEFA3C05F3D8E346D3A530B6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616153641, "uuid": "88848b9e-765f-4d68-80c4-d536e9a6c3dd", "value": "212ad670c01686a5b7fce94f52bc41d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616153641, "uuid": "c0447a34-2acd-42ad-a4ee-c9cc3512d9eb", "value": "49152:noT1j3FsVjlgHnPcN/45z7p9PgYGG8BQBCqnNKxTmORI/CaX+ijHFPPP:noT1bpcO5F8eC+NkBRGXLjH9PP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616153641, "uuid": "2b7beaed-5399-47d7-b771-14b6b4ccff1e", "value": 2071040, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616153641, "uuid": "5aff526a-8c78-4751-8cd2-af9cf935cac0", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616153641, "uuid": "6ba7c1e7-8c3e-427a-a962-065b874c7b5e", "value": "api.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40120b8d-8888-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616140433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140433, "uuid": "db29a7a1-ccb8-4c8b-8d4b-37f9fb152080", "comment": "Malware payload (AgentTesla)", "value": "056cd35fee879720ccf578002b4fcbe8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140433, "uuid": "3c30818f-73d4-4831-8236-9f159655e799", "comment": "Malware payload (AgentTesla)", "value": "c5d51b412716cb23b237dfb43f0cbd62191f357ccea814f37394e7d019221fb4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140433, "uuid": "05417837-a126-4460-b88f-0a012026f3d5", "comment": "Malware payload (AgentTesla)", "value": "17bfe4ca0915d64dcc4704583db426c00b58516b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140433, "uuid": "6ffec19a-fa8f-471f-90eb-a7500d9478f2", "comment": "Malware payload (AgentTesla)", "value": "789e22b49378888c0bd88392185baddc1061de62635ec8a911dc522575a6467c99f84b07384f88acd5b3859893b624e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140433, "uuid": "afd2a8cd-930d-46b2-9146-42f2e81776a1", "value": "FC057D1262D06F49F27E5B7990A8551153F1F81AE336FAFC7DA180CE55A2E80C7B07B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140433, "uuid": "06f165f5-db4e-4a2b-8fee-96e99126e9be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140433, "uuid": "d61b2157-94dc-4b56-abdc-5fc773d1d2f0", "value": "24576:ZbyRefvEC3tcBvV5+TosvWXGVw9ksJ/IrRUJX2WiY1:ZbyRefvV3CBvV5+TPWX1ksJAr2JXVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616140433, "uuid": "c4d386e2-84c0-4a81-80e7-a529a2889b1a", "value": 855040, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616140433, "uuid": "61556e3d-a736-4f1d-a84c-7f4dab275898", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140433, "uuid": "7e4545f0-1e3c-42a1-8bc5-8f16308bc6a7", "value": "056cd35fee879720ccf578002b4fcbe8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c01a8a-88b4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1616159307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159307, "uuid": "b6b70bac-1290-4c83-96e7-8a81e871bc91", "comment": "Malware payload (Quakbot)", "value": "2c04b9fff8f4a840cd66885e83d222ab", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159307, "uuid": "a6fb1fdc-d701-4901-9c6a-dc6980171dec", "comment": "Malware payload (Quakbot)", "value": "c67d823c6a85a46370c33b67f416bff65b3d986039bc2dd5ab4f09d53fd0fd3a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159307, "uuid": "92e6ea27-2d09-4fa1-9a9a-49ce08ea59da", "comment": "Malware payload (Quakbot)", "value": "74448bab79d1ef70f1c6b7ab830178ed97f50b66", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159307, "uuid": "2aaea139-3a43-44c5-ad69-6fe8e3e1aa62", "comment": "Malware payload (Quakbot)", "value": "d8e1c789df7ad1bd120d6d1b2df34da51ce6f611033c3edb3b76dde71a2bf96f92e218d4cd1337128fe8e9da0aab2542", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159307, "uuid": "0f2c8e44-bc54-4db9-a8e1-42b307821a9d", "value": "1A04F01BCD0A4E67C40DC77CBE470CBC6B0C62ACAA847BDD24B15DD57B882265DAB05E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159307, "uuid": "c8f9075c-3d3c-45b8-ac52-28736ff070db", "value": "3072:U1DXFYiB3kNT+2Jozo1UW8gOvlAsku0Gy3ZsY0OPlaK/LBXt:iXFYiB3kNBozoR8gOvljFy3ZIOX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616159307, "uuid": "9e515dc5-0eb1-4f7e-805e-15aed19bf0a3", "value": 189684, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616159307, "uuid": "c65f3e73-c5e2-49b8-9c93-d14e503083ab", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159307, "uuid": "2bfb1247-c78b-4719-9a4a-22ae2a88e154", "value": "895814954_03192021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f99b509-88c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616165316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616165316, "uuid": "37b3ff53-ee72-4fbb-a897-9540b2897f99", "comment": "Malware payload (AgentTesla)", "value": "dd1b9ba1c64963be36415a0609f9b070", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616165316, "uuid": "1ee1306e-c8dd-4c6b-99f2-6ca0841bf0f3", "comment": "Malware payload (AgentTesla)", "value": "c6c27f1820ccf1b18668f1a3d3587394a744003ccd6d1780fd92099ad97f7f66", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616165316, "uuid": "296735d4-4223-4db4-8b08-03605ba49419", "comment": "Malware payload (AgentTesla)", "value": "6a61fa72c3d57f7f06f0628784ee3310bf3116ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616165316, "uuid": "245a3119-4f74-4657-b94f-c3a1433fefa0", "comment": "Malware payload (AgentTesla)", "value": "d063c07ebe496ba886b7c5c3f15a9f7143ff945e5a44f94735a3ec70ff00131e13ce6c1a3c2e9921c2d37625e7318a89", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616165316, "uuid": "50fab10b-15cf-466f-b9bd-831ce5a0d413", "value": "B115018032619E8EC51F6F3648532C2CAF70A636D71BE3436D8711EC598EBC64B9539B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616165316, "uuid": "3b00d53d-37af-4a7e-8833-8ab0b4185918", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616165316, "uuid": "878e6d1c-9445-4350-8e5c-964d8bbbaecd", "value": "24576:cvxekd9JvWMdIT0WLasaPbeZy2Ck3adALFtCaYI4y:+nbJvkoeasaPyZy2CkyARtLYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616165316, "uuid": "7853bae1-1c65-4116-a076-a7798bcd5d82", "value": 876544, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616165316, "uuid": "1aadbedc-b12f-41ad-bed6-80e943debccd", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616165316, "uuid": "3edc8f9c-d55f-497d-ad15-1248ecbf4c86", "value": "Order Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511ebb21-88c0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616164514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616164514, "uuid": "119740b7-164f-4aad-aff8-87495ae21b4f", "comment": "Malware payload (Dridex)", "value": "0dfd59107c86f771c9ff5fd507a247f8", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616164514, "uuid": "e4fbd366-5808-417e-be97-ee85a4bd6a83", "comment": "Malware payload (Dridex)", "value": "c7db4de863003817c9b386aced5f58e0a28e645d954f6648cdaa5d44a6ccb169", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616164514, "uuid": "5ce233b6-6ae8-4785-a471-faef57be509c", "comment": "Malware payload (Dridex)", "value": "94e6143501b2247e687954a783216e422244c919", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616164514, "uuid": "06a7adb7-a0c2-4998-a9fa-1f59826409f3", "comment": "Malware payload (Dridex)", "value": "f37e209dda440cf3243f1301a6783e2cdac83751515da17096f1c0a19f1defd2cd3c21dbe3aea2fe763335718b357ac1", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616164514, "uuid": "216f2b63-a15d-4a9e-bccc-62c2cb003b69", "value": "5E24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616164514, "uuid": "32256806-0ad9-4318-a6bf-edde118b2360", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616164514, "uuid": "5a27d119-0b90-4483-91f7-4e192c1486bb", "value": "3072:h9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:h9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616164514, "uuid": "7ebe348d-ddd2-49d7-9788-d4900573276d", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616164514, "uuid": "7ad23c76-a83d-436d-96ef-5c2eb51cc0e0", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616164514, "uuid": "f18b8e03-29a8-4801-a17a-a8a8af09412b", "value": "c7db4de863003817c9b386aced5f58e0a28e645d954f6648cdaa5d44a6ccb169", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "678f5547-88e6-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616180872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616180872, "uuid": "b9a0e63b-df60-45c7-9c2b-411c0539aa25", "comment": "Malware payload (AgentTesla)", "value": "4d34ecf44f5a0209b427887fedb6ede9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616180872, "uuid": "9d7d52e6-50b2-4207-b129-7698e2805c60", "comment": "Malware payload (AgentTesla)", "value": "c91d6251e457c424a6d50ccae6231dc0a0a78ee758f0f0f6d12580dac04ee2b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616180872, "uuid": "44394526-a576-4b2e-9d55-7c331a570b83", "comment": "Malware payload (AgentTesla)", "value": "6341d6fc5f45d64f32c8802f9de99b0b3f697ac4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616180872, "uuid": "ebf7ac11-bc8d-41d6-a26d-5073750ff485", "comment": "Malware payload (AgentTesla)", "value": "9981cbcdefcbbb611f74919f059c7b550715a2db2b1e69df93d04b779455e7fb1abf64a8d0e05b90b81214acf9fc7723", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616180872, "uuid": "e34bb7bb-b302-49b3-9062-b8c49867cbb1", "value": "2725CE1193E0AF48E1BE13B508B985161BF7B59A83A2E77D985400CE0E73A46C77B737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616180872, "uuid": "e73939df-a5db-44dc-ab06-f8fbb06c340e", "value": "12288:6GalExVjpAXi8g2O3YreMNLnpxhgQ8/ehTgXDRSpBIGKX8u5wPEXRAXzxEgx5Eoo:ElYf92kMFThgQVUzKGnhRYzxEgx5kR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616180872, "uuid": "faf4973d-418e-42d6-accf-b95ad5ec18f5", "value": 972800, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616180872, "uuid": "a3085b06-c654-4e83-9792-db0cd6afb92b", "value": "application/x-tar", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616180872, "uuid": "efb6316d-b924-46e1-ab06-5fed89b3c17a", "value": "inquiry.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd217867-8855-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616118792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616118792, "uuid": "d3267a72-249c-4fc8-821e-0baa31de1784", "comment": "Malware payload (Dridex)", "value": "464290e5f2cfc0bcaced899834db1321", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616118792, "uuid": "51c18d73-3b30-4711-acd6-fa62486f1061", "comment": "Malware payload (Dridex)", "value": "c9cfdc6f021fcdd7987e44510b054e58dd8ec79407c3162f285f97bc4ae408c4", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616118792, "uuid": "50bebc42-44b2-401b-b7ec-78615ff02304", "comment": "Malware payload (Dridex)", "value": "7e16cf281c80d5533c61eb593cfcea200069b3a3", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616118792, "uuid": "2ac2e5ab-ba58-4f35-9632-d3d89825bfbe", "comment": "Malware payload (Dridex)", "value": "d4d0aae9e497ce3e99398276af5e48071e8c1be5988c9b4e61749c05dc63934725b31825af966806ecc506af9833d364", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616118792, "uuid": "df60f8f5-2f4c-43a4-ae85-a4a91b2ec2f4", "value": "A114AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616118792, "uuid": "e8e67f0c-4109-4e30-adc9-1f81ee245a90", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616118792, "uuid": "273ab9c4-e4e0-4a9d-99b3-2e6e09fbaf86", "value": "3072:81i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:4i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616118792, "uuid": "d0eb9b5f-53e3-42d5-9609-c8eeb51a0eb7", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616118792, "uuid": "0b9d6335-8dc4-4455-8afb-1d2a3d1d25b7", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616118792, "uuid": "30f1268a-e005-40b4-ac1d-8229a13aeb0d", "value": "c9cfdc6f021fcdd7987e44510b054e58dd8ec79407c3162f285f97bc4ae408c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad93785-8880-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616137150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137150, "uuid": "8c129b87-eb06-4462-8db4-a0a8b7b4a6e6", "comment": "Malware payload", "value": "75a1352875794833d258a99d0596f9bc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137150, "uuid": "159ca81c-95c1-489e-93f3-a6b6b709d8ef", "comment": "Malware payload", "value": "cae26475b78d9e5e8f2299360f829867f587cd68c9ad6e988b20017c4ccc6f30", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137150, "uuid": "4fef7d63-0623-450c-85b0-f6e21f61bf96", "comment": "Malware payload", "value": "ca74f1216c45d93f014f599919344658064543b9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137150, "uuid": "ce32e2c0-b307-42c0-9749-2795f07be5b1", "comment": "Malware payload", "value": "f98a02d2393bc1601f46b272380f3edb88ce650753ca34fb74000fd9d483305552ee8ff94e4a730eb1b14652addddacf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137150, "uuid": "73928ec5-62cb-4e12-a84f-cd654051ee72", "value": "7FD312D56F418D3CC0FFFAB0541EC026DEC69C8BACA827AA6E54979E21E5715037728C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137150, "uuid": "ac87fbc7-6131-45ba-a61e-11c84f73dd26", "value": "3072:jKX4GpNXrq6uObF6VBWOckkvkwj0fpbtv13HGZw31:jOxLX2ey/c1k9btv1Xrl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616137150, "uuid": "d6dac38d-1e29-4afb-b157-83d17623421a", "value": 132245, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616137150, "uuid": "77f11a2b-6a98-43d4-abbd-412f8d54ffbd", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137150, "uuid": "9b1a22fa-cb23-4989-9113-b0536cad4581", "value": "IMG_150-76-13.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26feb03c-890c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616197085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616197085, "uuid": "ab943693-2119-4044-9909-4c9f3ac32b9f", "comment": "Malware payload", "value": "f037f66caa51fa7bd9c7d519a9e502c0", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616197085, "uuid": "693cb463-aacc-4540-bdac-50426a1aa943", "comment": "Malware payload", "value": "cb7eac1cc0c76a962c1088b024e00c6ba6398dfdbac3d82c36947aea64d3288e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616197085, "uuid": "e26ead06-6715-4eea-ae58-c7a6916e74e9", "comment": "Malware payload", "value": "84ba8f86e8cc8ed2c384afcd4637f5e2845883ba", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616197085, "uuid": "745fece5-adab-4757-89f8-f5e0fd6e4da7", "comment": "Malware payload", "value": "7370050b2a22088fa44d460cab1bfc22eebc8cbfae1b577103a084ee251e43ea9d2647510226bb3631f129692ce818c8", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616197085, "uuid": "d0c93090-92ff-4b7e-9474-7c10d89dcf95", "value": "0924CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616197085, "uuid": "c2cb7fda-d9fa-42da-87fc-bedcfa68a691", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616197085, "uuid": "124e6515-1859-453e-9174-4b9786a84029", "value": "3072:W9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:W9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616197085, "uuid": "176996f9-8f9d-4b27-898e-a77ee94f2e0f", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616197085, "uuid": "ca32623c-5025-442d-bfbb-04303d788da7", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616197085, "uuid": "8b4c50eb-36e2-41f9-a68b-8c39c0bb4cc5", "value": "cb7eac1cc0c76a962c1088b024e00c6ba6398dfdbac3d82c36947aea64d3288e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a75065a2-890a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616196441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616196441, "uuid": "d80a877f-e43f-44a6-9dd9-dd984d75336b", "comment": "Malware payload", "value": "9113abbd6912525e2d8b54e06c7a9096", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616196441, "uuid": "101e3a46-7b94-4516-b226-5c4a6919f905", "comment": "Malware payload", "value": "cd9fcd620b5b2f756a37b08bcc4f21bec56cba734a7fbf26c75a9207cc0c209e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616196441, "uuid": "a9f33988-f6c2-4d39-ab91-308caefa286e", "comment": "Malware payload", "value": "8bb38444ca779d84ee70864f8863a01ff5ca078b", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616196441, "uuid": "7a6061b2-5549-4724-8167-3a4eb2de416d", "comment": "Malware payload", "value": "107dfbf9194050b80b4d39e1d43fe08bb12eaa47792ec8593a8b049a5ba5d305ff8c146eddc610ccc6a7b8eb3ebbe5fb", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616196441, "uuid": "978f8c9c-a6d5-4c60-baab-a218e61f5543", "value": "EB14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616196441, "uuid": "3b868e62-c17b-4632-98ef-bf343b9dc6a0", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616196441, "uuid": "cdbd24e6-1c06-433f-820d-f2ee28c0ee2f", "value": "3072:d1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:vi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616196441, "uuid": "8e2700e5-b0f6-4679-88df-8443f3bd182b", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616196441, "uuid": "0a21def7-c18d-4666-874f-b4928ed9e9cf", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616196441, "uuid": "fdeb4aed-3f2d-4fda-8eab-001b18bec4e6", "value": "cd9fcd620b5b2f756a37b08bcc4f21bec56cba734a7fbf26c75a9207cc0c209e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ece431e-8889-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1616140914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140914, "uuid": "927097c2-7244-466c-954d-811ee3ab6168", "comment": "Malware payload (NanoCore)", "value": "17a4a90705469d09434937d4eaaf59b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140914, "uuid": "369692ae-547a-4882-8b68-baba8c44068a", "comment": "Malware payload (NanoCore)", "value": "ce2ecce31582c696e16f19c66cba6276fe2a47287df652ab395620e20aecc21c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140914, "uuid": "321977fe-51e2-48f2-9f5c-2a7830f388d8", "comment": "Malware payload (NanoCore)", "value": "214f0e515cb447b6263a7be9d0ab7c0763e2397f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140914, "uuid": "675f6719-8360-4b8a-b022-431ac6082c33", "comment": "Malware payload (NanoCore)", "value": "96d34b8528089a0ebec6b94724867cd41cc765d39e1238dcf4c0b85af333b995c254026880b116ce9b689aaf20a8736b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140914, "uuid": "80ce1349-5ef9-472e-ae22-aedbbe24f15d", "value": "C5259EA613176627E1663AB41040F3B537B0DEF1A03ABAB59ED43CA3B4853C0697BC75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140914, "uuid": "7d2a00cf-951c-433e-84d9-f40eb1b767d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140914, "uuid": "5345b1ca-d9fa-47d0-ab46-276030f29891", "value": "12288:5fkR4ce4WiSwb96Ot43CvrFkffN1HoGpD5VDGpU9ULEFO7QMhR+sbjTV2bbDDof7:Bwpn6zHBXV6S9Uv7tR+mvVQnOFTY0JvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616140914, "uuid": "a008d1ba-e194-43cc-8293-d9da19a4508b", "value": 1010176, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616140914, "uuid": "9ee46a96-78d5-4d3c-8099-90aa9ef927d7", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140914, "uuid": "cb43f1c9-c401-4170-9271-c707a00330cc", "value": "17a4a90705469d09434937d4eaaf59b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b0963a-885e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616122437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616122437, "uuid": "cee3b58f-7ff5-4220-ba22-732d1b48b7bd", "comment": "Malware payload (Dridex)", "value": "d42155bf0cc8b367d6e6058654d42ee2", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616122437, "uuid": "a0abd635-0439-4840-943f-83ea3adf146a", "comment": "Malware payload (Dridex)", "value": "cfa5917a0fae3bc828bbe0ba8fa81059d697319dda8968b689c96453f1342fa1", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616122437, "uuid": "4373d4bf-a364-484f-b8e3-42a99575ccc0", "comment": "Malware payload (Dridex)", "value": "ef9b16397376ec7821404f9e86382a4003032c7b", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616122437, "uuid": "ac24f927-3c06-46ae-a7c0-9462b7c560fc", "comment": "Malware payload (Dridex)", "value": "124bb2c68171d75a80757d4e4b2e47d0aa54b80e13a66ee7441296ed53a76b0af9f24462b37d8a9b4e50c3e254b7d76f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616122437, "uuid": "1518d3ba-996e-4e09-b249-33607cf0be38", "value": "1014AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A6FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616122437, "uuid": "a60cc449-ef26-4f05-9017-63c62da6e79a", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616122437, "uuid": "11fa3c1b-5bfa-4d41-af99-3b4768e4b89f", "value": "3072:N1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:fi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616122437, "uuid": "963efaea-4a1e-4a22-b95b-abb4d3bbfa98", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616122437, "uuid": "f2579e2d-f5cf-4b19-85e0-4fecc56da16a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616122437, "uuid": "371ab7b3-0c76-44d9-a509-d5a7e01513ae", "value": "cfa5917a0fae3bc828bbe0ba8fa81059d697319dda8968b689c96453f1342fa1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79582edd-88d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (LimeRAT)", "timestamp": 1616175319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175319, "uuid": "9e656d63-5842-4aad-91ae-b4f7cda54b49", "comment": "Malware payload (LimeRAT)", "value": "806ba19af21c27492a4e92e38d64c634", "object_relation": "md5", "Tag": [ { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175319, "uuid": "7aaf70cb-3e66-4523-8b25-0447d62927d4", "comment": "Malware payload (LimeRAT)", "value": "d0af68df07b9f56b092301f3a4cc7d3465ec03bd79943a2cc07e72eefe1c8d21", "object_relation": "sha256", "Tag": [ { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175319, "uuid": "79c02d38-bd0c-454a-ad2e-b069d708c8a4", "comment": "Malware payload (LimeRAT)", "value": "b162b6e426d0342b8aa61e68b2021c22aa7f1975", "object_relation": "sha1", "Tag": [ { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616175319, "uuid": "eff1d165-d5da-44c2-a920-240854e3f4b0", "comment": "Malware payload (LimeRAT)", "value": "a951c8fb62c446fcbe45e44572c4b8e29615ea62bb7f57ae40f897686ce1e4a5b69f74bf9291ba4581f366c3cd1fd2db", "object_relation": "sha3-384", "Tag": [ { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616175319, "uuid": "15e40cf4-cb5d-4124-823f-e9e7b3de7e4b", "value": "24E4DFDCD96A1223C4A927BE50E73AD0CB6616291C51FFFA58CE70920663670D6037FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616175319, "uuid": "f7554664-7768-41b9-ad8f-79ca0210e441", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616175319, "uuid": "4da0e515-83cf-4ab5-864b-ddd5b8b761f9", "value": "12288:lGI4Rqeue+FxWK3GQmXIH1W0LFsbV8Ffvx7O47OBT1qwAT9aTo:lGIkue+FxWK3GAH1LpFfNOi8TzAT9aU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616175319, "uuid": "962dbe4b-ce7a-4fed-9068-a1c6a8adaec2", "value": 667648, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616175319, "uuid": "aaf40481-3e6d-44b7-b383-1ddb86104069", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616175319, "uuid": "cd12b5b9-4a62-4fe8-9390-ac8ebdf27273", "value": "SecuriteInfo.com.Trojan.DownLoader37.60197.25575.61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c973a0-88fb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616190003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616190003, "uuid": "a1bacfba-b734-437d-b7d2-ed1934204e21", "comment": "Malware payload", "value": "4fa86cc1230bea5c7cb2e2dddd4f806f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616190003, "uuid": "c2241388-04a5-44d5-a393-506c046e1c70", "comment": "Malware payload", "value": "d3ace6a0430dae3400a8b4c8274a370cf68d83baba0507b541a2488b7a7c39de", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616190003, "uuid": "464957e6-864d-4dbd-9866-cffa71ef6b3e", "comment": "Malware payload", "value": "5db28b8222e0d8ccaad94b30ce4febab9236e380", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616190003, "uuid": "4aa3348d-6c8f-4874-add1-6a28b111097c", "comment": "Malware payload", "value": "f053c5a8f8b64ad4735fbc2b91c5e97db2d01b4cb916646792edf73ca1b3d4505a49e0b8b9b34acce82964b0296bda1f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616190003, "uuid": "3add0620-e342-4b2d-b022-00c71949d904", "value": "E272C05AADE39F5AD42A56B8074A8E1478FF8774FE1D19668C623688037E40D646C388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616190003, "uuid": "874dcf91-544f-4f07-b522-e051b358985a", "value": "384:0Fin4W7Cg+A7DfnflQuAcBsA1jaxZ0hh9EkrSeeaHqp2U:win4W+m7jnflBAu/1ja/0tEkVeTp2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616190003, "uuid": "43613c66-91d6-4bc0-82cb-48f793ee26f0", "value": 17280, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616190003, "uuid": "fc38bb22-e6cf-4646-8abd-e22f479392a9", "value": "application/x-executable", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616190003, "uuid": "c561b2ab-69d6-441e-b290-53de87815a55", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.FVC.20460.11408", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede5bd90-8877-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616133423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616133423, "uuid": "1050eb44-2767-4de4-a274-45584de28b79", "comment": "Malware payload (Dridex)", "value": "8780e75c64c406d7b9a8ff5319f4247c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616133423, "uuid": "d37165cc-5d88-4856-b5d3-cfb86c2adc17", "comment": "Malware payload (Dridex)", "value": "d7673a43ed08ba7c3dafe8e8a54c3f17480c4b19bea8d5973110f2a87233a8c6", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616133423, "uuid": "08d23731-e3c2-487a-943e-154447d62886", "comment": "Malware payload (Dridex)", "value": "7e0433aaeecc7c4e1653ce9b0b7f9cdc1e8959bf", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616133423, "uuid": "53988e50-3283-4a77-a4b3-907a38bc83b4", "comment": "Malware payload (Dridex)", "value": "bcc7a8282b80e2ae219eb592a814be2d8d3b465ecf9517572e3ee7bc220f187f599ef726df67d293ba882a2bd57beb54", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616133423, "uuid": "6ebe2fcd-c37f-43f7-83c3-9024870564f8", "value": "FF14AE9DD729E464FAF3D9F104359A1210BB6C49892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616133423, "uuid": "a54c85a6-e63b-43bd-ab06-a2e8dbb1be7c", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616133423, "uuid": "162406c1-c13e-4fbd-8963-e1ebf43b0e4e", "value": "3072:A1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:8i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616133423, "uuid": "4e108625-dddc-4d1b-9e09-813fb3452819", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616133423, "uuid": "1c72e601-e122-4f6e-b033-c4aeaf97cadc", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616133423, "uuid": "a6f0a116-fb4d-4efb-b7f3-66451b5a646a", "value": "d7673a43ed08ba7c3dafe8e8a54c3f17480c4b19bea8d5973110f2a87233a8c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e18dd45-8886-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1616139625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139625, "uuid": "05a5aac6-861d-40fe-b76c-757895228c4a", "comment": "Malware payload (RedLineStealer)", "value": "5990bc0ea66f7d93280aa056f70f8c69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139625, "uuid": "a464df44-6b97-4c6a-a258-7da2a798b7dc", "comment": "Malware payload (RedLineStealer)", "value": "dac87834202c054525c35d38d12c32dd18ac8b9b45b5d11f340fae8f6a287414", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139625, "uuid": "5bb2ca2b-9d83-4c5f-916b-c5c9da608edb", "comment": "Malware payload (RedLineStealer)", "value": "723bd1c2e99c9c4625d08971ea2fd7a3308cc5f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139625, "uuid": "9f7c7f95-fa5d-431a-8e91-22e3b623b00f", "comment": "Malware payload (RedLineStealer)", "value": "d7296b570c3ba7d15c1eeb5b4f71ca0a122421b687feeb8ed57a2184ac42dac98f90dfc37c33cc7e1328208fd8a4acf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139625, "uuid": "8d96e89c-49e5-4944-b86d-5ae75769d05d", "value": "62C20A307BE8863ADDEE4BB599F1864185F5B4596802FF1B4CC8114B2E63B918F123E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139625, "uuid": "b9c7f3ad-d391-4155-ba04-1aec0f17ecfb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139625, "uuid": "23a159fa-e653-419f-ac45-7477f18fe3ef", "value": "768:6nzdD6pcw1Q+/pCmMg+cXQfWxluRVTXFoffHr:6nzdD6A+/pCmMg+cXQfWx8LTX2r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616139625, "uuid": "e3dce958-28e3-4930-89ef-d8f1e70f36bc", "value": 27648, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616139625, "uuid": "0ff6627d-8e3d-431c-a95f-2ecc899d2880", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139625, "uuid": "21dc9695-ea67-4df4-8e09-5822d6fe5808", "value": "5990bc0ea66f7d93280aa056f70f8c69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2186b11-8866-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616126048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616126048, "uuid": "78524468-5fdb-4628-b8dd-c1a6a89ba201", "comment": "Malware payload (Dridex)", "value": "8c72c1eb4c52a8af3922ac6cebe2b0d8", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616126048, "uuid": "84abbb6c-c7ab-44c2-ad41-0e77e25be4df", "comment": "Malware payload (Dridex)", "value": "dad8dd42a6c62d46db433eaac963a00fe0e0a1e238db2b81f607df0a5bd8e769", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616126048, "uuid": "f7e56ac9-8764-4598-8018-b6e272db449f", "comment": "Malware payload (Dridex)", "value": "e9cfb0aa8ce734e7f5f09224d37837b6ef5a7914", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616126048, "uuid": "f87e03a3-4094-404f-b366-40b3f791f0cb", "comment": "Malware payload (Dridex)", "value": "a5df4db96dbb161b368f5c75eb9b626f3aff0be44ed0583e435c7f98dc22a7b9747f4c5058668b44d8961dd7e0795571", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616126048, "uuid": "479314a7-590c-46c8-982e-3908642406aa", "value": "6A14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616126048, "uuid": "51260d27-3027-4db4-893f-cf84080aafa8", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616126048, "uuid": "a542b59f-284a-44f8-aa38-f1941c6d414f", "value": "3072:d1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:vi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616126048, "uuid": "246b64fb-ba2e-4353-9445-0c876fc3c7bc", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616126048, "uuid": "151cd7a0-4065-44bc-8fac-463bd5562892", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616126048, "uuid": "bd7ae2fe-7174-4a02-aa54-4138109cc5f1", "value": "dad8dd42a6c62d46db433eaac963a00fe0e0a1e238db2b81f607df0a5bd8e769", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c465616-88d7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616174438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616174438, "uuid": "9ae97099-7ab6-4cdb-9f84-759e7c280848", "comment": "Malware payload", "value": "9dc209f66da77858e362e624d0be86b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616174438, "uuid": "3675e13c-db50-45fe-b0dc-50e883f0c80f", "comment": "Malware payload", "value": "db36fbc490ffb8662d13388cf4a1d5daba1527ac0440fc2eff99ddedc51f4a82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616174438, "uuid": "e60b3c3a-aa40-474a-bd33-e051ab90148c", "comment": "Malware payload", "value": "60a542f76b1228b1725c51bd6e19d9763ce5cd03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616174438, "uuid": "a808a304-5b67-4372-9811-5470df7b45e4", "comment": "Malware payload", "value": "ad3a88dad07379898343b91f8cae39d8f80a55d51d2f64408eb0321c3536ea564b7bfb9d458d1c290cefac36e2a6b40b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616174438, "uuid": "4e4ac91b-486c-4a13-ab0b-fec498034b8f", "value": "C3C4F12237D4C831F07A263177026FA2E5BA7A3B1A7D105377220D6DB45ADE2B23635D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616174438, "uuid": "5a1b82f4-7f7f-4bb7-9271-2fb12f200808", "value": "50d4bd1fa0dfda0aae81649c95f61c43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616174438, "uuid": "6a73c8ed-ce7b-438f-8cdd-7d43c182a6dd", "value": "12288:97uBppy1B6wAIXNavDgY28UEHXmwYEAbqfVeQSmt7J7LvJYB7:97uBpeowAIXNav22WdZ2fVT/bs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616174438, "uuid": "e6c56ff6-d859-4af4-8ebd-ad78a85f6204", "value": 572244, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616174438, "uuid": "8bcd1a65-0215-42e4-b4a8-4ec20919ec10", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616174438, "uuid": "75f9df2d-bac5-41a7-8c62-7c0eab428513", "value": "chrome.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c17373a1-88bd-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1616163414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163414, "uuid": "c0925714-f39c-4650-8579-5da6e61054c7", "comment": "Malware payload (NanoCore)", "value": "545f10789942c9118ce1663c24f52c95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163414, "uuid": "9b414836-26fc-4647-9e80-cbc38d0211cb", "comment": "Malware payload (NanoCore)", "value": "dbf6333c8d18ebf77677a40afd504e9607538a9f261771c718189d3542b2823c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163414, "uuid": "02e74b8f-1e25-4222-a240-df00a4b40fb0", "comment": "Malware payload (NanoCore)", "value": "29a1eaa739624e2e1f760155bad536a718fcbfc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616163414, "uuid": "e45a255d-0304-4228-b976-60f6d4d137a2", "comment": "Malware payload (NanoCore)", "value": "3f16fa827fdc3f23093e3c93125463b94893a2a3e18044487149a299d3d2113826de3005adc44fabde794ae3b8202176", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163414, "uuid": "42d73c3f-acdc-4e31-a550-93ff3e82f21b", "value": "40258EE6D749EDDDE10778314C7C945100A3BE8D98A6D67ABC09356494F33823ABBC2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163414, "uuid": "c5d1b8da-2f00-4ba6-b44a-6618074aee9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163414, "uuid": "c1cb2d2c-0e48-46ac-aa19-89810d5e1519", "value": "24576:txzF57xfLSkG64CEuVcXVn/G13og0ZrB9zztzzK2:rBXBG6PEX/G13orrB9zztzzK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616163414, "uuid": "6be2ea3c-1405-4c32-b2c1-43dfe1ee6e50", "value": 1032704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616163414, "uuid": "39cff8e1-5b9f-4b16-850a-0c4ff6f1fe12", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616163414, "uuid": "11647024-78b0-4a69-a2ed-9bb98e6ddce3", "value": "545f10789942c9118ce1663c24f52c95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e2b2e3-88b4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616159524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159524, "uuid": "bde4a16c-cc8d-41d0-884d-9d9fd2a61afb", "comment": "Malware payload (Dridex)", "value": "21eddfce340bf6fde4789779e83b69b2", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159524, "uuid": "27553d43-147b-4742-800e-da6f3895fe52", "comment": "Malware payload (Dridex)", "value": "dc08359a05f7933f8b0df4f7a725d51b1bb62e9fa46ca398303b5ae3d24cee8d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159524, "uuid": "46a0669c-1a5e-413a-b2c8-b7bf91b0c18c", "comment": "Malware payload (Dridex)", "value": "c672021c6abe1c141d7fc49bea0607e996e5cf17", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159524, "uuid": "093bbc9d-3e11-4ad6-af14-02664c6bded6", "comment": "Malware payload (Dridex)", "value": "9ce07821b7445304650076e3174f7adb83ab990a2efa10c54e4710c2a70cc3b4e5d86e57a987f36fdbc028d6661a282a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159524, "uuid": "7c43edde-2599-4bd2-a7a4-efd90d7e814c", "value": "E514AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159524, "uuid": "55b728a9-4555-4515-9b8b-b60fdf36380a", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159524, "uuid": "9177822f-a4e3-4451-8e9b-8c99e6d548ac", "value": "3072:P1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:ti78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616159524, "uuid": "39ddcb32-edfc-4251-b163-c16299da45b3", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616159524, "uuid": "747ba719-c36b-4e6c-95e0-2da94d55e668", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159524, "uuid": "af85aaff-a186-4357-89cd-8c4f03668946", "value": "dc08359a05f7933f8b0df4f7a725d51b1bb62e9fa46ca398303b5ae3d24cee8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f40095ac-889a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616148466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616148466, "uuid": "3953675c-f9f1-47b7-81ce-ee64d26a1ad6", "comment": "Malware payload (Dridex)", "value": "40468f295d9de55d8a5c995d0cb90753", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616148466, "uuid": "b2091e1d-a657-4e28-acf1-0bbd40c7fdb1", "comment": "Malware payload (Dridex)", "value": "dca1a7ee38741ea855dc7424049e135e30d5b39add21d54d779b52c410e4a3db", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616148466, "uuid": "354868c2-560d-4ac2-808c-c07e78a82a01", "comment": "Malware payload (Dridex)", "value": "0c277a105cf1101badd6215b037995840a58f369", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616148466, "uuid": "ca7f8e94-71fa-43d4-8531-158842e7029b", "comment": "Malware payload (Dridex)", "value": "e3f4f57614903a251cf6aaae09a62a9a6304503f968dfb3572f73f6a4b7653fe72f8373e41551aa78bf8eae0b457c0d0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616148466, "uuid": "5fa188e0-234f-4d52-8606-33d9ecbb56b3", "value": "AD14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616148466, "uuid": "ffec430a-a7c9-4bab-93a1-19339d58d586", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616148466, "uuid": "1efb8b7d-1a25-4a50-af92-e9493f7e8bfd", "value": "3072:a1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:ii78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616148466, "uuid": "bf8256ef-d874-4cee-b28a-f9fa6727c005", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616148466, "uuid": "8c7094e7-a7cd-4666-9bfc-602e440217dc", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616148466, "uuid": "00f19505-b083-4056-97e7-c0ffabe4528d", "value": "dca1a7ee38741ea855dc7424049e135e30d5b39add21d54d779b52c410e4a3db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1f9e31f-88b5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616160005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616160005, "uuid": "6b27ad49-b70c-4262-bc2e-09a3779ba1a6", "comment": "Malware payload (AgentTesla)", "value": "27f7af725666225f17b718966f295624", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616160005, "uuid": "035394fc-e9d3-4fe0-9093-c212a29ece57", "comment": "Malware payload (AgentTesla)", "value": "dea2e88e71d3b38500aca694a9ba1f476d8db14e5389a2cf70b23cad51eb33c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616160005, "uuid": "10f3a431-0d1b-4e9e-8326-e2b5aa7b26ce", "comment": "Malware payload (AgentTesla)", "value": "fd1af9e92e2fb11bf2a433a20e4660f9bcaa95f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616160005, "uuid": "21a742d0-a939-45cb-b940-6797801efdb5", "comment": "Malware payload (AgentTesla)", "value": "79600ec0445168f2478607e719eb0a8892040747efb750f3818d0520d0342d53e4703020899200720140aa7fde52a0b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616160005, "uuid": "918c1cec-5549-49c3-bb48-156b76bcc842", "value": "D3437B8319673A55C13261B0BE4A76CB2DE0CE99A1D05740040BF682DEC3DAF9A1EFD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616160005, "uuid": "6ec2ceee-15aa-4947-923f-51f24179c8fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616160005, "uuid": "e5283f99-735a-4cab-bd2e-710f063526bf", "value": "1536:vSSMNIxlM0iHyoVBY+5TgLEhtIUdkwsyOP1EGRLckxR0b:vZMN0i0iHyoVBY+5TgLEhtIUdLsyOP1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616160005, "uuid": "9f390049-afe6-4bee-9d83-aad14f180477", "value": 58736, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616160005, "uuid": "dccd6da5-419d-407a-8043-e587f4058827", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616160005, "uuid": "5ec48a97-9469-4541-b366-05079e863466", "value": "RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30022a8d-88b5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616159734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159734, "uuid": "55050f6f-a11f-47fa-87ec-d4f155b457fc", "comment": "Malware payload (AgentTesla)", "value": "22229fa796ad8a1563ff6790b827c6a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159734, "uuid": "37c72281-89e7-4a02-a6cb-d7fb29153b84", "comment": "Malware payload (AgentTesla)", "value": "deb390bfd6670a9f8260b30aa5c6b1d1f482f0a82acf36237e616c0188ce9a17", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159734, "uuid": "b959658f-2caa-42f4-9e53-3a7eda898021", "comment": "Malware payload (AgentTesla)", "value": "f6835d8d1e6b2be9ba1ac822dee04a5653783447", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159734, "uuid": "5080756b-a62f-4292-8235-b616ad3b4520", "comment": "Malware payload (AgentTesla)", "value": "aad352b225798280c6e92e70de97b59585d4ff6926c5b8b172ee33b0c854a56742eeb20a8ec4ff07d3547be6a5c482bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159734, "uuid": "c7456911-3d72-4d25-815b-8f505cfed63e", "value": "361569127EE06F49F0FE97795CA84D3047F5B8CAD336EABC3C9581CD5591A808A742B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159734, "uuid": "d30f7f16-956d-4534-85f7-f2bb7b0beb02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159734, "uuid": "6f970174-5f6e-48b6-9f22-f50ccf5e4756", "value": "24576:4NyuEMrCx9tIXezEVKGxPE9lnEJz7XbuRR5R2rY0VH+hQpMi9:4NyuEMrC/tIOzEVKGxOlnyXBVeh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616159734, "uuid": "d594ce47-0c15-4e14-bb04-d7c920e678dc", "value": 907264, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616159734, "uuid": "58235d12-5398-41ca-b6e0-3b30149963da", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159734, "uuid": "d54fb5fa-3bd6-47ae-9e78-3e31e6e4694e", "value": "DHL Arrival Notification 202119_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6ca46a4-8902-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616193058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616193058, "uuid": "b25b62d2-5235-4af6-88cf-e34afee64ea7", "comment": "Malware payload", "value": "faa0272bb29d8e076f3fbe2b0c25a0bc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616193058, "uuid": "72013f96-0017-41f5-b796-e50c37f8fd2f", "comment": "Malware payload", "value": "e0e241f1479e494612d18459ad11d5cab9a70792bb0b5ef6fb7811285e99e1a1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616193058, "uuid": "8d41b9e8-967b-4284-8f0c-5da982a75a3a", "comment": "Malware payload", "value": "89325fc7edf2eaf3dc72306f2abf5412cbe85387", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616193058, "uuid": "1a6bf8d6-8afb-4ede-a2a1-e762b653d01c", "comment": "Malware payload", "value": "cfaca8eee99b71c776a383f441e2b64dca8df0301b242fb544e8166ffa2839d0282fb32174d02ea0b59a54da15c5e434", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616193058, "uuid": "0f6db879-0f56-4bdd-a34b-a9bc01d55d69", "value": "1C9412516D656040FABF8E711A70EB34E57C668926486E0FE37F7C495D839E1B00E3E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616193058, "uuid": "92b1e7ef-d1a1-435a-8e3e-e3d42969eca3", "value": "4f0c2c904283b81b81368f0a41d1a1ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616193058, "uuid": "b63b23e0-4a8b-4449-94b2-28fe9d9be7e1", "value": "12288:93mA9qPKUYmC1hSUOw1K3HOOHYFGI46J:9H95UWSUzcuL54C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616193058, "uuid": "e6d35218-ef67-40bd-9200-69e82e5d37b0", "value": 443904, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616193058, "uuid": "8e2fa012-9efe-424d-b3b8-86f3b4bac811", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616193058, "uuid": "338259db-340b-455b-876b-0b0739e407ac", "value": "SecuriteInfo.com.W32.AIDetect.malware1.9853.30767", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b5849b-88c8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616168112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616168112, "uuid": "947b919b-6228-4f8a-830e-1292d14bb422", "comment": "Malware payload (Dridex)", "value": "281ec18842189cd1bb333bb39359c2a5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616168112, "uuid": "0b5942af-7a60-44b6-9935-6e0897e797c5", "comment": "Malware payload (Dridex)", "value": "e27a18d4b25902e3879d8d8be7ec4388ef7f0201dcb5a35ae8557c6ef94b0a4c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616168112, "uuid": "520b6a4f-2cde-4ec1-8fdf-b3b17412e1a7", "comment": "Malware payload (Dridex)", "value": "20ebbbea6e0cd5072d241170d6c0d009c7069b2e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616168112, "uuid": "49d9f850-90bf-4ad3-ac16-7b14146e7820", "comment": "Malware payload (Dridex)", "value": "7de4a296c5943f85b814d185cc1e6743bc4095a9982693b84aff9d0f7ba1bc5951679b65d857e20248fc50f565233676", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616168112, "uuid": "e81d2cc6-a15a-4c4d-b404-35e1342fd530", "value": "7424CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616168112, "uuid": "15d7f07f-f443-43ac-b752-1bf7f6c8a184", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616168112, "uuid": "95aa610c-2b94-4043-8488-979dfc998c24", "value": "3072:f9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:f9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616168112, "uuid": "7c2a15af-1a01-4b63-adaa-0d7ebaf84814", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616168112, "uuid": "2d30d715-13a5-47a1-afa5-79668e462459", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616168112, "uuid": "bf4d0a6a-3beb-4913-8299-a5bd7cbd2eb9", "value": "e27a18d4b25902e3879d8d8be7ec4388ef7f0201dcb5a35ae8557c6ef94b0a4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bfc0f15-8896-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616146520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616146520, "uuid": "ffc258bb-f44b-498c-837d-beba321bc07d", "comment": "Malware payload (AgentTesla)", "value": "a4a1281216f1c19a56c91192273f3fe6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616146520, "uuid": "9508a987-cb17-4ad2-a847-b190e674b8a1", "comment": "Malware payload (AgentTesla)", "value": "e41d7ebd02ce366293d8a66436ff687eadc4ef71164318c5999d9c48ad8babf2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616146520, "uuid": "acd9f99a-da8c-41f9-86b4-d8efa5f10c47", "comment": "Malware payload (AgentTesla)", "value": "af7348fd4ff169bc1f61218ce99efb3c46603540", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616146520, "uuid": "32c72ce0-5b23-430d-b966-0715d92b6a02", "comment": "Malware payload (AgentTesla)", "value": "b0affb1ebb85954033046b08611466f4110b633ca02b47adbad840246e5f565ac7bddc23a9683c02a0ee407d5b7ea02d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616146520, "uuid": "a44804fc-56e9-4634-bf25-f820175a3117", "value": "02156C5252816F49F03F53F65CA8872023FDBC1ED76AE6B83D96B1CD5851A828632373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616146520, "uuid": "3f415127-1850-4d8a-bd38-be2ab96137d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616146520, "uuid": "a78d0238-fcf9-466e-970e-cae3b4c3adff", "value": "24576:cbybqmfyHc2V78NGmN723Fw+2cdPquy7et2BJDACMeUJ3e4lf+:cbybqmfy82VoNGmN723z2cW7et27DACK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616146520, "uuid": "a38ed9dd-d830-4c20-8f5a-d26bf7f55d7c", "value": 960000, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616146520, "uuid": "306a98d5-9160-42eb-90e3-2b5e67ea7f5a", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616146520, "uuid": "0963cb84-64bc-49dc-bc77-9fde5911c1f7", "value": "SecuriteInfo.com.Trojan.PackedNET.591.17594.16292", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7459abd0-8885-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616139232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139232, "uuid": "31547327-282c-492d-bb4f-003715dedfa4", "comment": "Malware payload (Dridex)", "value": "8ad9d6fba7697fb0df774df0fee2c64a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139232, "uuid": "b233eeba-fd20-4dcd-8c94-95f02c5be801", "comment": "Malware payload (Dridex)", "value": "e4e0cdb7f6b68c9d7fdf91165a1c26d40caf3ca681bdd3ed0c0510d779a283b9", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139232, "uuid": "8d5e17ac-c877-4eb0-94e2-e9ca9efab302", "comment": "Malware payload (Dridex)", "value": "6c51274fc8cea578266bab400220830e5f508d29", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139232, "uuid": "03fc2f8a-3b13-4a1a-b99d-dece5e6ee079", "comment": "Malware payload (Dridex)", "value": "2b2c8bc2436306f5d56de8b06a6f430b76357054d4f46f60b3fd91d9a1000781b16025046ae9a3338d3fc2e1c6cad1ae", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139232, "uuid": "2e12914e-5a04-4fea-899d-cd39c5dac913", "value": "CE24CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139232, "uuid": "4028ecf3-1aa0-494e-8f53-1a11aacf4629", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139232, "uuid": "92dcb8e6-1576-49eb-81a1-b34161029519", "value": "3072:r9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:r9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616139232, "uuid": "7c3a99d2-c6b1-471d-a6a9-923a9eedbf7e", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616139232, "uuid": "436b158c-033e-4d2d-a2b7-372fe1d377fe", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139232, "uuid": "3d0ce17d-e8d2-4934-9aac-e57969c48a89", "value": "e4e0cdb7f6b68c9d7fdf91165a1c26d40caf3ca681bdd3ed0c0510d779a283b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4342487e-88c9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616168356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616168356, "uuid": "07c5354f-da69-4083-8bbd-25bceddf130a", "comment": "Malware payload", "value": "af578a71cccc64eb9916fa97e32d3b8f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616168356, "uuid": "cbe94718-863a-4367-bbf6-ca5283472acb", "comment": "Malware payload", "value": "e591b4f3c7c9ecef79856641df3b948dcfdb48ba4f8af8c3b8bf644e735d4c21", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616168356, "uuid": "468ba9f6-5482-4b4c-9568-61bda32e4fbd", "comment": "Malware payload", "value": "e75bbe66104fab39585594a7491b03957e01f082", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616168356, "uuid": "7c73ad54-e90b-43ea-a527-7fbcd37ee231", "comment": "Malware payload", "value": "3ec822d804199558013c538ab32aab8b1148f48cfd0d3ecc16951e7a955799e695cb05c875812affec54630954d6cf79", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616168356, "uuid": "269da401-ecf1-42a7-82f2-2c7d2b863ad6", "value": "6DB4D0249C21E5D1EF4831B5E4D841EC619F6CB1978B18CBA4FCEA6331EB34665388BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616168356, "uuid": "299f641d-294f-403b-8146-3c7c7605eca7", "value": "b4c7cb5077bfbbf4ce55907dcd0ddc65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616168356, "uuid": "cfc77198-3c37-48b3-adb4-44b9f5a3c6d8", "value": "3072:bIV6Wbs+P00tHkBFlJveFI/+buvEFvEjWbs+P0TIM9zfE:bIV6GFJsJv62jGwIMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616168356, "uuid": "0da5bc5d-44f5-4328-816e-2553ef4d5576", "value": 529480, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616168356, "uuid": "eb93faae-0042-4ca9-a436-b38c9c2b70c1", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616168356, "uuid": "267d152e-41c6-4a4e-bc7f-95bb2dee9768", "value": "SecuriteInfo.com.Trojan.GenericKD.36487241.14374.18861", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6da0cfc3-8886-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1616139651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139651, "uuid": "293abc83-7bfd-4639-a554-b278d1be2a2c", "comment": "Malware payload (IcedID)", "value": "50aa8cf39d72bdc45b1999ff43b75585", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139651, "uuid": "7fd6107f-5736-4355-91b5-5ef99f70d2c2", "comment": "Malware payload (IcedID)", "value": "e815b530617bbc559b2e3d6ba3259c5390410260584b8a94c1b805900a4d5cef", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139651, "uuid": "2daa09f1-211b-42db-a489-49efa5a4e92d", "comment": "Malware payload (IcedID)", "value": "cedddbdb5970968e6f9d8ef9be764b5f8ac897d9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139651, "uuid": "554060ca-2bd6-4dd7-b3fb-efcf8c720d37", "comment": "Malware payload (IcedID)", "value": "42b1a204f55aa63d0053a492edae607764f2216edf07e9105b7f65c9ab5eba31f9631c963b2557e3e4aae77facd98cf1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139651, "uuid": "ad3a98ce-de3a-4a4f-89c5-b4c7ea3d5e4d", "value": "D273E59F40D14F7AC0B22631CC52473581732A44679EA4FBF6C05FB08A25BDCEB196AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139651, "uuid": "bd9bac0b-1b0f-441d-b7ff-711f28211032", "value": "768:KqE+MlI0GJ+4PWBzZMkkkksV83I8LtrqVLb/xXR+VYA8BjM20msXhwRnwP3LVx+I:nzMZCijuuK3Lqf4T/j6GAKg2gJFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616139651, "uuid": "fdafe42b-33a0-49fb-996b-bafb7b97a995", "value": 77312, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616139651, "uuid": "2253b3e2-78f9-4c66-a94e-bfdfe684c6f0", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139651, "uuid": "723b5938-3b3a-4cc0-a42a-9c37884cc014", "value": "50aa8cf39d72bdc45b1999ff43b75585.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b94753bc-8903-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616193465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616193465, "uuid": "a5a6a799-2069-4efa-850b-c682a3c472b6", "comment": "Malware payload", "value": "397a1f82c0a0afc721d95129a60511f7", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616193465, "uuid": "ebf67c02-8862-4896-aac3-e6c3ec1b4491", "comment": "Malware payload", "value": "e89729aa987958b5bf2626c34755265e5723856d28221a68c4e76b94b8fff0e3", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616193465, "uuid": "3d07c2dc-9e8a-4e37-bb3a-c86e846a1d77", "comment": "Malware payload", "value": "aa7e008f52dbad475fb592e0f0b19b20b99702c7", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616193465, "uuid": "481479da-614f-4344-9920-423ff6e3ffc0", "comment": "Malware payload", "value": "3da3ddc5cbb1350b50a8a1a1d5a8b892bbfe86ae393faf0265d2fc7d9161f7395bcdf3cff8ae32c6dac9b899c3db9e56", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616193465, "uuid": "e1096757-eba7-48b6-b5fc-fd001fa1896f", "value": "8824CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616193465, "uuid": "30b47718-024a-4987-b76e-a55c73a35780", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616193465, "uuid": "f3c7667e-c752-4e1e-8c9a-0c1fe476ec12", "value": "3072:09Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:09Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616193465, "uuid": "1f11d36c-394e-44f6-a485-dd0660dc1af9", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616193465, "uuid": "95dd5ed9-ba59-44a4-93c5-2e6be2fe6c3b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616193465, "uuid": "6793514b-5302-4b9c-a3b3-2eef86bba2c3", "value": "e89729aa987958b5bf2626c34755265e5723856d28221a68c4e76b94b8fff0e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10bb39e4-8888-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616140354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140354, "uuid": "59f6bc94-e68a-4c3e-b594-796a079bce9c", "comment": "Malware payload (AgentTesla)", "value": "8e0aedd91263fc5f23bc71a2136c6560", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140354, "uuid": "7c5c9526-a96c-4a5a-8a36-6bc433548a9f", "comment": "Malware payload (AgentTesla)", "value": "e8b48f83a4dc1fd1063453848c3d5da61e174cd03f161ead46eaa61f290e1708", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140354, "uuid": "04836df5-78e9-4a95-bd1e-d7bb8f596c60", "comment": "Malware payload (AgentTesla)", "value": "f86ad7fead8cef9064c299e3159344173f30f4f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616140354, "uuid": "a74200d8-566f-4773-8553-dbb20c5c4e55", "comment": "Malware payload (AgentTesla)", "value": "d8e3edb02f7532068a2ca29a99c4cb38bdf0d0064b743af1021d3c3b0bbb75edb9cdef19c1a17642c09b7478668ff4bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140354, "uuid": "4f82b1bf-33a1-4796-89af-cdce21617627", "value": "DDB4339041E527C9887E7B8334F062B5EA7279F459B9D13775B3582BF28F8F49408C89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140354, "uuid": "fa9e460b-724c-439d-9592-7f190245140a", "value": "12288:mHRaYhOSgMloP/+FXq+onV0jmb6BJHGXMRPYl:MarjMlu/+U+A0yOiXMRPYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616140354, "uuid": "9a6b53ed-6dfe-4030-9c0a-5955ffa387c1", "value": 517431, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616140354, "uuid": "5e87218e-e81e-4920-a76f-f39d055d0dc3", "value": "application/x-rar", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616140354, "uuid": "693d0b3e-01c8-4b7c-9494-46ba036f2561", "value": "0202_00267947_19032021_PS59ALDN020200262000430010000_F.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5eca6e4-8880-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1616137168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137168, "uuid": "27243620-b86f-450c-b26b-1306dda116d4", "comment": "Malware payload (AgentTesla)", "value": "fbe06e2b569b9d3f71d4ae539312fa67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137168, "uuid": "99afcdbc-17b8-450a-8c10-3ba235d53205", "comment": "Malware payload (AgentTesla)", "value": "e8dbbf4be4be9a2ca5596eebdda4b63a5e914f27a5258b42bf5cbd355f01045a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137168, "uuid": "18f9834d-0953-4a56-937b-32132f92491c", "comment": "Malware payload (AgentTesla)", "value": "6b59ddef9e32dbd55141a956432e02d15caf0c85", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137168, "uuid": "bc79f9d3-2b67-4e8c-bf22-30a514e7806b", "comment": "Malware payload (AgentTesla)", "value": "6b14d43a546173e3585322f46b820f15f7d53a57bb50eea046a92c789271d8321bd303348cd66ba2832a3b952402bc22", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137168, "uuid": "f4bfb37c-a8b4-4ca3-a793-b6e38adbfde9", "value": "70F36DA8E9D0CDD4CBCFC9D94A1D3A952022FABDC6C36C964438F7F50B9267F4A16850", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137168, "uuid": "965356c2-0ab5-4342-b8f7-e5b405ae2508", "value": "3072:oA4Zts1unvhfKwGt7D2l8hnoo+ixxpbeBJTJzEmFhThl4O/b+8OGo3VaES8e5EI:B4Zts6vVGt/2l8nxpKJTJznhdDT+8OGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616137168, "uuid": "9b3252d4-463e-4847-a682-f728bf16263a", "value": 165772, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616137168, "uuid": "d800e115-21cb-4b03-813f-2086b018164c", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137168, "uuid": "4bad9251-f799-465b-804f-701377af53b9", "value": "Purchase Order19321.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f0efb7-8882-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1616137945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137945, "uuid": "1382eba4-3a09-425a-b9f0-34b2f1b1846b", "comment": "Malware payload (Loki)", "value": "5e2c7b97ccffb6ccd3971acef61dd035", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137945, "uuid": "2c40e882-7dbd-46f7-a0d1-84c18e6060ff", "comment": "Malware payload (Loki)", "value": "e8ff38163716c348afc92f40c256f33423e8b597d65b0c4fc1e3b114239e6eb1", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137945, "uuid": "2995f4a0-eff2-4a85-802c-03bbc6dfc1c9", "comment": "Malware payload (Loki)", "value": "6a1415dfb89ce5a84fb7ef68cebec2f65951c0b3", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137945, "uuid": "354ecc23-7852-41a1-8bd2-0464608345fc", "comment": "Malware payload (Loki)", "value": "da5fab25d4b6f910da2f25f26b63287574aaec7527001f40f7c204d41e9574be8e8089bade51b8d9ce0908060e18a57e", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137945, "uuid": "ff403933-3857-4b6e-a887-7226f4cb51b7", "value": "F8B5330BA5E36F03C97F89F1C15AD118447CEC818A5489BD7A08B656BA3367373FA21D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137945, "uuid": "dab06a75-ab91-40da-83ad-96b58a1157bd", "value": "49152:DblmeJv1yORNZwf66NqCozkc9ujSumPGcyDTAjpM6WqF:Dwc0OFwfhxoTY+YfSbWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616137945, "uuid": "c3d9fbdd-cee0-4c82-b99a-d132a2793a72", "value": 2383360, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616137945, "uuid": "0090b519-fd60-4255-be15-3b4e1f508043", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137945, "uuid": "563df5a1-fc1a-4ed5-bc5c-0883e9453009", "value": "AWB 9284730932.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90d9c24-8886-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1616139750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139750, "uuid": "c8c2f1cc-b398-4c2b-8094-3dc4f3659d8a", "comment": "Malware payload (ArkeiStealer)", "value": "9284cf3677383b447109002b01bcc232", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139750, "uuid": "f6deecb9-2260-4070-8b78-8061af169ffc", "comment": "Malware payload (ArkeiStealer)", "value": "e9236502d303a733b1daf06ec731e09a67becdcf9d7178d10e7f5d6def2ace93", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139750, "uuid": "cbf81aee-3fc8-4af2-9824-a6bd8b0def22", "comment": "Malware payload (ArkeiStealer)", "value": "773d36537c62f0ce9bf61b0e7d52cb849347e24a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139750, "uuid": "c9916fa1-4d7b-4d02-8add-0991782ad463", "comment": "Malware payload (ArkeiStealer)", "value": "0af620639bec9cb008aa2030b5d63be722ab4cdd21e65db004bffaa93481aa0b023562bb7e322b71743cf1276d2ce9ab", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139750, "uuid": "41350c7e-c78f-48d5-8dfa-a07e292c5351", "value": "96C4E000A7E0C034F5F762B449768EADAD3A3DB1AF2440CB56D917FA66386E09C3175B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139750, "uuid": "81c51290-d11e-4420-93a3-ef2be6630058", "value": "5d17de16c76266fd8d910bc0fc0e437c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139750, "uuid": "9055ec8b-aa8e-4ba9-b915-c8cc1cb54e70", "value": "12288:tnam4OPuTrQJHB16ct++3srMjzZzMONJV2jmqXh2uEfkqsIKRcqxPjd:9B4OP8Q0S3SMTVARdqsIm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616139750, "uuid": "18863af5-176e-4283-a32a-b7294395a231", "value": 579072, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616139750, "uuid": "50e01200-45d9-43d6-a1e6-c2d88d22556c", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139750, "uuid": "569610f0-5537-48c2-82d8-8ff073296a82", "value": "9284cf3677383b447109002b01bcc232.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f94c3b-88c3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616166032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166032, "uuid": "74c641df-94cc-4602-b0d0-8ecd6857e295", "comment": "Malware payload", "value": "136ded3f96f927e13ed0f7e8501fdcfc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166032, "uuid": "79c9a8ce-22dc-41b9-8033-148fe25ac92d", "comment": "Malware payload", "value": "e9a90878ec6ff81a800836534c3c2ef86091379d273f2641b529ee6c3455aa2e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166032, "uuid": "d363d389-07e4-4bcc-94b4-bcd936f730bc", "comment": "Malware payload", "value": "65e60ecbc949e57e231cfeeb0de0088fc4ab85ee", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166032, "uuid": "3c10fa12-6fc1-4e3e-80ab-3e3fbac316a4", "comment": "Malware payload", "value": "96fac15c8148e8c7f3ad3c64c97f3c0172c3864ac302e6bef65627a4c5287764d23770e2a559345878c4047f0109450d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166032, "uuid": "c6be47aa-a7e8-410c-869e-78756bdb888e", "value": "6D847155A5268976EA460F7390FF8DF41677EE50961B4E4B3F8AF3085F703402E13A8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166032, "uuid": "866701bc-0057-47e3-b096-bdc720203abe", "value": "3072:2zxQ3STS6t/BI/s/C/i/R/7/3/UQ/OhP/2/a/1/I/T/6Xh4zJ2dtrBF:mxQ3STS6t6Uqa5DPdG9uS9QLqh4zJajF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616166032, "uuid": "42c1fb60-f512-4e0c-a36f-f16123799419", "value": 381952, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616166032, "uuid": "2af3110a-9870-4441-97c9-80f96d395dc2", "value": "application/vnd.ms-excel", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166032, "uuid": "afc60efe-2390-443c-a861-00e89437152d", "value": "document-1322316054.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6dceccc-88b4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1616159638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159638, "uuid": "e29cc114-ad3e-4df2-92bd-7b6341ea87f4", "comment": "Malware payload (Loki)", "value": "f706a499b9cead1b1e618ea1f2d3ec17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159638, "uuid": "d14337b0-7dc6-4125-b052-f30825217686", "comment": "Malware payload (Loki)", "value": "ea9fb25c355f736972eb34e2808c0939cff94da5ae355736b81492eb62ba786c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159638, "uuid": "31b9eff4-43b6-4210-b696-a4237e1b835b", "comment": "Malware payload (Loki)", "value": "56be1ce3419a5d81a4726552dfeac152444bfd0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616159638, "uuid": "9a9ba940-28c5-4f82-a70d-b4f73d2387ae", "comment": "Malware payload (Loki)", "value": "253b66566dd90f7151a6bfaa267a8c78264d0f154d8c70abc43b1177eb88258135d268a8daf614cd4f997bc4f38f346d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159638, "uuid": "cc53573d-c402-4593-b783-af8fca656ddd", "value": "ADF47C1262D06F4DF17E677D90A8421553F2B94AE336EAFD3DA181CE15A1E80C7B07B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159638, "uuid": "67283898-ce87-4872-9fd3-d45996876dc8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159638, "uuid": "81870651-7104-41ab-9578-779df270dfc9", "value": "12288:vFZ3M+ikzhLfQbIlS05z1HPg0Kp55dB655dBxUyVsT6MVmQI93PX73Doxw55dBIE:vFZ3M+ikzhLfQbIlS05z1HPg0K3yWOFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616159638, "uuid": "16c6f8bb-d369-48f9-ae7f-b3aaf2febb24", "value": 744448, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616159638, "uuid": "e44e0a00-bf4b-426e-b282-0f8623a6a548", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616159638, "uuid": "c1fe84bd-aba6-4f06-8721-4948ebcd018a", "value": "PO no.PECPUR20-21349.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c06da47-88c6-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1616167109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616167109, "uuid": "882c86e9-3076-42a0-9e35-e297ef0a31a4", "comment": "Malware payload (RemcosRAT)", "value": "a7f92c9410867333c6efdc6d006a8390", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616167109, "uuid": "75975a45-3834-4388-9a2c-78ea389bba26", "comment": "Malware payload (RemcosRAT)", "value": "ead243034e5816a6899ee5a8aa2582c58824bbb06967a25ca2811f83457c9b46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616167109, "uuid": "b60b62d1-f468-422e-8a90-86a8281d2e46", "comment": "Malware payload (RemcosRAT)", "value": "86aa2e2b79c24eb90c8d7774ac51222b4c47fe92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616167109, "uuid": "77e4826f-c442-4991-8d7c-64df626d05f2", "comment": "Malware payload (RemcosRAT)", "value": "974d2adb0fe0ac625a6605f3af157f64677461591ef0857f879ceded2efac8a631ce8adf7c078b1c53a80962412e4ba4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616167109, "uuid": "a9aff5aa-ee17-4b5b-a392-bec7833bdb7a", "value": "A3C48C01A3B6A648F33B63748178520297F6B945D73AD7BDAA8090CE1DB36454B7B333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616167109, "uuid": "fb2099d5-9411-4137-99ba-740f25c723c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616167109, "uuid": "a6ffb9cf-5736-4389-a4c0-41c415056384", "value": "6144:HefOedUl3MLGlqjHtCxlfgCxn8jgtpbjgyNyVre3yV3swFgxtNFgyA4uTch4u4Ym:HefOeOcqNxdOa+v7t4UM2l7665", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616167109, "uuid": "d88641e2-035b-42e9-9231-e0fe318f6288", "value": 582656, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616167109, "uuid": "d0708760-8893-4be7-b9da-b049d03c1315", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616167109, "uuid": "2c063fad-3134-4c77-b0af-a16264203dca", "value": "a7f92c9410867333c6efdc6d006a8390.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b87c29d0-88b2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1616158674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616158674, "uuid": "c4dbb123-e10c-48fd-886c-4e28c6576e4d", "comment": "Malware payload (Quakbot)", "value": "f3e051fa1025a710b161983dcd4a5812", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616158674, "uuid": "da5e841b-ad75-4f88-9c00-f83fb2752608", "comment": "Malware payload (Quakbot)", "value": "ef08d613257a985e7090c1f874f765643560816ad1e2ccf84605c08be353b23a", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616158674, "uuid": "bd9486dc-0d8f-4455-a131-2ae7c5c807f8", "comment": "Malware payload (Quakbot)", "value": "d8f38909976ccabcfdf9a059b5e25f0878cff17e", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616158674, "uuid": "a211b04e-543e-49b7-b5b5-cea23411f038", "comment": "Malware payload (Quakbot)", "value": "87e08526751d993189efa20fc2ddbb676ea6bb11cdf22cb083c5bf82738e58e6fa6619827acecf015ac814623afc6672", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616158674, "uuid": "26b0953a-c50d-4340-9d68-ac67ff53107a", "value": "D8838D46A242CB93DF91B4B869681D496C2E2E8BD1C274D68B517EDDDD81CE340CB3CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616158674, "uuid": "aab527b8-f7fd-4938-8727-547d7c2197bd", "value": "1536:09Am4lxZfyXZDPsDZqiwcz88i888u8886IRIcozVIRIQ0mRImRIBy6YJcJcHW3JM:0h45fcZEqipzMy6YJKX5GT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616158674, "uuid": "dacbf260-5fbe-4ecc-8246-9bafd8057c63", "value": 83932, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616158674, "uuid": "f91da1a8-4b6c-4e0d-999f-0ab2ad2605ce", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616158674, "uuid": "a18956e1-2f71-4d4c-b951-ec6f6d1accfb", "value": "Documents280.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68414dcc-8886-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1616139642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139642, "uuid": "59611a4a-2293-4768-85db-f589b09a3f6b", "comment": "Malware payload", "value": "d72c9da389ab5392ff617909572cac4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139642, "uuid": "54cd6406-92a9-4b92-b993-d900f0612dd9", "comment": "Malware payload", "value": "ef9b7f99346ac5307323163c42c1c5d1e63143287677c551db77403165346d96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139642, "uuid": "f0ace506-c230-4ceb-ab22-38aa75cb3793", "comment": "Malware payload", "value": "4d4f93b2abcd8fff94cf594e665f14710827b61d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139642, "uuid": "7051f46b-d013-4491-96b2-c130ba97a970", "comment": "Malware payload", "value": "7af876ec2ed79bf578f361daa50731d7e3998f9b8bc44f7fd457bd032c6fdd8feea06e19e024ff23ac2246e973be4144", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139642, "uuid": "b928e187-cf1a-457e-94d0-70210e6e70ef", "value": "71C4233ADBA4AC77ED17B0350464FB2A5311FD002A9C3772A14EB10BFE717721869A89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139642, "uuid": "71dd73de-5cc6-423f-95ec-7ffcde04f1cb", "value": "caa5e6a2892587c2324418efee31c648", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139642, "uuid": "e476c0af-d3f7-4128-9f32-4fa7a266d1dd", "value": "12288:r7iLxBGNINmAOHP9e7hdBojydyVnXnJQI47M+:r7iNBEmcH1e7hdwydy1XnJQXQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616139642, "uuid": "de352c84-bad9-4711-9f04-6b08ee92e599", "value": 587760, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616139642, "uuid": "7f69802f-3003-4ec9-bbbd-950dfdc61709", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139642, "uuid": "f893c13f-9459-4c43-866b-22ea69727383", "value": "d72c9da389ab5392ff617909572cac4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9527e3f9-8886-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1616139717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139717, "uuid": "2a3df5e2-1436-4da9-9637-065d2d1f7d68", "comment": "Malware payload (RedLineStealer)", "value": "c76515ce42ddd9b89ed2b79ded5a6045", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139717, "uuid": "ef5513d0-d700-4791-9615-28575468fcf2", "comment": "Malware payload (RedLineStealer)", "value": "f1aae79787fff8edd5f6769ebecf43eb5a94d392cb3723810a66dd9868ec2925", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139717, "uuid": "d7de1f62-219c-4eca-8fde-7fa5a1dcfd9c", "comment": "Malware payload (RedLineStealer)", "value": "0021871d80e6974442290e300b0e42ff5b3ade66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139717, "uuid": "6ceb7971-7436-4eae-8a43-565c97ae73c0", "comment": "Malware payload (RedLineStealer)", "value": "a05ccd2ad8242126b15568deca3e64678d8cb20136e57b447acd3c2d1c4c87b3d70e65b824c5fa12b35612811b9ab06a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139717, "uuid": "36d0e554-ff61-494b-84fb-607801aa4f19", "value": "6836236321A58049D0E49D3E4937BCF031F65E76CA033CB9A5EABED925365B4F607883", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139717, "uuid": "6c09569b-a6a0-4a63-af78-c2fad16f36db", "value": "40a3e3e00b1cad3ab67c828af845a553", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139717, "uuid": "683ba428-5a23-4847-b1d8-eeb2c737609f", "value": "98304:oP2bvBVgTFwh5C2S9+xKQWvVHISzi6TBbcawOXldIkgjDvpGGKwlKOgEPz:C2jvnhEVU4VHZuCBwHO1dUfvpCyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616139717, "uuid": "8b67bdff-1154-423f-b2c2-951ad4a43a63", "value": 5281728, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616139717, "uuid": "05f0072d-4725-4d14-9e13-186411aaa376", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139717, "uuid": "67cd8385-dd72-4441-8ac9-8b4e09f65203", "value": "c76515ce42ddd9b89ed2b79ded5a6045.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e44356-8896-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616146451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616146451, "uuid": "d48d24b2-1f2e-44fb-a57f-9a8ab04b1b9a", "comment": "Malware payload (Dridex)", "value": "75f14f06abc6c0604af46f916222e548", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616146451, "uuid": "1174f444-697e-4635-a0d7-916b485f521b", "comment": "Malware payload (Dridex)", "value": "f1fd3918a642647030d8fc79ae790406f860275d1db8b77cef9b8d2c46ee3898", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616146451, "uuid": "280e70f1-3841-4e9d-adcc-5c5950368326", "comment": "Malware payload (Dridex)", "value": "d0068c73c9040fbee0e50d0ed4bed7de400a31df", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616146451, "uuid": "1b05f763-c341-4d28-ad86-3a40f3052d03", "comment": "Malware payload (Dridex)", "value": "8048eb6952c7aaf9246901a2c14f9dd0728fb097b7c87287e5aa808901d89276c08ce9e703a2d4444cdf75d90f05ff70", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616146451, "uuid": "518c7c57-dd56-4ea3-a266-db77f6d3fe31", "value": "AB24CE5CDBB6D865FBE3EBF20016932A95336D41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616146451, "uuid": "03157cfb-b5e6-4c67-bfe7-3c058855703f", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616146451, "uuid": "22fb1c78-5af1-4e02-a036-a48d68249328", "value": "3072:d9Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:d9Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616146451, "uuid": "a13f3c18-5331-42c4-902a-ca363109faa7", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616146451, "uuid": "35696525-cb16-4009-b35c-73b94ae7f402", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616146451, "uuid": "32203d34-667e-47c1-9e75-88b104913898", "value": "f1fd3918a642647030d8fc79ae790406f860275d1db8b77cef9b8d2c46ee3898", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d3b449-8884-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1616138941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616138941, "uuid": "762c9dc9-45c3-409a-a087-443a2033942d", "comment": "Malware payload (Smoke Loader)", "value": "05ade671828a036852f5906bed805c88", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616138941, "uuid": "0b1a95ab-059a-4d42-9002-4c4d05f3b5da", "comment": "Malware payload (Smoke Loader)", "value": "f2576e20833929d6ee93ab308ae039e1e4559331b5e559be1c393c3556897b79", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616138941, "uuid": "9ed7d69a-bdb6-4c07-acde-8e44b89188d0", "comment": "Malware payload (Smoke Loader)", "value": "0e16279a9760d3b5d3114a7aca469e2f9fe94373", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616138941, "uuid": "94e8c485-8d86-44e4-94f0-6ab02d1b8a16", "comment": "Malware payload (Smoke Loader)", "value": "fa6ad792907601518fb2f107313c9641dfca5d617737cb205c90df26d0624768b6799d2c2abe2b114bcc1b2f0aaae471", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616138941, "uuid": "c7f454b3-e03d-4db6-a71f-d66bfc555599", "value": "F2058B0273D1C036FFABA2739B6AF64156BC79254133852F13981DB9BD701B2263E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616138941, "uuid": "590359e9-1a9c-4796-b698-726fecaf9b21", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616138941, "uuid": "d3cf1ddf-7bb2-4e0b-a6c2-809d07aff2fe", "value": "24576:UAHnh+eWsN3skA4RV1Hom2KXMmHalIM5:jh+ZkldoPK8Yalf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616138941, "uuid": "0f2755e8-4a02-4826-b956-f84c682d40c4", "value": 867840, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616138941, "uuid": "05ee1239-6a3e-436f-9c72-e4d7fe13f0da", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616138941, "uuid": "b53612e7-7191-49dc-9a57-f1f856d66565", "value": "05ade671828a036852f5906bed805c88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4474b1f-8880-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1616137165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137165, "uuid": "235692ba-2f9b-4006-b8df-68d1439c8d10", "comment": "Malware payload (Smoke Loader)", "value": "c0ce5fe0bf5304df10b776472d8c7255", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137165, "uuid": "71fc821f-c1cd-43f0-9bbf-0b688e0fb2e9", "comment": "Malware payload (Smoke Loader)", "value": "f395b9d7aee2a2b64be774d9a3b2978a5d2762d8ff8b899a35ee96f86ccddb79", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137165, "uuid": "d05f234e-fa05-41de-85c5-b07ec99ec71b", "comment": "Malware payload (Smoke Loader)", "value": "3bf5c40e3daba17bdc3205a93cc2dc8b3951cebd", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137165, "uuid": "d14a2e1c-0a2b-466d-a95f-d61eba64d640", "comment": "Malware payload (Smoke Loader)", "value": "6d7c97d04f64b2871b4c9bbebedb6e7a2beaefff148f7ce54bdf2bf414cfc6e4ebe99e7903efc9030afea10674ea0423", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137165, "uuid": "9f50c26a-6191-4bfd-8a45-753c4e9d8cdc", "value": "52B5F1E02B2569EBC8AB0F44C19935540B27F53AFAC714D8F01EFB7525BA293E61DC84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137165, "uuid": "e3db9e7f-2075-42d0-b4af-c2d078779ba8", "value": "12288:WNI0nn0NI0nn0NI0nn0NI0nn0NI0nn0NI0nn0NI0nn0NI0nn0NI0nn0NI0nn0NIg:sSSSSSSSSSSSSSSSSSSSSSSSSf5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616137165, "uuid": "76e22fcb-bf59-4607-af7c-4df06b038153", "value": 2454409, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616137165, "uuid": "977fba21-031f-4174-869d-37301e1b63d0", "value": "text/rtf", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137165, "uuid": "d46c5098-56ce-4d26-9cd3-eb27d4e9de48", "value": "QR243318HY.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c929075-8874-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616131972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616131972, "uuid": "21078944-a139-4bf4-8e22-37c5ffa3e7df", "comment": "Malware payload (Dridex)", "value": "378af76ac00f64d922dffcd91a841a51", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616131972, "uuid": "57fdb270-87f7-4960-a375-ec31f0d7f4b7", "comment": "Malware payload (Dridex)", "value": "f7f6ac337660c12fb40325c9f8539ba02dbe194e8c10efdc876ec04f564277cd", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616131972, "uuid": "c2b5bba6-ec2a-48ed-8401-fce3c31e1380", "comment": "Malware payload (Dridex)", "value": "8cfe8f52753fa59af1adf3feedd360c8c663f8ec", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616131972, "uuid": "36c05438-5761-4e8c-841b-0e6ebac4a33d", "comment": "Malware payload (Dridex)", "value": "d9586a59b09563ea2778b3ac36c6737dae16e04ae04a8047265aa9a3719e8835f8ca4637449e5e8c4cb827324bb2ee9e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616131972, "uuid": "b8df8634-b149-4f2d-9cc8-6d29d7a915b7", "value": "3324CE5CDBB6D865FBE3EBF20016932A9533AD41816B9058F3C9653FCA3F62C416225C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616131972, "uuid": "e133b0b3-272a-4066-8025-957bec0c0a22", "value": "9a83a05f751d90a83ed0413e0d8eb676", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616131972, "uuid": "bf77a513-080e-4e56-9c21-f93a2997940b", "value": "3072:99Yhg1i//ox+rmBceAOHUZDO6haenOpqQJUKSJ9WNA:99Y21i/zGmsMm1vSDWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616131972, "uuid": "523f16c4-66fa-4a02-9f5f-29ae1f2f99a3", "value": 212992, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616131972, "uuid": "7ec2808f-232b-43f6-97ed-272c30d5186b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616131972, "uuid": "49e94198-a359-4e94-8781-381de826f6d9", "value": "f7f6ac337660c12fb40325c9f8539ba02dbe194e8c10efdc876ec04f564277cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7908f6db-8882-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1616137952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137952, "uuid": "a6930aa6-c8b3-49d1-8b02-e60f3f5d7fda", "comment": "Malware payload (Formbook)", "value": "22371e7f11bad808eb76646cf9651c08", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137952, "uuid": "c0f0fdd6-aa17-42ed-ba59-6a7ac460cc66", "comment": "Malware payload (Formbook)", "value": "f8196e6009ed055bd7e2021a629cb903a530650ed36505b296c177fab320180e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137952, "uuid": "d66f8d85-4299-48dd-9cae-bdaa5dcef915", "comment": "Malware payload (Formbook)", "value": "76406077b16e74957e79546927f1e9c519d00770", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137952, "uuid": "604bb18c-f513-410e-a5b5-735ce8258636", "comment": "Malware payload (Formbook)", "value": "97e6c8c14f899f817921733cf8e3635040fc3e136870c1a3fd156614fd0ca6a3bd6798d6622b8106a4bd3565ae3adc2b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137952, "uuid": "67a325bd-97de-4ac9-a911-98659d9521e7", "value": "18B53367E8E0DF52F65E62FEB9CA5D388578CE210C104A1B3429B42D367B16461E4B3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137952, "uuid": "0779e5b0-9e40-4122-a346-d512f8b557bc", "value": "49152:/mTZs4Z8o01DfH3oPGJc+Hw0rNSUYYlzwsY9IFCKJerTQu+OXLz:/mLLCDfYPGJcKrIYlzTYyDJer0u+yP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616137952, "uuid": "493f4c1f-f372-4b01-b5e8-dc25482e805a", "value": 2419200, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616137952, "uuid": "0b74d06d-5c92-43f8-90bc-98df144740a4", "value": "application/encrypted", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137952, "uuid": "c8e88f77-c235-492b-8d7e-7d04e1dbf64a", "value": "PO TM-3851 ,BT-4792 RS-70100.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f71cf305-88c5-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1616166940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166940, "uuid": "34d67740-ccfe-49a8-a549-43977e361034", "comment": "Malware payload (RedLineStealer)", "value": "965212c139d8c474ed69ff3c33b88be4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166940, "uuid": "d8a62e73-53bc-4ca4-b565-8a9ded183d7b", "comment": "Malware payload (RedLineStealer)", "value": "fc1c966dd0ac73c1e2aae4287b1480ba9d27d01accc069a9a69d2a4fc9f1a6a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166940, "uuid": "3f320b4c-cf94-4192-b61c-b92ff8625a37", "comment": "Malware payload (RedLineStealer)", "value": "cce8ddf99da03113f80cd0e3e1368186468d904d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616166940, "uuid": "555bf879-b9b7-4e52-9cdc-b34487f3d5c4", "comment": "Malware payload (RedLineStealer)", "value": "8240c7a1aad4decf2338959d215432e2a1a970a6f969992d115693a9e0452a04ef3ef62e6893d4834853255be0b8cb0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166940, "uuid": "5708fd8a-0703-47a6-8f7b-4b19f941e62a", "value": "01B4220AFB84954AD6831D3212CD23E29EB29EE03D61187754D5B88739F1B4B0F6F289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166940, "uuid": "3b26dd22-3f29-4412-9ef7-b2751464fe6e", "value": "caa5e6a2892587c2324418efee31c648", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166940, "uuid": "448789e7-2ef4-434d-96fb-b06b0eaf984e", "value": "12288:ikxgYHEDFOhUJhsjmUHxGIr8U195uMVSpT9:ikqYHEghFhQIrZ35Ps9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616166940, "uuid": "48695701-5923-4a1f-bbd6-91edab613e90", "value": 533968, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616166940, "uuid": "1700a14a-1e54-4a10-855c-c1cc84c7d21b", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616166940, "uuid": "cee1022c-2fbc-4f21-b61b-725f5f826dbd", "value": "965212c139d8c474ed69ff3c33b88be4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc3461c-8885-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1616139168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139168, "uuid": "173758b3-3228-4c5c-9d7f-3a25f024d861", "comment": "Malware payload (RedLineStealer)", "value": "51c25bee51585d854a99738df9b583aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139168, "uuid": "fa283ceb-2fd7-42ef-8524-1090110e9051", "comment": "Malware payload (RedLineStealer)", "value": "fd38d6e7ee598b9ead8640b414b0251e85b8cdd7c59ee456ea5ef973b476b3ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139168, "uuid": "57e5e80e-141c-4af4-b9a7-35e821b98f01", "comment": "Malware payload (RedLineStealer)", "value": "eab431238b9737f404005a8d24d6b096ae2ebe96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616139168, "uuid": "524dfbe3-e05b-4fad-9b07-d15bc0b3edc6", "comment": "Malware payload (RedLineStealer)", "value": "f8b7dee1cb4294cd1526b5eb4bdf2071eee86c431742cbaad2dbe2faab4b8adb2d0233fc38142dbd8c3b38775eb15d0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139168, "uuid": "2a1a715d-6867-4811-a634-975d867a71dd", "value": "9074BF0CA7E0C034F1B726B0497A9ABCA93A7EB05F2890CF62D517FA56746E09C31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139168, "uuid": "b3e5b3f6-cd66-4124-8259-b7554612d128", "value": "5d17de16c76266fd8d910bc0fc0e437c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139168, "uuid": "16bdb277-4641-4281-a54f-fea937b9d566", "value": "6144:C5aJrdPOTiIFHBKziR5Gpmvm/UQVabDa7c2FiGHb5EOgItftlfmo+8:C5aJrdPOTiIFHBKzcGpWb275FH75lgIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616139168, "uuid": "2b423021-fea4-4049-9dcb-70573b1c559f", "value": 346624, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616139168, "uuid": "fc1939be-ab55-4e6d-879d-9a5e740e1442", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616139168, "uuid": "bfadefb3-c86a-40dd-b423-7791326cf091", "value": "51c25bee51585d854a99738df9b583aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a03cdb27-8880-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1616137159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137159, "uuid": "f4046b49-0741-4cab-8637-d4e8a6ef213b", "comment": "Malware payload (Dridex)", "value": "f535813f4f8949b435e82dc0cfc5f534", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137159, "uuid": "c516994a-828a-4d47-8e3b-b80418a2891e", "comment": "Malware payload (Dridex)", "value": "ff4253a55f56e90c8e83847acd89a94d2b6e351fb090faf8eb297212ff91493a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137159, "uuid": "9df62639-44c1-4ac4-8c90-00c686317085", "comment": "Malware payload (Dridex)", "value": "f50676c1f696a33058b21dac01ec9dad799c5dcb", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1616137159, "uuid": "a93eaed0-1c42-4dd2-a66e-de8de3a1eaa4", "comment": "Malware payload (Dridex)", "value": "05ccdc6976bda37ce284cb2e66172ad43b45443e422d2808565c7a1eafe20786b5638a6c98705293442139ee85b80a12", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137159, "uuid": "90ac68a2-b516-4121-a1a2-5ae51054ba4a", "value": "5C14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137159, "uuid": "044affad-6d13-44d7-85a1-74e955f0f15a", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137159, "uuid": "a0a656e7-ec5e-41e3-98c7-8e59161b9e6a", "value": "3072:N1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:fi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1616137159, "uuid": "9f3ff2d5-09b1-4c28-ad2d-3288b60be7b5", "value": 200704, "object_relation": "size-in-bytes" }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1616137159, "uuid": "2216cdd2-fac0-4add-bcde-3b5427b966d5", "value": "application/x-dosexec", "object_relation": "mime-type" }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1616137159, "uuid": "f31ab5dd-ebe7-442b-88d3-9cd1ab771759", "value": "ff4253a55f56e90c8e83847acd89a94d2b6e351fb090faf8eb297212ff91493a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" } ] } }