{ "Event": { "published": true, "date": "2021-05-05", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-05-05", "timestamp": 1620259382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "2edbc20c-bfdd-4348-90ca-8b57388f4198", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec7805a-adc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234179, "uuid": "a482fc46-6764-4bdd-b4eb-37f5e0501d0d", "comment": "Malware payload (Dridex)", "value": "394f46576ddd0bdf7dcd7d412cabb288", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234179, "uuid": "240eda4f-35cd-4e69-9a8a-288bb349a721", "comment": "Malware payload (Dridex)", "value": "001ebcb205c78981faca566c7fec5b952f7ae6cdd1993818097b34f8397e7a9c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234179, "uuid": "150aac88-15c6-4aa4-9d37-f756b601cb51", "comment": "Malware payload (Dridex)", "value": "51a83328bfb7334d1b2adc7cfb0ed0c499a38b7d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234179, "uuid": "45176311-33f7-4955-a92e-921e984cd125", "comment": "Malware payload (Dridex)", "value": "9454c538b3d4650186e7ea0f404979d4a721b5606083cb02e5c9be027717c75696584f65be25bda78322b7c60d618c71", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234179, "uuid": "cea6fb5d-ffbc-4697-be45-c6a731e970e4", "value": "B0F3C085DBABE87FC44A35399072DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234179, "uuid": "ac0b96b0-9fb6-424a-922e-54c68cef008f", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234179, "uuid": "d09b7a56-f05b-4005-8f0f-769a27aeb201", "value": "3072:Sz45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:K4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234179, "uuid": "f13ac0de-90b7-45dd-a487-4eacec703f88", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234179, "uuid": "c6ea4bc3-59c1-4795-992e-91a7566730f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234179, "uuid": "8b64689c-08f3-4eba-b5e5-cc61e2ea05aa", "value": "394f4657_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f9f6f9-ad57-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1620187485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620187485, "uuid": "ea9b7e3a-54d5-437f-9c9f-62b066a28546", "comment": "Malware payload (njrat)", "value": "2241e06dcdf40cd940e891ce55fea220", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620187485, "uuid": "e41acf0a-7481-48bf-95f6-d3ad0bcb2743", "comment": "Malware payload (njrat)", "value": "0037ef6aea2b179208cd379210224fb863e12100e921a9e3c036ffbdea7e63d2", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620187485, "uuid": "e4281a74-5a94-4668-93c1-b5622236e44f", "comment": "Malware payload (njrat)", "value": "e1c90fd684ca9c943dd33d01671092989e4c0b7a", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620187485, "uuid": "19e013e5-f127-4ddf-bd71-ebb2498249d7", "comment": "Malware payload (njrat)", "value": "838b2f68d89a05494c8a2068318453a7ddf4faa00a131905cc16e78f943543b5c958f57b09471747acc42f7b86f5d8c7", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620187485, "uuid": "4dedf374-ce64-4081-b40c-7d7c4d6499b3", "value": "10242BCE326BD8DBCA6515F43D13C27D87339C7AD142A65A28B2772EE2B117723604D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620187485, "uuid": "6b5a52f2-20f8-4671-b4c3-1a20da8e4bbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620187485, "uuid": "5715da78-98a4-4f22-8aec-8e855c803663", "value": "3072:sgVK/xr+VBFaIqYIYiheeeeeeeeefYDeOWClppeppOpplppepppDppptpppjpppu:N0ZrMBglSOvdiOsRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620187485, "uuid": "72f36a8b-e918-42cc-81a1-261f8fbec67e", "value": 217600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620187485, "uuid": "f0cf1b6b-73ee-4565-9948-b3d5c56545bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620187485, "uuid": "67f6a9ee-987f-48ae-9467-2a3d3f23b291", "value": "SecuriteInfo.com.BackDoor.BladabindiNET.10.4283.4332", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c982b9f-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201748, "uuid": "0b2ec589-97f8-47ec-a2a6-ef5226d902b4", "comment": "Malware payload", "value": "509f4cfb25305b927c606723fe2f6b8b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201748, "uuid": "e20193a7-b010-47cf-b2b4-dbbf474c3b6f", "comment": "Malware payload", "value": "006a6bed71198de86f59e003a891e431d75e47c3a6ead1b612af6c2f896f6e0b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201748, "uuid": "64f78c4f-e675-4ea9-bc4b-8063efbc8791", "comment": "Malware payload", "value": "bd233a21fec15d541446e85c1f4b5af5879e754e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201748, "uuid": "3afd56b9-63bb-4422-a879-6f3ad98f0030", "comment": "Malware payload", "value": "a758441468f151073d2a322ee3fe34622183691c9d4844bd79968d3a5ccb269bf7fde28fcf3bace0a5cf615038c25f82", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201748, "uuid": "ca0b2869-030b-442b-a61a-feb65cdfe6e3", "value": "52D4AD62ABF9D8FECC5582768CC4F6B8C69283769E0D425F0F404095A0FE9D4E3D5E4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201748, "uuid": "0b1966c3-6785-4866-b8c8-2a98a66d2150", "value": "665ca8ef89a5633779c67d062b93bcad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201748, "uuid": "cbd87faa-b17a-4b91-aa13-50d615e6fe62", "value": "12288:rOII1IJfA7gxgYGg9BKPy7zwgIhdKjnPay4qlCtYm9jWylGnTTm:rOIIiJo7+gy9Bnw3/KjnPH/C9h0nTTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201748, "uuid": "5aae5775-0e02-4932-a7f0-92bf9608487d", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201748, "uuid": "2e14b7ca-028e-4dcc-bb23-12ea063b9c1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201748, "uuid": "9eaf850c-b6b7-42eb-96aa-e4297999b082", "value": "509f4cfb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091b4b0f-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241605, "uuid": "0ceba258-91e1-468e-9f50-c87cf7b9b9d7", "comment": "Malware payload", "value": "a6146e1ece3572bd8d5fe54a96f52c9f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241605, "uuid": "49d7dc7c-6273-488f-885b-63f3c9f65b46", "comment": "Malware payload", "value": "007446a281a52618cff06521e2fc536f968349a24cc2189f7acf0b068be38703", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241605, "uuid": "2f6f32d2-8d71-413c-ae1d-9939eba9ed83", "comment": "Malware payload", "value": "1047e57f906cec669b2155ce994f49ef1a3e1e91", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241605, "uuid": "b13d1984-5e90-4573-8584-c8927b54b0e7", "comment": "Malware payload", "value": "179d3074ccaad9a6c877b2adb9d6d0667c603f8a016c10e9ffc2be4842918a39050792cbc549bcde8e9d58fd07514b52", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241605, "uuid": "369ca1f2-d20e-4a29-85c0-6cab0784bae5", "value": "0DF3C085DBABE87FC45A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241605, "uuid": "d8e01c11-6ab2-4eba-b428-85e5d5316176", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241605, "uuid": "60d8397a-41da-4060-a1fa-0975b5a3b62f", "value": "3072:by45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:u4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241605, "uuid": "b74158fb-cc1d-457a-8f8c-90dec42eb85d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241605, "uuid": "2f7d7031-e597-49af-b1d9-4e6994faca6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241605, "uuid": "d0b2e5ae-12ab-461a-b18c-f8713be9a467", "value": "a6146e1e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ca4da28-add6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620242175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242175, "uuid": "04d474fa-ba69-4036-b085-064185936a0a", "comment": "Malware payload (Dridex)", "value": "ec295870d783b6bd8f83cac468acbc08", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242175, "uuid": "c3be12fd-a3cb-44b0-a6b7-a499366682c7", "comment": "Malware payload (Dridex)", "value": "00900190a5618c445c3a5ea22f8f1bcb0df4278d0ec6720437aca26c68c58ce9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242175, "uuid": "e10e9051-86cc-4dbd-af58-c47328e5d57a", "comment": "Malware payload (Dridex)", "value": "8b809c284a35f3ab7d34d73822a4d4f312845736", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242175, "uuid": "d3cf3fb9-8975-4ac9-b82c-7fc5deea0eea", "comment": "Malware payload (Dridex)", "value": "15a6536b79badd4ea379ea0258c362cc44ace34c534ee8b73df6db30be62833ba538180c923b089d4bb089a8860ff13e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242175, "uuid": "08851526-2de7-4de2-87db-cc34c47b12ad", "value": "1EF3C085DBABE87FC45A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242175, "uuid": "e99c9d6b-c0b8-4201-bf70-0e464bdca60c", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242175, "uuid": "6f4b3f87-3cee-4010-87ee-40e7c104fa43", "value": "3072:MB45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:K4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242175, "uuid": "87750262-ce43-4b2a-a93d-553d839b7a32", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242175, "uuid": "7ce09a0f-3656-440f-8401-b2a9ecbe99e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242175, "uuid": "48f07449-a432-4400-85c3-0a0d08bb0be0", "value": "ec295870_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d84baf-adaa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620223526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223526, "uuid": "b5d3116d-758d-4427-a9ea-116d384330a9", "comment": "Malware payload (Dridex)", "value": "c54840ff50531ff95238e4ecc79cecf1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223526, "uuid": "8e59b895-e2c6-471e-8c5c-b6be21a311c5", "comment": "Malware payload (Dridex)", "value": "00a113ae6b63b3ea778446f33660a131a16abd2cca2fea13e443c4741d00f2c6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223526, "uuid": "c25d0e8e-c9c5-4506-8ed7-457de0ae39e3", "comment": "Malware payload (Dridex)", "value": "422039171aba09a5714b19499fd0843008c74f96", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223526, "uuid": "f5c5d295-ffc4-498c-8895-9da03a1d40c7", "comment": "Malware payload (Dridex)", "value": "170de860b0d894724b18dead631213fdb30c34e8235f113d89a9a7394388411e559c05bdbbcbeb02eae50c65ec1fd27d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223526, "uuid": "84bd7dd4-a1c8-4eda-901b-12ca34984e82", "value": "A7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223526, "uuid": "5d2caf03-bf4a-4c76-a8f3-45ed42757d1a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223526, "uuid": "50447bc7-2ae4-4610-8183-33057047d896", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620223526, "uuid": "3afe4bb4-8623-4dad-8c0c-52e86f32b714", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620223526, "uuid": "538c806e-95f2-41c1-bc25-cab3181aa405", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223526, "uuid": "f9a74e41-4a96-40d3-8d54-6f3fdd2241a6", "value": "c54840ff_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5468ec94-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209090, "uuid": "40437e55-86ad-470b-8603-68b8c34b2fc9", "comment": "Malware payload", "value": "47837b5add036162295d59e7fa237eb5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209090, "uuid": "363a6120-9360-442c-9e75-a6678cde12d1", "comment": "Malware payload", "value": "00beed8d57b08ef338064d37a4f143478435633df088db422122654e07cc9693", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209090, "uuid": "6f4a5997-a042-43fb-9029-f1c6c3ae7430", "comment": "Malware payload", "value": "baa7f062c283c298e7b53812a03eb887d4b942d9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209090, "uuid": "97975b8b-26b4-47d5-a1f1-afd402afa522", "comment": "Malware payload", "value": "8da026628d2664a2305aaab4602b8080ecd90f9cd99413fa4e7b0af15ece41b6cd91198fdd3299b261e9fc9da380e726", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209090, "uuid": "be7fddcb-1e7a-4021-82c3-6448266e8b62", "value": "338501A4C621A4B8E955DFF5881D3D81A87EC12FCC566F671AEB6023333A2D4D5397C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209090, "uuid": "f2128c20-82b2-48ab-b94c-3026f1fdd225", "value": "906773854ee31b95e03f915505f52889", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209090, "uuid": "b9da3dc7-059a-4f05-b338-0b75a019b33b", "value": "24576:ei6dSTyT8kV8nsTcgH1xQk85eP8OozA6FjCA51qdw/4p1qyz9D7:r6dS68AXMk8cpoV5CALMw/8Zz9D7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209090, "uuid": "43df593b-0ba2-4ca0-baa6-6a96fd210727", "value": 1723392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209090, "uuid": "10941b74-12bd-4028-8ddd-bab7af1a4763", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209090, "uuid": "97adabc7-6b9e-4bc9-ad09-3c561e9fb2e4", "value": "47837b5a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86a330d4-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212610, "uuid": "f7a96b15-c4b9-4c7e-a13d-a011357ba1c4", "comment": "Malware payload", "value": "f85f4c9430f277c329bc056747f9442b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212610, "uuid": "a870822f-b928-4804-8f89-105bcc9ae47e", "comment": "Malware payload", "value": "00c117931a05cb77d4a92f34b2ddeeb3cebd8b02e24f8ed0f6c56c08fdb9d935", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212610, "uuid": "0f509a07-8d17-4c4b-8661-11d93dd6a4f2", "comment": "Malware payload", "value": "428b2c9f073956eee2b330f848d1cfe2c5a95d7f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212610, "uuid": "18668081-8e5b-4d7d-8ba4-aad7c5d5b9d7", "comment": "Malware payload", "value": "c4d4c37ae7b34b1db49bd58c6789d9d51b0d3d725d074b14a6836f112626d4cdb8303d5b38db4063c5ab4beb627579bc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212610, "uuid": "bd0b4255-e57d-4948-b5ec-5952c2e63ab5", "value": "1B650110C6BB4118ED11BA7DE9359702566ECA6C6C98577A887D7E42C1FC0EBE30B0E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212610, "uuid": "aab5a460-000f-45f1-a2d6-fa4863124f72", "value": "39dde3bb05b5db54ddfeb429b8c2a803", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212610, "uuid": "75c88b79-b8bf-4902-9827-018837afcd22", "value": "24576:2xRtgu89c05XJM5PuxglcDGMq2WPLqneBchE7GfUpy2969RgyXPrXvV+EzKcFaqU:2xRtb8C05XS5PuKmKMq2YL59aXxzzFaf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212610, "uuid": "84dc7552-b222-43a8-8ca2-715aec632f74", "value": 1463808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212610, "uuid": "c040f42e-217b-4edc-bc76-5da9792acffc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212610, "uuid": "df58f236-06ce-4594-a2d3-a59827973701", "value": "f85f4c94_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7eb0ab4-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212746, "uuid": "80fd15d1-49dd-44f5-8404-4a0a6a10e1d3", "comment": "Malware payload", "value": "08d5a04106fa25feb75843614c89b91c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212746, "uuid": "f800a051-489c-4f8e-bcbe-5a57d6087449", "comment": "Malware payload", "value": "00e3d0bea57050c20394ff12199c4a34364dd5afed8c6215ca143a84f3a9d488", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212746, "uuid": "ce0386c2-5444-4bc4-8a48-0f09b99d401f", "comment": "Malware payload", "value": "a08376ad095b6c8a89f9b126383578c87bb04505", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212746, "uuid": "54a9a072-af9e-453e-bb3c-3dd2ed9b70ad", "comment": "Malware payload", "value": "c4d6b6b2a1ac2468e4d793a475a4bf824b0bed6c2589044888f3f33e7ccc43bcfa4b9beb38422ff6ad8ac1080b6594a4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212746, "uuid": "01765288-8b12-466a-bb5b-0f5c3a2fe481", "value": "D682ED267AA659A0E87442F2DD8E5FEBA7303CE65F47120F034C369945B1683ED9E3C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212746, "uuid": "e4178c4b-4ca1-4a1c-b307-bd2980daa0f2", "value": "1e4c0da5737da53aff5e6e0ab7de1efa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212746, "uuid": "2c66c53f-c1cb-4efb-8ae9-3b275999abe9", "value": "384:gF6tkbSUacmZO2Zp+Nye8pqrmub8TyztsDN:gQESUaoKK8o8TyJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212746, "uuid": "9d5333d1-de41-478b-9fbd-92ed1a968326", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212746, "uuid": "0592fa2b-1c87-47c4-ad67-835e041462e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212746, "uuid": "df791dc4-113b-4c58-b2a4-484fefd67c11", "value": "08d5a041_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3262022f-add6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620242104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242104, "uuid": "6fdf652b-f556-4f7e-a036-8dffa0f5d6b2", "comment": "Malware payload (Dridex)", "value": "91900c352d77a02fc9767d6665d11c68", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242104, "uuid": "ae176ae9-b407-4667-8e5a-afbb17e442ec", "comment": "Malware payload (Dridex)", "value": "00e4808b0d16c628e075db1646131728d9d8d44a1a0ef0ebf4fd5f7a7f43dce3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242104, "uuid": "384c7ede-ca12-49fd-8144-bbcde6605a0b", "comment": "Malware payload (Dridex)", "value": "5935aca7a637f0b6131d62e5d59d5be244818fe7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242104, "uuid": "9b10880b-c036-4479-994b-4c3f6c350979", "comment": "Malware payload (Dridex)", "value": "7dff1fd85852a4c89541d25bdc78b63b1b082e05d529151ffd949d4035c31bab214a0426a764f1746e3ce1f13ad9fc89", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242104, "uuid": "ab82a0a4-7e96-42bd-891b-239103a9e07c", "value": "A5F3C085DBABE8BFC45A35399071DFFB5B388B145250C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242104, "uuid": "dda0e857-9c32-4542-a1a6-89d50be61f10", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242104, "uuid": "5189abb3-1434-45f5-b199-7c3f97e78bff", "value": "3072:RB45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:v4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242104, "uuid": "c0ee894b-aa5e-402f-b58f-18c1341e6beb", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242104, "uuid": "f9b5aa6f-a39e-4698-941a-9701cb0d35aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242104, "uuid": "0d85d427-5c1b-44d2-bdc4-c7ac6f637df8", "value": "91900c35_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d72ad5e4-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252259, "uuid": "355f6017-ad97-4cd7-9af4-01d173bb6460", "comment": "Malware payload", "value": "180fec6a44a676c1b571546e5517088c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252259, "uuid": "ab5a1749-4e74-4ea7-841c-be813b95ae96", "comment": "Malware payload", "value": "0118f8189a1553a882b3cf10c599c53f3f1b68069865ce66f36e9be7159caa46", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252259, "uuid": "eafe437a-79a1-4cc8-9bd0-4fbe26df019d", "comment": "Malware payload", "value": "b32c4526f592c4260cf16d86c6985eb7a44e4d3e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252259, "uuid": "1cb777bd-a44d-439b-b950-c99166224f86", "comment": "Malware payload", "value": "67dd30219b0178b6eedac84a2988662089d86a07c9444a025722276f6332287824e90ab5ce395d4230d8878683992a3e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252259, "uuid": "8b175fba-e916-43b5-9533-850011f13353", "value": "F8F3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252259, "uuid": "2c793f14-1fba-4e55-b064-e0104d0be924", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252259, "uuid": "9ca6e35e-2a28-48e2-a659-360e21711579", "value": "3072:g84Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:0DBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252259, "uuid": "33f786de-c134-4f80-bd67-cad04d9e3fc1", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252259, "uuid": "b7ff00bf-5d42-4ad4-a1b6-181d1391c06f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252259, "uuid": "5e01fd1d-a899-4d7f-8675-be5f485fabf5", "value": "180fec6a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "028cac78-adcc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620237729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237729, "uuid": "8e173ae4-da5e-4e13-a61f-ded2dce7deec", "comment": "Malware payload (Dridex)", "value": "a7dbe5879b5fe834bf87b4f7f2c33de8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237729, "uuid": "549a51c2-b0f7-448b-83b5-0d0e33cde572", "comment": "Malware payload (Dridex)", "value": "0167b19195a272d1174ef89236346782b2bdad9ff310de1e8694bbab6b9101b9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237729, "uuid": "67798f67-61dc-4ea9-9f91-96a83357ca3c", "comment": "Malware payload (Dridex)", "value": "e79c581b8579cbc666d0aa5fe49995b6515cf02e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237729, "uuid": "404ecf36-9ddf-4220-aa99-48bd1c6b17ee", "comment": "Malware payload (Dridex)", "value": "1119a00d896d06d1b49f3b1cd79b95fc63787224e22e31cd6e8b02511aacc3ad3ceafdd49f573c667beb8c3fbb2521da", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237729, "uuid": "6482212c-e430-4436-8d0c-2fed1b6401dc", "value": "15F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237729, "uuid": "156ec22a-c242-4423-9435-aa085c9d4a99", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237729, "uuid": "d4362762-aa05-46ec-a3ff-ddef8edb07e5", "value": "3072:tlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:tlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620237729, "uuid": "4902358a-c9b4-4b05-9f25-709dd6680a07", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620237729, "uuid": "3fbf9925-e592-4f35-bfa4-7f4f553d8b32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237729, "uuid": "eee0babd-1b4e-4eca-8df6-91579fae51a4", "value": "a7dbe587_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd29ee9f-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252752, "uuid": "6a2c44ec-b187-4be2-9c4a-4494f2a2bed1", "comment": "Malware payload", "value": "38f6310bb9a32d49527b2dc1f8796453", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252752, "uuid": "e1ea9b72-514c-4c72-9cde-1597669b9e26", "comment": "Malware payload", "value": "01b37def7724731d9a97455b93f41ce5cd63ebb39a2136d8c4615074cd276847", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252752, "uuid": "78ef3d4e-c2bb-4192-b8e5-26d7790e606e", "comment": "Malware payload", "value": "05860e89a0875a4d04fff5945f5060ae07cbb1b7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252752, "uuid": "8ecf9290-cedc-41f7-a8d9-fdeabb366873", "comment": "Malware payload", "value": "2c65315b8da0e0ba302511704108ef85514042b76b83045b089c33f73b6ff50a6414b64f0c3d129a7e9639c24acc4639", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252752, "uuid": "0227f509-8bab-4113-ab5c-2f988551728d", "value": "4BF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252752, "uuid": "40aa7d2e-3bcb-4128-aaef-e7d8be36dea4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252752, "uuid": "0d3b2b8b-9b80-43d4-b9b4-5ee9236d9c91", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252752, "uuid": "a5eaea85-0550-484f-b39c-9c9f79dd2133", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252752, "uuid": "cac01143-6fe0-43f5-8bee-e23517af5e2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252752, "uuid": "cfeba893-091c-41a1-8d0b-fc73af874dd9", "value": "38f6310b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb2e9bd-adb6-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620228436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228436, "uuid": "d3aefe87-2b29-4784-be2c-97a6eaf9d959", "comment": "Malware payload (AgentTesla)", "value": "97e096b2ce1ae63bbcddb2fc79678f78", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228436, "uuid": "ef57abc4-2dfb-4d93-ab6f-a7d9ac77a1e5", "comment": "Malware payload (AgentTesla)", "value": "01b3e5b869fb8df0e432b5e8fc6089bcb8a571ca39c5156bf4149698ba5ab05a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228436, "uuid": "a0c80057-79e0-4e0d-acd3-f12a0cfd827a", "comment": "Malware payload (AgentTesla)", "value": "a50a633ebe35a0fb2908af8998f655a335357915", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228436, "uuid": "8ef25005-7eaf-452a-b896-2a181b892c43", "comment": "Malware payload (AgentTesla)", "value": "2f9fcf2a0eaf4e4b9c398e320ec4b1e8c60e396f058c7c3f395cf8c3b1eae0f8bf8963ecfc303dbe015e6b3987790d51", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228436, "uuid": "f9d600fa-d1a5-464e-b725-c057e4750cc3", "value": "D105027C13898795CC2F477C2878C1042BF1B63AD6B3E71AAFD076772AB77918621252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228436, "uuid": "68c94d2d-0cfd-484d-af2a-c748a1f6e945", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228436, "uuid": "f4fa1c52-a2a4-4545-84e4-8a07cdf92f5f", "value": "12288:DmtkfS3KJrPqydOVgTk3mMC2qMYA9NOHIIdkDwMG5hJuW6Wm0Tg/KX+r90P/9M:zFqpIk3shMr9NO6DGLJd3mD/KXw0P/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620228436, "uuid": "93f665f8-1b15-4858-9827-0e5cee5743ff", "value": 812544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620228436, "uuid": "e79a5e8f-0467-43b3-b7e4-73f73fa84d9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228436, "uuid": "0f93ceb3-9409-456b-8417-f2dc19657123", "value": "Spare Parts (KITO).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d2f5154-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201884, "uuid": "8f591a2c-8177-446f-98a0-d287723a80e9", "comment": "Malware payload", "value": "c0ff39016aed7357ee07f38834c604cf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201884, "uuid": "34fed072-bc6a-4f53-a028-4ac9d27c84b8", "comment": "Malware payload", "value": "01b660c91e227a817722d8253374b0e0e535106f116d58c9e7bc74905a6856dd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201884, "uuid": "458177d9-d6d1-40ea-b4fd-017de20532b8", "comment": "Malware payload", "value": "fe21b490494622148b62819a512cff5196fa90df", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201884, "uuid": "01692dac-2351-412f-8266-d801007b419a", "comment": "Malware payload", "value": "6295d01a5c835ba2bb202e9391a972c419b6722e119cc789a776968704ffae37e9aec35d4f6ce2432607877459bcd8b7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201884, "uuid": "e055040d-300d-4eef-b083-da7cbdd6f62d", "value": "F1D4E1229D88F0A4CE71FA7D36EA7347B33EF01A04C625A6F351D64FAC6FA005198D59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201884, "uuid": "ce059253-7aac-47cc-983f-9a7fea81ab65", "value": "97244161407221e861251a2f39cd3865", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201884, "uuid": "12736796-e4d3-4345-ab03-6b71a461bdae", "value": "12288:P74e+qBjGp1zIOMbyEWXW5qGE0s+BIRBSFm/8gcIMN:zPhMp1zCBIAtIggcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201884, "uuid": "107c2c39-41eb-4258-b8e1-6d337f5042a1", "value": 634368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201884, "uuid": "d035a7fb-3403-4d15-b1ec-096fb4ae50f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201884, "uuid": "1a7436ab-a831-459c-96b4-0bc501358ca5", "value": "c0ff3901_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd00d442-ad80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205507, "uuid": "a2e71b7e-f64a-478a-beb0-b6d6d97e3387", "comment": "Malware payload", "value": "c3eef96a62e4a8df4fc9f41c8af506b0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205507, "uuid": "3642d5a5-ea9b-4108-9b6d-a69dc6208a22", "comment": "Malware payload", "value": "01bbf31428af55549e5e6fc68a67acf2b2dd61a31021f56c961ba9139f5a6a27", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205507, "uuid": "d3c14369-aca7-4de8-ae87-0e0c83ee1b79", "comment": "Malware payload", "value": "c3483c69858e64daa37c4a5c88d03fffe0b71e90", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205507, "uuid": "3a65377a-1256-484e-af8e-c67585f81186", "comment": "Malware payload", "value": "11af212f02675e1838804a4d35d18acfdcc41f2b86ba9513203ff09d56ecf340245ec3a86111612118d864bfa3ece639", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205507, "uuid": "e1765c7f-0ab5-4b02-bb7d-78b88f56cf29", "value": "DA5501014B9A03AAF82DC63254E8FB84F580395FE263F56F9FC401FF579053D62A8996", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205507, "uuid": "b1f5d2db-190a-43b3-b639-8acf06cb0701", "value": "8e90823fbd74899b0a74b95fd8b3dd37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205507, "uuid": "74664fa3-f0f8-4f60-8d9a-504534b81ed4", "value": "24576:GCxBI39s/cD5JP8LLBJ5Nc4EgI0EEl8PEU6WAiEc5MRrNJ:BBI3C+PQLBJ5sg/EqUEU6ddciRrNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205507, "uuid": "5cd45ef2-e075-4e08-a3c1-47bc7d148e33", "value": 1335296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205507, "uuid": "af689a42-0e69-41a0-8419-c715b2204921", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205507, "uuid": "93ac64ce-b4e3-4a85-840b-4b004d5305ed", "value": "c3eef96a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed679a3-ad87-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208490, "uuid": "0871a331-d4e8-45c6-82bf-30f6b8ae1fc5", "comment": "Malware payload", "value": "e1c4004030117dbfad7242bcbeaaa5f0", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208490, "uuid": "f940982b-2fcf-47db-bf15-9a39bc335c6d", "comment": "Malware payload", "value": "021c4350c35e43c6d9bd9eafa3b89aee3957676ca32befe2e9d6ed2498bba5db", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208490, "uuid": "7f1ab7dd-11f2-4926-897f-42483bcd42d9", "comment": "Malware payload", "value": "167d80486197d38ab8de29c909a5d29ef939cced", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208490, "uuid": "1d0e9cdf-d36f-491b-9f7e-16de9a6ca737", "comment": "Malware payload", "value": "afcfc00aabdf3e262d24d1e41dfeab07cb367537c5bc9daa38444d0e6dc0f5bd23b6ed53961d389cf3289a20b7bec0b8", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208490, "uuid": "fbe0e805-5999-4ef0-80a0-e55671bd3702", "value": "FEA1F750112C1AB17246697AD26FFB52B80EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208490, "uuid": "76a4e82a-929d-4788-b97b-96f5aca7e33f", "value": "96:sRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:sRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208490, "uuid": "8428fd8a-756b-432e-bc7c-6b0b42b9f02a", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208490, "uuid": "282a7544-e203-487b-8c2e-6f9a184c3094", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208490, "uuid": "1768b27a-a029-411e-abd4-fb76b53f73ed", "value": "021c4350c35e43c6d9bd9eafa3b89aee3957676ca32befe2e9d6ed2498bba5db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d2cc589-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252135, "uuid": "d2362833-20e8-4c16-8bc0-36347e4affba", "comment": "Malware payload", "value": "03686e5add22aecb0eb7164ff61fdee1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252135, "uuid": "c72f6cd9-12b4-4c12-a888-4cf0fe99e313", "comment": "Malware payload", "value": "022c7ea2229b25baf170c6ac324fdbf0fb1bdb26e6a70a7cfd30ff30ef118e66", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252135, "uuid": "50acc4bc-1c20-48cc-b1e8-1a2f518478a8", "comment": "Malware payload", "value": "9d7df1e8f630bc608f919c09356db8e71651fdc6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252135, "uuid": "d5b9f1a9-d4e3-4488-8049-4a7c2bdfa6e7", "comment": "Malware payload", "value": "f91ef3e957c92d758d3c2a81ad086a282846f767e023bf496d92cff0c85640de5f6cd067cc61ceac37b57442f0bfe414", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252135, "uuid": "6df07416-0ca4-452a-bbbf-a3fb6fa8e9f5", "value": "D9F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252135, "uuid": "e971b40a-2344-4ea3-b6d2-12dd35eb9bcc", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252135, "uuid": "58b1e4cb-8502-4333-a152-873e9fec83f1", "value": "3072:Ox45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:k4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252135, "uuid": "5a0a93fe-4628-4df9-93f7-3f92beda7895", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252135, "uuid": "3bad1d8e-8218-4ff1-aee9-4d62ab17f629", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252135, "uuid": "0d10f736-8313-48c0-855b-b1632e0a296a", "value": "03686e5a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe474088-ada4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620220971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620220971, "uuid": "fffe1e29-2b18-41dd-9e8a-748de1325ea2", "comment": "Malware payload (Quakbot)", "value": "6d479eb76198ae12bd76ce4173cedc52", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620220971, "uuid": "57071222-5a2e-478e-aa06-31d65ed2fbbb", "comment": "Malware payload (Quakbot)", "value": "023c1c23b7560d03076bec4c717a1cc690e3538541228de0adc40421493d974d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620220971, "uuid": "8339bc0a-f761-4fd5-bab2-2296fa265f79", "comment": "Malware payload (Quakbot)", "value": "9524e0e5c16b282a0b8e6312173efe4838d0681d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620220971, "uuid": "b613c0d0-4f40-4105-9ca4-61bb1ccca070", "comment": "Malware payload (Quakbot)", "value": "e4064ef23797d24908988a31b97055ee99da860c145e60ec383f1a7bb7575224f369e12f6ce43e68278812ccfc323894", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620220971, "uuid": "f29ffc4f-4bed-46db-837b-cd54758c8fa6", "value": "D2A4BF7CFF668973E1142FF1A3C35F940A53A9D175A0610E42B11F6E3DA93D5383AA88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620220971, "uuid": "183154d9-dc6a-4d4f-b193-ad86a741f411", "value": "d4b10803acf444b49f2549bbf867a9f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620220971, "uuid": "47a7966a-286f-4f6a-9e24-d0abbcfd704f", "value": "6144:U0LcdcjuQ/9zoaV3EeVHq/Ca6VbrdRNXh:njuS9zoadEYHq/CjtNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620220971, "uuid": "8a0a1b21-af1d-4be1-be7a-a32af8fc20de", "value": 472075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620220971, "uuid": "7fb640cd-1a7d-4d9d-9e8b-a5bb5c8fbfa8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620220971, "uuid": "39442e91-c720-4fc5-b6e2-50e307c63009", "value": "6d479eb76198ae12bd76ce4173cedc52.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aada7f1a-ad80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205369, "uuid": "17d4223f-e937-4673-873b-30237501f984", "comment": "Malware payload", "value": "c5be5a666069fd3e13e30814a8ad7446", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205369, "uuid": "99ca18a4-7a04-4cbc-8fd2-f9a4b12f93e0", "comment": "Malware payload", "value": "0244fa4697c12a48d976049ff02bb024a9ed7435db048c2bb29f2b3b34d0fb07", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205369, "uuid": "3ea5a48b-257f-4a72-be06-ea5b362e06a8", "comment": "Malware payload", "value": "6df358e6fa3cc97a191d06f185870fd0a1ab2f9d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205369, "uuid": "abb51db8-0b8f-4c49-adca-df96307f278c", "comment": "Malware payload", "value": "7d5e49ced48c88f0ad2e38bf237cf5884c42130d2c90e56989b7bc88eb97f310b1eaa3748f93918ddbb40d78c10b147e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205369, "uuid": "d1982df4-5321-4fb0-9fb7-f995b7452214", "value": "86D4CFDF1EA4E490CE19113C077870F37D3FE937A971445867EB6229B2A9E2210B6D9C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205369, "uuid": "f71cbb81-28d9-4f3e-a62f-417b63e7360c", "value": "fe3dec88c2f232516d1104ea13a974eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205369, "uuid": "330c1d34-9c2c-40f8-b5f0-5b224e2a3eb6", "value": "12288:BCDhlHrVsA6AQ95BymzpqpJIOxxyVgCUOfGGSxja10lkq/Op57:BCD16AQAmzpqgOuqCU2GXxeGlkq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205369, "uuid": "704258ff-7577-4ae4-b576-cd8947dc5ef8", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205369, "uuid": "7d58d59f-e990-4999-94a1-a9a6ff70657f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205369, "uuid": "cb3ccd8c-6924-4185-8a41-769b6b40aebc", "value": "c5be5a66_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "271636e8-add4-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620241226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241226, "uuid": "e2f8eea6-68a9-4a1e-a71e-5099cbbe3bd8", "comment": "Malware payload (RemcosRAT)", "value": "9f7ef650ee32895e313edc085fbc29f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241226, "uuid": "34b6ff9d-0bba-45c1-86b8-7dcf21ace4d0", "comment": "Malware payload (RemcosRAT)", "value": "02650bdf290724edd38abc7e303ff74ca1fc7fba26f3f0dcead22cdce5b9b3fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241226, "uuid": "791e5844-5b17-4f25-894b-19d5242c9cfe", "comment": "Malware payload (RemcosRAT)", "value": "bcde3f8d90c9b0d3ad79785f77a089003260fedc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241226, "uuid": "e44825c8-ac36-4500-aa19-00915a162b39", "comment": "Malware payload (RemcosRAT)", "value": "91b8b086feedb7573aeb36b79831fa2f09f4befc16500a609e4600a30769976ac513ba61ea1e97c8649c7db220cffe30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241226, "uuid": "e6be1adb-993f-4858-88b4-5137199e9493", "value": "53A4AE12B592C032C17251701D29F7B59AFCBD202A7595BB73EA1D6BBF700C0B72A663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241226, "uuid": "7f150f18-542b-4b47-9e16-bc308e94459c", "value": "409f5d6d64eccf1b9873a7c796c3f1ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241226, "uuid": "f45b30f5-6cdf-4fdb-8b65-7a786abe19a5", "value": "12288:chm96YXGL474/CQNqBrsX9RiT/Z8At/e:Z8GGL4U/KsX9KZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241226, "uuid": "dbfd86ca-e53c-4570-9e3f-afee32d0ae12", "value": 466432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241226, "uuid": "16bcdde5-0d5d-417c-8ad9-5f4377d8a67a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241226, "uuid": "082245cd-dc8d-4979-ad9c-36ce6b1cfae7", "value": "9f7ef650ee32895e313edc085fbc29f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a46fc2a-adb6-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1620228454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228454, "uuid": "718d6cd6-d110-4e5a-93fb-4be26031a956", "comment": "Malware payload (AveMariaRAT)", "value": "cf3e6f4dd1b47b5e9f09f9b1165bb519", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228454, "uuid": "98e5548b-53b3-4f13-86f4-a5b5573ccf96", "comment": "Malware payload (AveMariaRAT)", "value": "0288f149c280ae5dc3a27ab06b9cfc41582635226b9759e1aebe4d3e641074b4", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228454, "uuid": "e59018fa-ca16-4a1e-8114-a7c73a6c4f1d", "comment": "Malware payload (AveMariaRAT)", "value": "68a1a10ad6b7eaa3d95b7eabefb53097cd44845f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228454, "uuid": "a2016d3d-c6b3-43d1-a80a-0d7b6c78a99f", "comment": "Malware payload (AveMariaRAT)", "value": "1b9fd129967b17b973cd04a985161b711aa22808854d25b02a9b9096f4e01b19d916a4364915fab84b7f0fd89292681b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228454, "uuid": "059a2a0b-6568-4911-b9d8-39b6f9ed47e7", "value": "3E1526F41A04D921F717063AA1387000017E9D9B566EE68D9BB0BBFA8AF3FC5197C52D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228454, "uuid": "8ae8fa51-2656-4591-ab4f-28b7470955e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228454, "uuid": "43d9d994-8be3-4d2f-92ab-9eeb299a31af", "value": "12288:bmtkfg35Wg9NPz6ryZi71XR94oZguc0vgfB7Yd/oe5lSC9QV12YAVVKq90MkBlKN:qTPz9Zij2Tx0IfVYieSC9dYATr90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620228454, "uuid": "bd2da250-93ff-4a41-818e-0fe7f025b947", "value": 941056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620228454, "uuid": "02b8618f-c764-48ed-89c1-a2016949a9f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228454, "uuid": "49a8cb09-ba55-4637-a990-6c370037cb2e", "value": "SCB_MT103_31951R2105050031_200505.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff51b144-ad9e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620218396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620218396, "uuid": "49c7ecec-42c8-4bbb-91a2-9457ad6499fb", "comment": "Malware payload", "value": "c996d7971c49252c582171d9380360f2", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620218396, "uuid": "d2f62ad4-4dc7-49c0-bb44-30a4df9da41f", "comment": "Malware payload", "value": "0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620218396, "uuid": "939cc871-3b80-4b90-969a-d01ef9a16167", "comment": "Malware payload", "value": "c948ae14761095e4d76b55d9de86412258be7afd", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620218396, "uuid": "02001c83-edb7-4223-b7b3-ef95b0732b76", "comment": "Malware payload", "value": "b2f1ca6988a0c378167dbb3a580788a8ea190786376343774813fe07cff48ed9d1c3f98e25ee6985fde8f3d0f9cb4b26", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620218396, "uuid": "eea8f6b1-110c-41ea-90a5-b574f6b9639e", "value": "0462E7C746306865DC8BCA36D1DAD577AEB2F2946FA151C71120C0BA2D47BF02B7D40E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620218396, "uuid": "57811a57-7a03-4eab-b687-70a2f26ca810", "value": "473c3773ca11aa7371dbf350919c5724", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620218396, "uuid": "d69727eb-7df4-46be-a42e-c4e25263c2c4", "value": "192:QGkygXkI925h0rx/jPdQUorjs/6gfyowJL/aMjGwP7eMa8Ep+ebMwfPZgjlJMSJ:hkyg0I9+0rljPaNI6iYJLWWEfbHH6jV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620218396, "uuid": "377dfcd5-ca5a-4ec7-940e-e8b736d93cb0", "value": 14840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620218396, "uuid": "b70b57ca-5326-4a12-a81e-d0a2f7629f34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620218396, "uuid": "2b91c68f-f9a0-4146-afe0-835adf89f4fb", "value": "0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40415bca-adf6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255871, "uuid": "e91587ab-32f3-46c6-a6d9-1a92ec3942aa", "comment": "Malware payload", "value": "a6d3966fc039b72fa6d75c7f1d621f64", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255871, "uuid": "d3ab6610-8a75-4744-9508-cd2c0c544ae8", "comment": "Malware payload", "value": "02ac2b575ccc8434fb380fa2916dbe6db00d818209fd28ed685aef3b5797ef7a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255871, "uuid": "dc663b0c-3603-48cc-8a54-415cd680e3d6", "comment": "Malware payload", "value": "5837855eadb221ac151b25f283f0de04833bfa1e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255871, "uuid": "71b9216f-9609-447f-8497-df0d08ea37aa", "comment": "Malware payload", "value": "a75e47c8b58a617dba260097da98c31eb431295b912c07ba63a6e84f96970bcae254fe6ac198c3c44dc9f65988ed52f3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255871, "uuid": "6f2c95a5-a017-4db0-901e-1dd21daccb8e", "value": "33F3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255871, "uuid": "14efc587-0a8f-4291-bf67-119b5fe97fa6", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255871, "uuid": "200d0f59-220a-43a6-b24a-faa4623814ec", "value": "3072:C84Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:+DBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255871, "uuid": "50508fd0-1b03-429d-8775-889b5d73af8f", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255871, "uuid": "0cccab34-4b41-44b4-b7c3-41e25f87762b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255871, "uuid": "8f93424c-a243-4084-8a76-4fae8e47649f", "value": "a6d3966f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e9bf11-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201823, "uuid": "b1d4e8c5-8038-41c2-8607-11172a76e17c", "comment": "Malware payload", "value": "a155a2d60fc255aea3854d75443422d1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201823, "uuid": "84eb203d-a11d-41b4-b3ca-de29e65bbc3d", "comment": "Malware payload", "value": "02c295951551d06d573f8631d699d5ce0a1170591fe4e2700754c2bdf8556be7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201823, "uuid": "65136ca3-ebdf-4dcc-948b-7fb310185728", "comment": "Malware payload", "value": "b600b1025243ca7bda469f3afd44b86a399884e8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201823, "uuid": "408baf90-f331-47de-af4f-5f4ac4cfb2f9", "comment": "Malware payload", "value": "872aaed29b537d88a2a77b263a7192a6f684d3c3a1f8a7071bc1448c7ff230d609ff29c66f1cb9830b4fc41a3904e446", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201823, "uuid": "86065bf7-0218-43ab-ba87-ad7d6174fed1", "value": "9E25AED2C458630EE6EFD530135C8BDE38AC05D1EF929F36D42828B3D5AE66972DD248", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201823, "uuid": "60c381c8-82d3-45ae-a3fe-ae147a4313de", "value": "aad46e769f3bad92264cd829ef594025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201823, "uuid": "f475e26f-3c86-409d-9e8d-db40945bbfdb", "value": "12288:3IFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFnJe6+GQOikxBtUT7HetJ8SVSN+kDxyD:3WJe69Qdk1aHi81+kFy3JJC3V13Q5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201823, "uuid": "b564fd9e-280e-43a9-bfe4-d7777a44c81a", "value": 963072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201823, "uuid": "b0618bed-2ba3-41d5-920c-1bbae969fde5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201823, "uuid": "14717ebe-42f9-457f-8b06-682f327e684f", "value": "a155a2d6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd84fd5-ad99-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620216246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216246, "uuid": "9d32a76e-1450-47e1-a046-ae9f148225f3", "comment": "Malware payload (Dridex)", "value": "b3d03263ac709c2cb53ea9d1a679129d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216246, "uuid": "692e5ab8-6bc0-4822-b918-7057bf15876c", "comment": "Malware payload (Dridex)", "value": "02d10374c13b2d851e109236f09f342ca0152a61a56f99afb8df8e78134851bd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216246, "uuid": "9bf36639-eed0-4c58-acbe-9f3424abd44a", "comment": "Malware payload (Dridex)", "value": "6c01eaecf090719182d3552436801b0b8b5fc423", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216246, "uuid": "57a48e6b-ae47-4108-aebf-6ef94e5857ac", "comment": "Malware payload (Dridex)", "value": "4e1474439a25e8ad55d2099f040885100c3ab6877a84c1f098143ad3e8ff2f8fe3868d95dfb81a5dda5b386986c7179b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216246, "uuid": "3ca15175-d166-400a-af5e-b825dea4d39d", "value": "AEF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216246, "uuid": "e7e35ff1-f34b-4dbf-9cae-30be87fa9799", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216246, "uuid": "dc47cfaf-ec44-4bad-bbe7-01f6d60abf26", "value": "3072:miFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:deAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620216246, "uuid": "a35c2b16-5026-4585-b14a-265faa246848", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620216246, "uuid": "2115693d-4e6a-4742-8e32-7cb2710ed19e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216246, "uuid": "621cf7a2-1812-4229-a17a-8d003c88c1fa", "value": "b3d03263_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a874c03-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252560, "uuid": "444082b2-29ce-46f9-a374-cab1c6a3945f", "comment": "Malware payload", "value": "c3c86965ee13e19d200d541f5c21b94a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252560, "uuid": "436afd4b-12fb-415f-99dc-5a8a432c754e", "comment": "Malware payload", "value": "02d3e4171a3252043c75acad1811fbb57adc0d229af40e4f4004b2e01958d7db", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252560, "uuid": "949cc1e2-7c11-4f1d-a08b-bde2c4c7537a", "comment": "Malware payload", "value": "99aef824380a0dd4f5f8810f5ac7c816977f129a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252560, "uuid": "19ffa7ad-ce8d-44a1-abd5-cf61a1ae4d79", "comment": "Malware payload", "value": "2b9bb8deefb0cc567a1894de1d436c04e58ed1d00bbc6305ce994b429680e5667accb57878ccb986cde8ca21e1a1c70c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252560, "uuid": "56d5c555-b056-4473-9d70-a08d4eb5b5d1", "value": "4EF3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B120856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252560, "uuid": "a1756606-b47d-4e41-b487-ccf73ca9573d", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252560, "uuid": "2272558c-6910-4164-8f6e-f4ddbb03ff97", "value": "3072:RL45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:R4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252560, "uuid": "364a3bff-4160-4ff1-a894-bb7ba24004bc", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252560, "uuid": "9a725c52-c730-46d9-9e84-5189b663545b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252560, "uuid": "f30c6b87-2f47-4d69-b63c-f311dcd86755", "value": "c3c86965_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243eb647-add6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620242080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242080, "uuid": "188072dc-a137-4f1a-94d0-ec0c45a701f8", "comment": "Malware payload", "value": "345f9c7882833fbcfd569ca6cc4786cc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242080, "uuid": "cc3b4b37-661a-4ba4-90cb-23998e92b452", "comment": "Malware payload", "value": "02e0a614ca97f3cf4815510dff091ada8a5cd88c5bc974b1f98670b3784de6a0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242080, "uuid": "a1226c11-dfd8-4fa8-b9f6-96d881282eb1", "comment": "Malware payload", "value": "583d777e5701df3442a1aea1abf760f7a45dbbfb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242080, "uuid": "c2f0163e-66e1-4013-a241-a34945129493", "comment": "Malware payload", "value": "d521e6952899cce1f915dbe5e78594c87ce257a3e031d5fdee7310d14d77a905fb75d8d9264e93e19ad89d8f20720a4b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242080, "uuid": "4a8ac716-9c40-4a78-9afc-a285728fbc13", "value": "CBF3C085DBABE87FC44A35399071DFFB5B388B145250C870EB6969EFCA07B110856883", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242080, "uuid": "9f64a1d6-266d-4bb0-82ea-bee6591a9f0a", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242080, "uuid": "91da3cc1-1e5f-47f2-9569-63bd097e15f5", "value": "3072:pu45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:44KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242080, "uuid": "326658fb-b9bf-47d9-bb89-7d01b16fa4f9", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242080, "uuid": "164e5867-5a70-4e82-83c2-4b1b4e4f0994", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242080, "uuid": "ebeaf2a9-e274-4da8-9dd1-bc54a22bfc61", "value": "345f9c78_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb081742-adcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620237689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237689, "uuid": "865a1fef-5dbc-45b7-9f6c-72cdc33d0754", "comment": "Malware payload (Dridex)", "value": "03065df8f6cf2141da5e316b6fa79d3a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237689, "uuid": "577e8e6f-bb48-4e0c-8d31-44b7fd338cf7", "comment": "Malware payload (Dridex)", "value": "02e84ef9332ad97bf4a056025b4a38532e58f87cdbb807b33f6ef2a7dffb7963", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237689, "uuid": "b60673af-e344-486c-b0ae-eaae61d16119", "comment": "Malware payload (Dridex)", "value": "551c51315e07b6c22c917a9a5ad6415f9c4f0d24", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237689, "uuid": "20524b94-4dc7-4161-8ad8-688249dcd4cf", "comment": "Malware payload (Dridex)", "value": "a7f64c4b6d50199b9d232ccf1d95f086f005fd116e62f62955a735fb2b50a027a2f9fb61c70391dda4f3d21050451962", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237689, "uuid": "98dcce17-0e6a-49a2-a685-9b3b00992189", "value": "E3F3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237689, "uuid": "30ff6436-aa36-40ed-bf70-9c33f1b4ed3d", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237689, "uuid": "e0145833-e0e5-47ee-a4b0-aef5fb25ac60", "value": "3072:RWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:R42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620237689, "uuid": "ae1a3529-cbda-4aca-9ac4-18ac5e8cd005", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620237689, "uuid": "6c37988a-f459-4f21-873b-b90fdbd39b53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237689, "uuid": "d6c0bdb5-33b9-4d07-81b5-9103cbc5c699", "value": "03065df8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa563e0-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252721, "uuid": "76d52b53-20a6-493a-ae8c-3d187599f9ab", "comment": "Malware payload", "value": "7915ab37f84f9fac76745b929c141fb2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252721, "uuid": "7241c1ed-0158-498f-87dc-469b19b48c6a", "comment": "Malware payload", "value": "02eefdd41affa648c335f72e84309dc1ab83dd9a7d6ec312c28c71699a7f0f5d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252721, "uuid": "a6c300e1-f8b2-4647-ad02-5a060daa0456", "comment": "Malware payload", "value": "0047ed1a6e7d9d21575c6f2059bc0c2432aeaba8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252721, "uuid": "10be52e5-0a28-450c-8739-e571998c767c", "comment": "Malware payload", "value": "b8046d6e15a4fcbf2b22cef42fbeca5861610e735b29965f7b831af264a3a1d9c13fa7a231677d51993586ad15eaa521", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252721, "uuid": "51260e80-69b7-493f-a232-8a196dfac7cd", "value": "ACF3C085DBABE87FC44A35399472DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252721, "uuid": "62d52869-cc11-454b-92ae-9645fdcdecb6", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252721, "uuid": "9abe001e-b9bd-452f-855b-e3c8b138e968", "value": "3072:9L45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:94KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252721, "uuid": "6ec21e18-2274-4b79-ae2a-ea71b27aaf60", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252721, "uuid": "925c29dc-3072-403d-aca4-e0689ed52dde", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252721, "uuid": "a96b6809-a7f4-46ad-b741-488f79910da0", "value": "7915ab37_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff3f3fa9-ad80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205511, "uuid": "5eda8856-d8f4-4fc4-ae43-2f1d87d1bf9e", "comment": "Malware payload", "value": "9ac3ab1817ffdf514ab6fca983f56af1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205511, "uuid": "4074b548-1160-4b89-9acd-dc6ae82efa65", "comment": "Malware payload", "value": "03252f0d19d2cbf74a06fdc69cd16f80c3329b47400310c70253ff0d31dc1efa", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205511, "uuid": "db234b56-7d17-4f45-8313-56aa14be7b47", "comment": "Malware payload", "value": "5e7fabcb72c6d8d07446705bd29aa20341f0eaf6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205511, "uuid": "c8831635-3fc2-47bf-9cef-27dc7c6b6fb0", "comment": "Malware payload", "value": "6a66c368c4424d1361d52021bb2ed0373cf634d679031b0e7e3ce05ac38fb7278e8e910625ff2f9efac4232ca8ba811f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205511, "uuid": "2055c0d3-b6c7-439a-ba80-48ede80d3390", "value": "14F4BE2D4190B68DFCAA99BFEE0460A9F197841A4C86C543CECBD6227C7D5832F2C57D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205511, "uuid": "7c080647-f003-42ba-9a16-d3713557621f", "value": "abfef6d1e987aa678a319491f1016598", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205511, "uuid": "15a5bb4b-cd10-43e3-be37-3af174e0795d", "value": "12288:BKyPU09gsMc/qxXcCuxK+3ODgWWdk0fpSPcO5t1rE0zTtCfRAHTm:BTUQRP/QsCMXBSEO9rDzhPHTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205511, "uuid": "af7095cd-2c9d-4897-b3a5-5dbc1d74b6a4", "value": 772608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205511, "uuid": "fb97d106-df9c-431a-a8eb-ca890ce895b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205511, "uuid": "242d9919-603d-4756-ae61-82408e264461", "value": "9ac3ab18_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70610015-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1620212573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212573, "uuid": "0ab40522-0a89-43a6-a91f-33a18c4dd5e7", "comment": "Malware payload (TrickBot)", "value": "39adf6ecdd71f0d727e79205c71a62cb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212573, "uuid": "d64e853e-3388-46a6-b2dc-00d18a478bb0", "comment": "Malware payload (TrickBot)", "value": "0352835fa00f51dc22097204f150bf7d48fd678bd7e4b7d0c3cc968009efa38d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212573, "uuid": "46807e99-e5f2-4ca9-a612-19a91995bc66", "comment": "Malware payload (TrickBot)", "value": "c52f4df420684f27160cf252ac736c32dfdf789e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212573, "uuid": "b2c2389a-79bc-4126-81e9-620623ced655", "comment": "Malware payload (TrickBot)", "value": "c92d45ff8248d5592adecffa01cb3f73e3e240c4005d737928d7db21108ff0c35f84c6482b22e900ba43818844224849", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212573, "uuid": "cd252d46-b1de-4ca9-99f7-e01c0181d7a8", "value": "2A8423A832E36B4B9BF86019D2B5CA7C56184999957AF4A1F5A34C10F430F847F8FC2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212573, "uuid": "f990c8a9-e3b3-4b00-b4be-598c24dd4283", "value": "6144:YeAVU6ry9EnKrVi2y+qcWnmwyqDZWh/6GRWUFUEEZtFSFISpUcvD4huFs6+iKZVz:ReU6N2kC8Byq4h/68vE1ENahuFsffoYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212573, "uuid": "ea0693e9-3f69-4b08-92cf-fe7e2928933e", "value": 383820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212573, "uuid": "9a876363-e90e-4400-a1d3-e02fc5033d71", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212573, "uuid": "61b11285-a558-4813-8df9-637797d21266", "value": "39adf6ec_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e86ce1ce-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620202037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202037, "uuid": "34fdcdb8-e221-4c20-9ad5-9b3b542a2274", "comment": "Malware payload", "value": "7c986ab5d46078154d0d302dc5360f62", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202037, "uuid": "7078929b-4345-43f7-9201-ef59ed1fc7a6", "comment": "Malware payload", "value": "03745fbf91cf67f1c079704524ed1b5064fc3e067083e33a9cc1655a3748ee2a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202037, "uuid": "ae063710-9f3f-478d-aada-efd3107b3e9c", "comment": "Malware payload", "value": "f63de1f674ba6b467adf4e5dc74409e8780c9a1d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202037, "uuid": "4cb5ae71-bf19-4cbc-8f06-21a8a7c0912c", "comment": "Malware payload", "value": "fbde7dae38e9efc0c70f8e2da5c1d0eeb9a5ccc2c3967fc6c5d78ecf6f7fdb7211159c4dbe82a76b30eb149b1b769bc1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202037, "uuid": "125cbb30-4db1-4aee-b66c-e0717aa8b28d", "value": "A1257D2AF7C08837D2631A38CD5B9768AC26BE503E2955463BF81D4C5F79381392A3D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202037, "uuid": "985740c2-8d07-49e1-af6b-97414d17ac11", "value": "26496ab6355e75472c49cf2dc4f6cc6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202037, "uuid": "ae5c2ec8-3008-4c10-a352-b1641056d034", "value": "12288:M8kxNhOZElO5kkWjhD4AyE8kxNhOZElO5kkWjhD4Ay:jqEkfFQqEkfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620202037, "uuid": "87fed285-b5a8-4fe7-8406-30418a38f23e", "value": 996622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620202037, "uuid": "4dc3ab3e-7c12-482d-948f-1aee29714bb5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202037, "uuid": "a0be233d-68b9-45a6-8822-debbaf6e9614", "value": "7c986ab5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f17eaf7-adbb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620230609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230609, "uuid": "fff573ba-1611-4a99-b0c4-b5120ed4ca4d", "comment": "Malware payload", "value": "bb37e1592a9611dc521167ac5a2034a2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230609, "uuid": "59e9b6b3-6c46-4d25-a941-519ba9e7163f", "comment": "Malware payload", "value": "038214d4fc146d3a0b09db57ab584e3cef198a466d82206a03af0ca6aff4ac2e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230609, "uuid": "c3509b58-8325-456d-bf7c-1f1ce838aedf", "comment": "Malware payload", "value": "a9a1e60803fcb5a0b68659195ce5d0c15455646b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230609, "uuid": "83a7b2eb-8b8f-4125-9799-70521f9e9d6b", "comment": "Malware payload", "value": "c17a183f2f39e65a51842e81d58374caaf58cc315901e12487c3f6aa3b8757fe38d35f41cb376c36f1682537f0df752f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230609, "uuid": "6484aba6-5675-4346-b439-2a9d33395163", "value": "AF72BF6FB10578B5C372983DD401667E640F45491E12FAC8B4A2B71C0BD23C71B9D7A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230609, "uuid": "9b7e06d7-d633-40c0-b39e-5cb4b9b602b3", "value": "384:gLvHKHBPJ2cwPrgJYFp0S1gcVFBSZuSSDppN8cfbhd:gL/KHBP+PqYYkXWZu9+cj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620230609, "uuid": "4577c702-f522-41b1-a4e7-06d9b3c6b656", "value": 15985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620230609, "uuid": "a74ddc44-7ff2-42b3-8930-8400df982db9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230609, "uuid": "fd7b8925-d9ff-43c1-a978-673858fe80c6", "value": "bb37e159_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7e8e850-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209257, "uuid": "5528edf3-6472-4d98-bb6c-4e77e54c3d1a", "comment": "Malware payload", "value": "604eb3ffa2aebf38d14181c5beb5255f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209257, "uuid": "a1936c02-0453-4c1e-8e5d-abbc4253ca4e", "comment": "Malware payload", "value": "03b08332ab127855a6b1dd9e5f15c6114b1d85cdc5fa01ede2265630399af447", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209257, "uuid": "0e5a4b8a-e11b-48a9-8420-55ebe4071f05", "comment": "Malware payload", "value": "1d17964e300dae037cdcf6bc8b41d4b251228901", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209257, "uuid": "8ce4b7ff-5c9b-41ff-81e6-9703cbeec2b6", "comment": "Malware payload", "value": "9358e8a172002efedaed6ed833f063673c329cc4ba2ddc14dcce4bea12ee6844a41d4e4f370fb929f292d8ddb198c9ee", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209257, "uuid": "0bef0dc3-55f5-434b-a080-3f3a88825292", "value": "4535CF590FA2319DB57896FBC9DB4B24B5936BC13A181E7A02CF84F4727332F8385985", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209257, "uuid": "068a9fc0-8164-4886-80e1-f7f2b9c21df6", "value": "136165f50ad383f44637a648eaa821b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209257, "uuid": "5887410b-da1c-4d4e-98ba-6edf19f7167d", "value": "24576:ctFt8Ipdjaw4LMrrHq/rZq8bO+7yMAWYT8cvTWK6:cZV94OHq/rZLmMqAc7WK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209257, "uuid": "2157f892-c2c2-43d2-8970-91978cc15389", "value": 1089024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209257, "uuid": "b71065b9-08bd-4a17-bb55-bcf526cd70c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209257, "uuid": "800036b2-61eb-4d14-805a-1616737d6ea3", "value": "604eb3ff_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c154e605-addc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620244921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244921, "uuid": "a707ef0f-4c98-4f3b-8740-8f487bdddcdc", "comment": "Malware payload (Dridex)", "value": "37e3065116cc54b0cebc2ad7cac6dd6d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244921, "uuid": "d29fdb3b-2bbf-4e83-ae69-f3712b72b4ce", "comment": "Malware payload (Dridex)", "value": "03b4496cafb665922515359deb8fd965b7c44f46cb182d3b5faba79fce98fc5a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244921, "uuid": "04783ad3-0b18-47be-8308-5dba9c9331af", "comment": "Malware payload (Dridex)", "value": "54b739b4b8f9cc8eaaf3526f1d64121181e2689e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244921, "uuid": "b62cd32e-eaa6-45f7-aa8e-dc52c5a51d9d", "comment": "Malware payload (Dridex)", "value": "bf8f3f4d2b82e473fbaccd2b7d1f281d953c906590586f5a938e470d6db5265116b1c19f429776789837de8bfed92ebe", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244921, "uuid": "60bddabc-7002-47d3-80c8-6526c958b497", "value": "E5F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244921, "uuid": "61b0ca78-848a-4c97-857c-87d104c74f81", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244921, "uuid": "c3830a5a-1935-4915-b0f4-d3ff905f924a", "value": "3072:7WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:742IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620244921, "uuid": "242bc6cc-0536-4a57-b20a-0aa2fc1bd891", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620244921, "uuid": "6bae3fcc-00c7-41e3-bde9-fe8f82429d5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244921, "uuid": "ef9b03f0-0bfb-4f2d-84f1-f0c402e227b5", "value": "37e30651_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "247ed277-adef-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620252818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252818, "uuid": "da83f2e2-c8bb-4481-9dd5-0cd7bd86c0e5", "comment": "Malware payload (Dridex)", "value": "bb2ef3c536a92419b0f45857e91670e6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252818, "uuid": "19d3e264-d56e-44a2-abfa-961f1917bd0a", "comment": "Malware payload (Dridex)", "value": "03d6a2c60a8c83287afc1737c7cc577871844b436b8cad7d477bfebce8a06ac3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252818, "uuid": "b65f1501-1cf6-4c10-8132-c4ded9adb815", "comment": "Malware payload (Dridex)", "value": "9c71cce980f43a6c5f745d5c52272cb327ccea2a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252818, "uuid": "4e09e066-e1ec-460d-adaa-ba03dddeb6c2", "comment": "Malware payload (Dridex)", "value": "90d4fb552cdb93c6e39a6f2536e4abe54b8f5d67e6f6270a02fe7d38cb6575a26d09cb42d31e66f7aacb7770f4e57b51", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252818, "uuid": "50eb51b6-0ac5-4694-8351-2f6962d0d905", "value": "0CF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252818, "uuid": "55c10b9a-99fb-4acd-9f07-e578b6b09eb3", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252818, "uuid": "d3ba8305-3583-4a00-9823-9dc6e5ddddb6", "value": "3072:LA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:L3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252818, "uuid": "92af3460-dfda-4d31-ad70-3c42b32e6983", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252818, "uuid": "0bcfaaf5-0f04-4505-a9e1-62e31e5a1854", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252818, "uuid": "8f90c68c-240d-4fb6-a229-c2bbfc57d6b2", "value": "bb2ef3c5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f383266a-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252736, "uuid": "57a71bcb-1654-40e3-891f-a790fb4577a6", "comment": "Malware payload", "value": "46eb14120189f91cf49672f40563be03", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252736, "uuid": "b5c51435-8cc6-4bb5-a33c-3822e0e41a01", "comment": "Malware payload", "value": "03fea43f63bd8b86aabc53721ff343714147bb5a52146c41d357acca971434be", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252736, "uuid": "5139042a-2589-44d3-b8ca-0d733ab1bf08", "comment": "Malware payload", "value": "c7088cacd26bfa837fc5231bbec20dfcbd5ef0ef", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252736, "uuid": "bb3f5cde-130a-4350-aa76-99402c1cbf5e", "comment": "Malware payload", "value": "d6ac047a482d5fe150728ba05b1cae09a4276afaf0cbc204d64830cc742556d176a1b6e297d8c1d23b693a183cf2d0e1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252736, "uuid": "c803357f-7682-4d50-aadd-d7e6095402ac", "value": "35F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252736, "uuid": "dde44e20-be9a-4c93-96ab-4b57cd580b23", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252736, "uuid": "3bfc21df-47ad-412e-8a5b-bfc33a74bfba", "value": "3072:Xlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Xlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252736, "uuid": "dbca25c3-73b1-402c-afe0-9ab16001ba2a", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252736, "uuid": "cf650636-9d05-47b9-9199-0e3617378d2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252736, "uuid": "e4aec76a-6bfe-4088-8970-702a11e3c2a3", "value": "46eb1412_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a6bbbd-adab-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620223591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223591, "uuid": "a55b84c5-b3c7-4783-8268-95818733e9e6", "comment": "Malware payload (AgentTesla)", "value": "4c1e0d69072cee4b0a5f3e7e6c0dc6ec", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223591, "uuid": "704e8407-fea8-48cb-8f1f-36ef1b3e941b", "comment": "Malware payload (AgentTesla)", "value": "043040f3e3a85ad984448ead2c5395fabac1d8bcee72a6ec46019173d6d25f37", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223591, "uuid": "31210d09-2edf-4b20-9d0a-fb2143a6f42c", "comment": "Malware payload (AgentTesla)", "value": "6a7aa489a63df2faca9ee1d355062bd04fcea1bc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223591, "uuid": "d108c8c9-a1ee-4d8d-8e38-cf46f0757d83", "comment": "Malware payload (AgentTesla)", "value": "90dcdbf9ca7e8472c50108d57920f21ae99fb476fde78d67d3b4954caa172994921847e4e4c3c67f0ed26c5315b2cab9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223591, "uuid": "955cd556-e851-4fdd-994a-911ee35bc9ed", "value": "6FC423D9FB572188BF3386E5373DA96258E280BD8438EF3537709A75C84B29E058275C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223591, "uuid": "a9b24310-0b07-4462-b2ac-5fcc7986ced9", "value": "12288:mSSlBYoCAaNyYxnGjEp2HaH10Xaj4lrRQ6M664HvfS:mSSlQyNEMG10XG4dK/US", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620223591, "uuid": "11ac77d0-3e0c-4e19-910f-afc520442e6e", "value": 566397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620223591, "uuid": "b3765196-bea1-41ba-b0af-a5829296cf8a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223591, "uuid": "9a51b478-ec36-412c-8b2a-77ed89a6574b", "value": "4c1e0d69_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45d69f25-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241707, "uuid": "6c905482-4663-473a-8b49-3fad324378dd", "comment": "Malware payload", "value": "cc16da0d2bb409c894343ef3bfe80986", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241707, "uuid": "d5385cf9-b782-42e5-aa2d-cea4e6caa817", "comment": "Malware payload", "value": "043135ace5921845687d239beaf0ed9983dd700d1a02e23414c836bab93833d0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241707, "uuid": "b7964bd9-472f-40f4-9d97-b08be6b4a17d", "comment": "Malware payload", "value": "59f22694842c8031ba94ade3b342e84f0d365b36", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241707, "uuid": "26b42123-ad65-4285-984c-d937a5b38376", "comment": "Malware payload", "value": "df1e903def1d937f0b46baccdd6468a204ce0fb426fecb2df3d2c5c2eb589f40a9b20ac5958188a46cc79d48fae3b100", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241707, "uuid": "2514dda3-f3ee-4fe5-a36f-c7a5d3109a57", "value": "50F3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241707, "uuid": "a463c533-7628-43a8-8984-c28532ab38b8", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241707, "uuid": "57db94e8-9a92-4638-9d3c-37479fc63685", "value": "3072:ti45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:E4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241707, "uuid": "d282e59d-04eb-4a3b-aed9-dc7196e3dbf3", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241707, "uuid": "361c6e42-6a44-4f5d-87ea-fdf723323dc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241707, "uuid": "2a0c020d-0103-49d0-bf24-0ffe9defc523", "value": "cc16da0d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a51204ad-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209225, "uuid": "722ca434-c21b-4fe5-9d5d-2eb478999e0f", "comment": "Malware payload", "value": "5b8c4728b107a994d7fcda02a1aeb2c4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209225, "uuid": "1c33ab19-37b2-483e-a769-4ef356b93363", "comment": "Malware payload", "value": "044ce13a80f8cccff294f37d977802a8550cfe52135991fa09769e46aadac8f3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209225, "uuid": "53ca3b0c-c6e8-4436-b88e-c463f62b777e", "comment": "Malware payload", "value": "0862b1af20d39ccb5e6b47ad89be8e4537761b83", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209225, "uuid": "fcbfef35-da16-4072-b4f2-35909605a4cf", "comment": "Malware payload", "value": "c9894efe7aa8b1b0d63a2c60fcf9d298dafb9ec1737cb0214404e06886d1149959ff006740c4f1302c0c3cbd85228559", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209225, "uuid": "5d5bf0b7-4fef-4922-89f6-807efe00cc2b", "value": "6985DFACB4EA80D7DE2C9EB233920DCFC5DBB821188D5E9AD743515A1C5EB465E930F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209225, "uuid": "514e565f-ca60-4984-97d2-972ed4b6f3c0", "value": "daff8b6ca7cfbf818106cdbf8d276c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209225, "uuid": "2850fcc7-346c-4a08-96a6-ea5ca5d5b799", "value": "49152:OoAWUT+1r1cq7JREE8yYEUDbig0dxualYHqDcyhI:OCo+1pcq758yYEiiLn9kqDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209225, "uuid": "f9374492-6cf5-4491-9dde-0f506b7dd567", "value": 1724416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209225, "uuid": "460968ac-d311-4a30-b59f-9ff98aa6288d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209225, "uuid": "5feb06a3-e3b0-4c86-88a6-8b3d2f828cec", "value": "5b8c4728_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a6fbba8-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252506, "uuid": "d375513f-836d-4d0f-8372-71de78b06eb7", "comment": "Malware payload", "value": "75662af433ea06689e3fb15a70cfcc79", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252506, "uuid": "9178f256-8ae0-48c0-aa12-7b50a6681a86", "comment": "Malware payload", "value": "045b1751aa8eddb0ff9e8e34f817f905a2bb07b5796e20d0fca521b23a5038e4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252506, "uuid": "977e3517-fa66-40b5-9263-32a81e614358", "comment": "Malware payload", "value": "fd31186a644a5014ad9bbb2def308fdf1b97a803", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252506, "uuid": "d547330f-28f8-4103-a47d-5de4f2ba1850", "comment": "Malware payload", "value": "ed0eb8dd1eba795873425d4d8683eb384029568fcb4a35d3d40844d1d950710cdc5fb0c35ab3a50843e38b146cd203b5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252506, "uuid": "45ff0198-d297-4c5c-849f-151bb04a1e0e", "value": "C4F3CFE89A9FC097E663583055FF3BB6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252506, "uuid": "890a56dd-f64b-4238-8693-d71044776e86", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252506, "uuid": "e4b122aa-c73a-4e1d-89f1-6ed56615e2d5", "value": "3072:8c4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:EDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252506, "uuid": "f887666f-2c0f-4079-aa8d-90c8caa35fb9", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252506, "uuid": "63d5e22f-fc6d-405a-b285-cfdccb720b91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252506, "uuid": "2a5d8d32-8660-440f-9e88-1e7f5b751bd0", "value": "75662af4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bb8dfad-add6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620242146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242146, "uuid": "d7b09e25-abf6-425a-ad0e-c18cd2c8cc08", "comment": "Malware payload (Dridex)", "value": "f3a3959d599529af4b99bbe3b8e2d1e6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242146, "uuid": "403d8655-b4b4-4271-813c-be09c2c8956f", "comment": "Malware payload (Dridex)", "value": "046bcc2ce80b3184c71a9d2af68775301aa9a4d9739d8524ba4900dd814bfc1b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242146, "uuid": "e30b7286-f453-47ef-8b7f-5eb24c0ceb2a", "comment": "Malware payload (Dridex)", "value": "7eae88a955596acc478c46124f27bccf13a16197", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242146, "uuid": "103aaa7c-0532-4659-abb5-072ea7e3c006", "comment": "Malware payload (Dridex)", "value": "7d480b4065f51c1578c067d9636808bd36796964c2dbbb2d0c01f65703ed1ead3ea98e79a308c4425d8fcc9d0cb6a71f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242146, "uuid": "da6faf1f-72f9-4a55-81de-18fdb89adb68", "value": "7BF3C085DBABE87FC45A35399071DFFB5B388B145250C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242146, "uuid": "75d06158-6d59-4510-ac04-5d6cee383e56", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242146, "uuid": "07a4bc90-34fe-45fb-a7d7-4b60799a9769", "value": "3072:9B45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:b4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242146, "uuid": "e600d979-3bda-4fbd-833b-22b2944f099c", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242146, "uuid": "596f916b-c413-4204-aa41-ae0ea5b79ce3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242146, "uuid": "21a08d6b-92f5-41ae-9fe9-dc175aec4268", "value": "f3a3959d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bade980c-adb2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620226871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226871, "uuid": "84aabd9d-143d-4cce-846c-8149f4046e83", "comment": "Malware payload (Dridex)", "value": "7fdbcf101bfa4f171f5bcc5764d564c4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226871, "uuid": "4d49913c-00dc-4d91-b8e9-d1412411efff", "comment": "Malware payload (Dridex)", "value": "0470d81f6f10017a2d608d21a019ad9725ab9fc6822fb55a3bee2889b1489b8a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226871, "uuid": "f17fb778-71a2-483f-89ff-b3bb1772ccb2", "comment": "Malware payload (Dridex)", "value": "d2f3d40edc395f3cfef5221c53c196b6c7f500c5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226871, "uuid": "534f2737-b31f-4fdc-811b-65729ba086f1", "comment": "Malware payload (Dridex)", "value": "90f8c09656cd16709ad3e636a01d12d10c1796130152557a74d1eff7349702a9d3457cb622c68efcdc71aade6120d5d2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226871, "uuid": "a0487e40-8616-4002-9e83-15a9bc0d10ca", "value": "2FF3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226871, "uuid": "3179d3ff-6558-412f-8085-366f66342ea6", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226871, "uuid": "84daf922-5a3a-413c-9bab-90eb8c6d1453", "value": "3072:pWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:p42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620226871, "uuid": "bd7d159c-3cc0-4f4a-acbc-6dccc84bb289", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620226871, "uuid": "dd7280c1-d931-4be6-a9b5-a79eedc2baf9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226871, "uuid": "e12ab3e8-4c6f-4a10-ba2c-e2cd29ef8d5e", "value": "7fdbcf10_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b17fc14-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201719, "uuid": "bfd4a807-fa06-4e25-bc12-feaf38b08d65", "comment": "Malware payload", "value": "d681d81e8e52b4da5ee851f0da9bb8c0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201719, "uuid": "c7c882bc-65eb-42b7-b09b-5ed169d95c15", "comment": "Malware payload", "value": "04790dd0de0013a93ab854a222a4ec7ff04a428953eef222c8ec54e18fcaf5cb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201719, "uuid": "a70c85ed-95f8-4f0c-9241-0e7b41b71991", "comment": "Malware payload", "value": "4b434bc2f4ebb3a7ecb9562a7321b9cdc4669a23", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201719, "uuid": "46da1a12-e5f4-4d4b-bc80-443816187fbe", "comment": "Malware payload", "value": "42807f7e3dc44e20b3a8fdd30e9d3425c9e382cf19f363b757940b7d7629b8c4f13292a46f6ef151fc91c809f36a1314", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201719, "uuid": "5623ad25-606c-4841-b99f-5c81741cdffd", "value": "D6E4E00F7924DA92E3C237F86061B3D74B0474EFE9F09919FE252911FA7A0A906767C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201719, "uuid": "8c6bef95-e07b-4de5-bc67-c5c79f679aea", "value": "285d3115b2067777cc0f28e665d2a151", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201719, "uuid": "b4d17d14-741e-4fc0-996c-9431d314a6b4", "value": "12288:4uQF1UggZ4V5FBgpp8Pk3Q97Wd3hBpcnVhYSbQEU+FN:Zk/gZ4V5FBgppy8Q9Sd3enV44", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201719, "uuid": "d5790d0c-4519-4358-b8c7-9336eb3a4303", "value": 671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201719, "uuid": "476f0b57-6ea0-47ff-9025-c78f971c0d89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201719, "uuid": "b85994ac-d301-418c-95e7-5c751085b260", "value": "d681d81e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "623af95d-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload (Sodinokibi)", "timestamp": 1620212549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212549, "uuid": "00c5704b-7da3-4b61-bba6-7fc75f0fd80d", "comment": "Malware payload (Sodinokibi)", "value": "040818b1b3c9b1bf8245f5bcb4eebbbc", "object_relation": "md5", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212549, "uuid": "1d19e59d-d3d6-446b-b6b9-e266c09f5289", "comment": "Malware payload (Sodinokibi)", "value": "0496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402", "object_relation": "sha256", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212549, "uuid": "3dd9ef6c-dba4-474f-a9e3-2119ed1faa7d", "comment": "Malware payload (Sodinokibi)", "value": "c0f569fc22cb5dd8e02e44f85168b4b72a6669c3", "object_relation": "sha1", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212549, "uuid": "322b122d-4591-4438-b79a-86bf3d3dd312", "comment": "Malware payload (Sodinokibi)", "value": "12ec1f04e042e16eede2b24a961ee48d267f42b078b434dd6c1c92845b1630a17915652f29a809d5dcbed10fbc567c0a", "object_relation": "sha3-384", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212549, "uuid": "8ef23d3a-db48-46b2-9216-dd87bf65f913", "value": "0B05AE13FA8184B2F5DF013961B3577E8E3A9E109729E6D38B9178668D312D06B3F385", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212549, "uuid": "245001d3-c18d-452f-9f99-26bf5720c1fb", "value": "978e775a5e5aede14cbde23e1be9bd23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212549, "uuid": "87c8cad5-1f52-487f-9593-38cb27a4f8de", "value": "24576:sxskD1HtqZ+p53DVJ3Bpv256HDtMTeWDqQW:md2+Pf28SR3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212549, "uuid": "06712462-7d95-4f71-8a4d-2837c17e4861", "value": 832864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212549, "uuid": "1c46fa23-7dad-440d-8964-5f05486695d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212549, "uuid": "0e0424f3-99aa-4800-b26d-631b41d2f6ac", "value": "040818b1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3216970-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208927, "uuid": "195a816b-dad9-4cf0-9dc3-37223f6e5958", "comment": "Malware payload", "value": "aceed5ce0b2d8f9c271cdde043299dc4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208927, "uuid": "26b9af54-1358-476b-8286-a3e995fcfcf2", "comment": "Malware payload", "value": "04d22c0a59742288ba0407588468a0f7237a9b004f81e40c5221ecc9d056ea15", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208927, "uuid": "6d13433e-2804-4fef-9dda-198b4c74f048", "comment": "Malware payload", "value": "5c93179c92460fbc6980b2c6028cdf98b16ef43f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208927, "uuid": "95f576fc-6aa3-4b5d-8147-b9084602e767", "comment": "Malware payload", "value": "7cb0f3d2b8ba7f20978ae4f60539b3dcf091864e5849ded456bd0bc5028e25c7a3193ceba2d2ca4a1cb973b24b3489d1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208927, "uuid": "3fb61733-ae4b-4c58-9ff5-9ecf582a8b23", "value": "62D47A1110D1FE27C99F22F310AA5B8041609A46938DB5CBED64BAF3FFE1A817135DE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208927, "uuid": "65604fb5-7614-4947-b9fe-28191ace243f", "value": "5a91a81180330eb58c8c54d063da047f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208927, "uuid": "f71d9cbb-a4b3-4984-9a8f-cc69c70cda8d", "value": "12288:+v6oxJefkA73fTUzxAaOe5RI7ICWBChu4ZUFP+YnTm:+v6xfkAjfTpkRIcCWBVu2P7Tm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208927, "uuid": "abe8b8ba-2148-4032-91a7-cf4c321f8f23", "value": 640512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208927, "uuid": "f54a3c2d-b907-447b-8c69-9dd39d89ea0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208927, "uuid": "ea54c077-94a2-4575-9684-d32ed134d42b", "value": "aceed5ce_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ecf56d-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252183, "uuid": "1a6069cf-6d94-4e85-b22e-0dfd9d510aa1", "comment": "Malware payload", "value": "1c63248b16d09da649e67d438632df1c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252183, "uuid": "a07c5a75-1a7a-4748-a7c9-9b92c03aba0a", "comment": "Malware payload", "value": "04e9accb67530d19a7933d11355e1f442574f7e042b273b0470309c025c94095", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252183, "uuid": "f3d40be0-a7ec-402a-a401-49d72799ce11", "comment": "Malware payload", "value": "b5b3a177b38fce13ec9dd3ee3c814cc19685bb69", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252183, "uuid": "57788c70-71e3-4b72-9a8a-a09c6e31136d", "comment": "Malware payload", "value": "8e968f510bda57a93b857dfb2fada51cf7eb2ac9b4758f70f0798631a3924a531c4cb5b124e079f80a74f7fe09b72ab4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252183, "uuid": "1bd6312c-fa71-466e-9422-57ce25bba073", "value": "71F3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252183, "uuid": "cf719416-c94d-455f-af05-85f1b2953815", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252183, "uuid": "8e8128ca-f262-4155-abf9-7487f2277dc1", "value": "3072:KK4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:oDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252183, "uuid": "005ef062-88d3-4079-8605-ffd97e4ab5cf", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252183, "uuid": "a322947a-cfca-404a-9f86-9fb18ba16818", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252183, "uuid": "7d77ab56-466d-479b-8014-633e14626be2", "value": "1c63248b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1190b8d0-adf6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255793, "uuid": "c62ef95f-fa6d-4487-acd8-2a2f1d21be82", "comment": "Malware payload", "value": "2b9cd7fc8b546c5348a772e08beab6b7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255793, "uuid": "a87d9e17-35e0-4d16-8b35-a76f2e9f35e4", "comment": "Malware payload", "value": "04f4e5b88008ce3f4f8990f5bb1db65ec0c995092009eeb7ff47d0f18282cd17", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255793, "uuid": "46424d17-c398-45f0-8ff0-bde9966ecbda", "comment": "Malware payload", "value": "5b0b96719b5672ba7bfdb1e4d90262758b12201f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255793, "uuid": "06e9647f-02ec-4c3f-b52a-b75311063625", "comment": "Malware payload", "value": "fee820c2972e6e8a590fc3684d3d528e6dd4bf2c79433446b974a088705e6ed59f294eda7f547ea9b9af61ce6b6adf9d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255793, "uuid": "eca08fdf-c000-46c9-90c5-9e5030f10554", "value": "4AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255793, "uuid": "fe342350-6bb4-45e8-b8f5-4e6f4e0933a3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255793, "uuid": "04a14bf5-58de-416f-a0bb-e77176f22ab8", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255793, "uuid": "81689d3f-7ee2-4f9a-bdef-0f57e2872adc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255793, "uuid": "e251fdf0-657d-477c-8734-4f69ece3dc13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255793, "uuid": "2d3bfd60-13aa-488e-bbec-d43fbc0fcc87", "value": "2b9cd7fc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f315d37a-ad87-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208497, "uuid": "b7f2907d-5277-4377-8513-eb2cb1f3683c", "comment": "Malware payload", "value": "1feecc7964eadfab3ea0f695e40673d3", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208497, "uuid": "5effb26f-b70f-4cd6-8d29-914bc6db6127", "comment": "Malware payload", "value": "05055fe525bf6b6e42e75fd65d3e30fa797da6ec4ee27be7c49ecaaeee199729", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208497, "uuid": "a414517d-500f-4a82-bf18-bedf35c10430", "comment": "Malware payload", "value": "0d001ae18a41215fc3efb4d00f8bd2bcb92f3ca4", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208497, "uuid": "ab87b0f0-921b-4ea6-b5ff-17df30a905ad", "comment": "Malware payload", "value": "408e72578714ca05785adf2ba4c02c7fee53ce861804a5044cee15631985aeef5a8ba42b696071ba80b4c69764c9d3b0", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208497, "uuid": "a0e1e0e0-5b63-43f4-acad-b8754c01bb1d", "value": "16E533ACB1DD39BE82D4A772A2EFED28301665CD706183916DF3948E0C17271D4EAE1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208497, "uuid": "1d8943a4-4e28-4abb-8598-3b743d093eba", "value": "49152:tT0+oOBiXLUNaRHKmjsbS21i2F/ecE+0n9aFctnpbbTruN3MKQexlwLE5Ig+M4hM:tos909Qg6ecEZHyEexmLaI9MYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208497, "uuid": "9b03b558-2fb5-4fd7-908b-cc3545af9147", "value": 3059712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208497, "uuid": "b85a4793-05f4-4af4-be54-d0f4d01552da", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208497, "uuid": "ddaa99aa-72bb-4bd1-b11c-7321aacdb70c", "value": "05055fe525bf6b6e42e75fd65d3e30fa797da6ec4ee27be7c49ecaaeee199729", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d83e2998-adc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234222, "uuid": "6f0f9793-f6f2-4800-a2bb-5e838aa5f934", "comment": "Malware payload (Dridex)", "value": "2ea54e147a157f3d8e2ffecae6d19395", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234222, "uuid": "73c0b6a8-4f20-4b89-a34a-29e8c34cf797", "comment": "Malware payload (Dridex)", "value": "050713a56582b64d0cdf210980a56f1bce44fb8a3421ee5811662c3efe61d837", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234222, "uuid": "b101394a-da13-419d-9240-ddf8b534469b", "comment": "Malware payload (Dridex)", "value": "311309ad29bb82efcd598e81328c4fded16a8ea9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234222, "uuid": "6166dbbb-f2c1-4c34-9024-0509748a5a87", "comment": "Malware payload (Dridex)", "value": "1e8512b225b7d434f0be07c32188b652a3fcbbe1f01f83b1d577a1627a7cb5a36637727749dc2aa8808fc85f275b5a27", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234222, "uuid": "8d08819c-a968-48df-a879-3e590c453717", "value": "0DF3C085DBABE87FC45A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234222, "uuid": "c7c98033-2a0d-47e1-bfb4-e6b4e6e8c58c", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234222, "uuid": "e24da40c-7361-45f6-8932-99c2c33e0044", "value": "3072:Ek45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:34KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234222, "uuid": "b810621c-77f5-4952-9d80-918a87ac9e98", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234222, "uuid": "1c6bc5d2-e4f9-4874-9209-f20bdc876f72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234222, "uuid": "f5408487-a5a9-4fbb-a019-eb09b60daa90", "value": "2ea54e14_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c30675a9-ad80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205410, "uuid": "3893f5d3-66a4-4088-a005-a5d1266f7a68", "comment": "Malware payload", "value": "67d06ff4ca1048494444b4831fce80d3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205410, "uuid": "34caa9d9-aadd-41f6-94d3-7ae383ac4489", "comment": "Malware payload", "value": "0519c84940b0adbe0cf444d80a3e201ef81799a4ef4472806114db55cf596f85", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205410, "uuid": "a96a584e-27da-41fa-ba22-f7f08cc5191f", "comment": "Malware payload", "value": "2cee76ca8933749dc6469ba3da692cb194557847", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205410, "uuid": "114c99b0-8e0b-487f-a79d-548f103e47ac", "comment": "Malware payload", "value": "5a3bfed13418aa41c9ef8f0c5809c0dff53bceff15d12b9b061b3f3f3caf7480ae8f33a014261a0c1615b52cd2bf6fbf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205410, "uuid": "c7404098-aab3-4ba0-a570-84ad91e0f358", "value": "5E0501406A6A8C01D7634F74D0BF1A463A68D8DE2EF8BCC255FD2D575E8C2A5808FBC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205410, "uuid": "ec7f7f56-3e59-440d-9864-15ff9be23bee", "value": "867c91c6d0d0461fbe4fd7d734932677", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205410, "uuid": "b3f287d9-584f-4fee-aa87-c11248fbf3c5", "value": "24576:VVDc/AdjEQWXN3Hin3uJm20RVWIylNHw5U:VbQ5VinCmZVWIylNQ5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205410, "uuid": "5b4824b4-7556-44ff-9773-9f3d514f4699", "value": 845824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205410, "uuid": "a2a346a4-753b-4d3b-8479-8905922d8ba7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205410, "uuid": "993acabd-13be-4827-a89a-db9fa2ccea38", "value": "67d06ff4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0547c365-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241599, "uuid": "c2d72391-1711-4fbd-af19-7065c14b98cc", "comment": "Malware payload", "value": "94ca5ce082f751876b94f9a7f5b136dd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241599, "uuid": "8630b22a-19eb-49b0-84b7-efd86f528313", "comment": "Malware payload", "value": "0549f83951c59c7af166d82eab8590235e9a5f6b4d61c159fa7b79e5e5366900", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241599, "uuid": "d5f974a8-a108-4cec-b4dc-2257bb93fa12", "comment": "Malware payload", "value": "939f46550823c8458a6a3ca9a85369aa91e7eca9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241599, "uuid": "03f77fc8-b879-456f-bda0-0af235085120", "comment": "Malware payload", "value": "b1852a41b8eea6ef4091b4eb13655f9aca3a141fb9f836fa5e223f8f8e12f0beb6a7cafea177f6514afc85f920d493a3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241599, "uuid": "f313f923-2a68-4f17-9d9e-ebcdbcb4c1b7", "value": "58F3C085DBABE87FC45A35399472DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241599, "uuid": "3af5658b-92b8-4283-9688-dfe1600bd4e0", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241599, "uuid": "89338821-bd29-4a7c-befb-74060cfd6e85", "value": "3072:xX45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:94KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241599, "uuid": "c927ba70-1927-4ca9-b551-c1da34f7d342", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241599, "uuid": "2adf2109-a890-4911-a10b-375e4b297964", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241599, "uuid": "3cbb876f-13da-41d4-a444-9d26b0b3367b", "value": "94ca5ce0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5459d8bc-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201788, "uuid": "9f818f94-9c51-44ee-9f40-998c12548850", "comment": "Malware payload", "value": "96345baee7db41037cf40fa1d9885cfb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201788, "uuid": "b52e9361-e37c-4f3c-b95e-c399268466dc", "comment": "Malware payload", "value": "0591dfda9a2c55d18848b91dde076c61c333dc6ae14b2166cd30891e949607c2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201788, "uuid": "bd94ab19-b9ee-4789-bbda-0976b588f7c2", "comment": "Malware payload", "value": "8c13f9478236189b7973261b3608dbe7925b31a1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201788, "uuid": "fd3156e6-9fbe-45fa-958c-e681f4bfeb08", "comment": "Malware payload", "value": "4c0f5a4104c4cc8d8c6839a18e2e1aea8bb993b9f181eb2c85d1d58f83ae51f8e10bda6181d8ca9a929464a0ff72f09a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201788, "uuid": "28c5bf49-a654-4dc0-9a90-6c2473e5b8c1", "value": "72F4CFC516BEB0AACA561AFC1C8BFBE09B55EF4F0CE15946120F398F849B4906443FD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201788, "uuid": "ce1efda7-c584-456b-b40f-0e120d8ac499", "value": "f364060db69c2ae31d4a21ab8f098587", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201788, "uuid": "16e65012-f575-4891-a3e5-c502cbeb8c57", "value": "12288:awdf+5rgXeAZkWFCVtp/AQPDgsDImVIkmVKr+9hEGTm:vI8P6Wmb/PPDzDlTNiTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201788, "uuid": "ffe4afa5-56f9-4e5b-8261-36566baababc", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201788, "uuid": "501d551f-1eab-4cfd-9627-e759fb1e3d49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201788, "uuid": "0cc1d528-b31f-4d61-aefd-a27884c79d51", "value": "96345bae_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d846ce7-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload (Worm.Ramnit)", "timestamp": 1620201857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201857, "uuid": "d17aabf1-9488-4745-a34c-33192bed51db", "comment": "Malware payload (Worm.Ramnit)", "value": "6edb9133df37ae1e10043831628b7913", "object_relation": "md5", "Tag": [ { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201857, "uuid": "9f6b60c5-73d5-4a0a-89ba-18e6b17a78d4", "comment": "Malware payload (Worm.Ramnit)", "value": "059608e22160cd34726c0c7f5d6c33394ddb814bc3673670d092223a5bc6181c", "object_relation": "sha256", "Tag": [ { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201857, "uuid": "3a15380f-8a62-4845-9b9e-f914d5c51ac0", "comment": "Malware payload (Worm.Ramnit)", "value": "325db46f8db1b8f6187013b560b48a982a8425fe", "object_relation": "sha1", "Tag": [ { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201857, "uuid": "1c34f81b-8f6a-4584-813b-886674497d8f", "comment": "Malware payload (Worm.Ramnit)", "value": "9761a72b59eea99a8aee523aafe975d59183087b3f153e41fce6a5e181d132788f7a6cd565f6fc1267d63a8c89fdfd36", "object_relation": "sha3-384", "Tag": [ { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201857, "uuid": "702b0a42-1dfc-4d22-b7ef-2d53794b316c", "value": "2C647B123BF4C47AC64301328F5DABE5A0FA97A94D60488327D00D6CFA75DC6D369E2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201857, "uuid": "ff9f2fc3-5ef3-4590-ad5b-aa57716aa1ca", "value": "6d26c857784eea32ac92dcb74e598644", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201857, "uuid": "25125a4a-3d97-4795-ac0e-ac85d52f6407", "value": "6144:lW+Dffz1gUZ3sOeNw0VqIJ/uJn9tvq3v3/sSQJw1Tu:lW+Dfhg0cvd5JIDvTJw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201857, "uuid": "02d1e367-1fe5-43ce-9398-da0d3a90301e", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201857, "uuid": "43b53f02-9a2c-4c5a-8f2d-b0bdf82644af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201857, "uuid": "d853b7a5-ebdb-4b52-9a4d-d03bda75a67b", "value": "6edb9133_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef6b825e-adaa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620223523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223523, "uuid": "9d48b9b5-797b-452c-b6e4-f09477c6278d", "comment": "Malware payload (Dridex)", "value": "e2781cbde92a0f8b7e44653592913698", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223523, "uuid": "56a9a06e-56bb-431e-8129-fce09c32255c", "comment": "Malware payload (Dridex)", "value": "05b646381adcb899f3a06487f4d3bac245086b379e927d5d11e3991bfaaf87fa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223523, "uuid": "d16eefd3-5e3f-42b8-a028-0203dda71b12", "comment": "Malware payload (Dridex)", "value": "671e3aafbff51d35215a132b2798813e1983b972", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223523, "uuid": "70a0d8dc-10a1-4a99-9a2c-d680ef1b356a", "comment": "Malware payload (Dridex)", "value": "90723f193b880f384fb06d626a301687a407bb422408f8df681503d678a0c281d2cf16695ea66dc5cb943286aad7d6fa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223523, "uuid": "a5c43d9e-8a6a-479f-a010-27da9553e24f", "value": "34F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223523, "uuid": "048af9d6-8d19-4e36-84f2-2d6a1b427942", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223523, "uuid": "f6613a14-1c52-4f74-9346-4686fb10a40f", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620223523, "uuid": "9a8efe2d-4327-4637-805f-b9263fc798c3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620223523, "uuid": "29dd0267-590a-4ad2-9ebb-ec566ef28c05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223523, "uuid": "5f46adc4-97f6-45e4-9d78-be1d3014cbca", "value": "e2781cbd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3eb3d64-ad87-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208498, "uuid": "fdeb355e-a26e-440d-b0d7-76db2df63756", "comment": "Malware payload", "value": "c11838e341a4a2fb9611983b6248553f", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208498, "uuid": "138dc67e-1c2d-441c-a667-acaffc194ce2", "comment": "Malware payload", "value": "05bceddd0bb57b2b6743db95f65642afd1edd961b358da94099b47d981d65f5b", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208498, "uuid": "eb827728-a598-458a-bbe0-63af505e21d2", "comment": "Malware payload", "value": "3ecb3996ee4a83f328057e803ad26e1d2a528c60", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208498, "uuid": "d2ee9091-7d61-40af-8d5d-590a4466b627", "comment": "Malware payload", "value": "21c1ff18d7ce882531b9dd93ae9da1ea6392fdee732df53619e0f68e5bd78de239aa0557fed2e2bef5a8b5ca4fc40a5f", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208498, "uuid": "bd2e33e6-9e7f-4a06-b3be-6117af06e3a5", "value": "57A1F750112C1AB07246697AD26FFA52B90EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208498, "uuid": "e0d27ea9-70f0-4f39-85b4-4cdef4975a6b", "value": "96:ARYZxQOBpLyxIcymLKY8M991wuIaQPYPW:ARJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208498, "uuid": "e637bdd1-d3cd-448d-bac0-ae7b3c55b1bb", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208498, "uuid": "afaca080-6534-4c47-8054-139c6c17bea9", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208498, "uuid": "3d5e5c4f-7d20-46e5-aeb9-e711c7ffec60", "value": "05bceddd0bb57b2b6743db95f65642afd1edd961b358da94099b47d981d65f5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "828d4230-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241809, "uuid": "f3591991-8869-4c27-9ec7-1119937b7738", "comment": "Malware payload", "value": "9cb9f58fd415ff6c711ae820245c3302", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241809, "uuid": "eaccb8ac-7f88-4f63-b842-cc3649007b5f", "comment": "Malware payload", "value": "05dad1d7be9a6e1c61cfa38480f9691ad150e4f22167e1eadefb342385fc3ff5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241809, "uuid": "f2fb1efc-9d38-4e44-9fca-a77fad1e1147", "comment": "Malware payload", "value": "f074e3ee1738ad4243c7b6d59bf65092a9c59cc9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241809, "uuid": "34332c78-a6e7-4b39-b2f7-65ef2283f53e", "comment": "Malware payload", "value": "7b66c7c1f3864a6181fec8a627d23f38b7dbbf1adb2f6d8ffe5ad4ddde92227d1af99624513f660794d23f85bf0459ce", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241809, "uuid": "0d98d80b-927c-4289-a47a-bec96ca52e95", "value": "40F3C085DBABE8BFC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241809, "uuid": "90b0d47d-6628-4200-aace-f1b12dca8344", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241809, "uuid": "5164aae4-0304-4dc8-8a39-bc14240f49c1", "value": "3072:WM45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:J4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241809, "uuid": "76a25f46-a3d1-493e-b1f2-fd764f2f3dde", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241809, "uuid": "3a8a7b4a-86e3-4331-ad20-4a3b69e9bd31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241809, "uuid": "449d76f1-16bc-46fd-884e-aa23dddac80f", "value": "9cb9f58f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec4d08b-ad80-11eb-abe1-42010a9c0039", "comment": "Malware payload (Worm.Ramnit)", "timestamp": 1620205376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205376, "uuid": "56865392-ec5a-484f-88b1-4b807a26cc7d", "comment": "Malware payload (Worm.Ramnit)", "value": "c863627e983bb696ec0d8821d7b6cf9c", "object_relation": "md5", "Tag": [ { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205376, "uuid": "6c0fd235-7a4f-452b-b3a8-d328e93a77b5", "comment": "Malware payload (Worm.Ramnit)", "value": "0606efd9f0aa0a7dc6cfd50f96dc63c9ac546f506df0c45dfcc9415222b131dd", "object_relation": "sha256", "Tag": [ { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205376, "uuid": "added0f3-e1e6-4ce6-95fc-36a281561733", "comment": "Malware payload (Worm.Ramnit)", "value": "dc8fed74b013a5d1dcb63a07dc375e7b6cf3200e", "object_relation": "sha1", "Tag": [ { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205376, "uuid": "d55e3b2e-b254-4aab-9cb6-42c5651896eb", "comment": "Malware payload (Worm.Ramnit)", "value": "5d8483ad7a3839e312e5a8952533d3a2d6517acd2b5a273cbe8c3d275054e0d80c08aeaf5c1d6e89a0895f032d3b70a8", "object_relation": "sha3-384", "Tag": [ { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205376, "uuid": "11bde653-5c4f-4ad4-b5b6-2520adcf2e2c", "value": "45D4E901B7904038F9F725F596FE61A8593DBAE11B1490C7A3C42AFD9A25AF4BC3071B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205376, "uuid": "7f20936f-f08d-45c9-8af2-e794dfd0a7a5", "value": "53a576bc2b30d1dad641242407c95d00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205376, "uuid": "db44d82e-0f99-4285-b1b1-112be4a0e360", "value": "12288:R4B5FmURXxJiiAuuo0hY+jeCxCtPujjWNwAXovcfiIkPYS4:RqHuY3CxCtPujjWNiv4i3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205376, "uuid": "f4c13da8-debc-4fec-be4f-817cd035b7c6", "value": 637440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205376, "uuid": "f2cb134e-6f5c-4a17-a49d-17228546329c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205376, "uuid": "a208660b-3ed3-40df-8e05-7e47d69574ed", "value": "c863627e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbdfa90f-adaa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620223544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223544, "uuid": "3b5c2dcd-2a85-447d-becb-5a4c178d384d", "comment": "Malware payload (Dridex)", "value": "42b9373b0eb72406ea70dac1c6369e76", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223544, "uuid": "1a897fd4-fd56-48d0-9915-07ac24ac168c", "comment": "Malware payload (Dridex)", "value": "062a87ae3e63e4b7b84fa064bed1b72336a44b2003a7ed301bd40e5da3865ceb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223544, "uuid": "29acabf3-8022-4387-bb18-6d8affff9af9", "comment": "Malware payload (Dridex)", "value": "683f3766e0e7ec461b66886fe2ad7393c02cf830", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223544, "uuid": "7d5bfdda-e1d0-417b-aa6b-02f868298936", "comment": "Malware payload (Dridex)", "value": "339bba2c270dff100030064d33810dea6fb56da1d3d0de89469663ff824eb457fc5bd061dbeaf78bf0083d34fe73b527", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223544, "uuid": "38357a88-d395-4548-9367-2dc5d612c045", "value": "5BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223544, "uuid": "5d08bea8-111d-4072-927b-c7a0dac57871", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223544, "uuid": "f95ef5e1-adba-4e60-9ae8-aa4de36dcca5", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620223544, "uuid": "bafd7799-ccab-44f1-9a4b-5b0d18cce076", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620223544, "uuid": "daa3b447-2ef0-4697-b2cf-345a8fc179d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223544, "uuid": "74e0a406-5414-469d-9922-87800d12b38d", "value": "42b9373b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5daf5c24-adbb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620230580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230580, "uuid": "491dcb57-b9ad-4c27-88d6-71eb7e3c5589", "comment": "Malware payload (Dridex)", "value": "a594342a8f6658ba7b530a8e33d737b1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230580, "uuid": "c31925fc-b688-48d8-93e0-3fd807f3f4e4", "comment": "Malware payload (Dridex)", "value": "065ce813347d5d205f84271c3c769b47fc0e282129e038840f687ddc277b210f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230580, "uuid": "1731266c-a640-48b3-ab45-b0b8f8c8f994", "comment": "Malware payload (Dridex)", "value": "0b3161608e7e347f51f2a4b70cdc9c7ef6070a2c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230580, "uuid": "d83d47b9-e55a-416e-8d83-c33b3bd0827d", "comment": "Malware payload (Dridex)", "value": "37ccba39c58061ce480d7b3ede198bf8de7338fb2c6246720011e5659a9aef9bae7fef600adf649152314bd8d7b66c77", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230580, "uuid": "fb0bc2a1-ec1e-4df6-92bf-49a2a1ebdabf", "value": "8BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230580, "uuid": "0779437e-1844-487a-8c37-f564e28e991a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230580, "uuid": "db0ade3e-0a38-4900-9e4c-6bcdcb04571f", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620230580, "uuid": "016992d8-27bc-48f1-ab64-a609976d62a8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620230580, "uuid": "67c964a7-2d3e-4079-8535-023077ba9ce8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230580, "uuid": "97d15bbb-0e35-4260-8bee-4b203c7411ca", "value": "a594342a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5ea977-ad7f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620204805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620204805, "uuid": "9df043c6-771d-4b68-aa28-0af63cd07bd7", "comment": "Malware payload (AgentTesla)", "value": "cce4bdca120137bf418a90de7829848a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620204805, "uuid": "526123c8-1c48-400a-a1cd-0683a514bdd9", "comment": "Malware payload (AgentTesla)", "value": "06dd02e93a4e453491c1beb8ff3b77936f652e0c2ca0d83ee023f4a175ee4a48", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620204805, "uuid": "d69d1fd4-1047-4353-9cdc-7d50b154a021", "comment": "Malware payload (AgentTesla)", "value": "1d0218373af99a57b9ea9dba25cb8d5f9d27c50f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620204805, "uuid": "288d646e-a7e8-48a8-ba6a-9429b56062ba", "comment": "Malware payload (AgentTesla)", "value": "1e4b1387bc78b5eddf99dfe1ddc381b127157cba19b105c70f6857d399d27d89be88775d9f2407d5a9066d2b5a3f2c13", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620204805, "uuid": "611244cc-b6d7-4a16-9cb4-45bf25a2b47f", "value": "50F42311522466B9CA8ED7BB107542C467FCE507A7ABCB4D298F60D814EB203CF56FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620204805, "uuid": "ee93c5c8-10b6-456e-a9aa-dc5ab4c80534", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620204805, "uuid": "e01c1b1a-7619-4418-b082-43feedced89a", "value": "12288:cMZuIxLDXyHurfY+2FK0OA319e/NEQNL/giBrjKuO3MzjBqwGBR4o0/mwoX1Z4Y:c8/vPArs0LcNEQNgi5mbcq1nXX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620204805, "uuid": "a1e8b040-5499-4b69-9b2e-fea6ffabd76c", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620204805, "uuid": "16b1a4a1-2130-4daf-99e2-1a4392a2b756", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620204805, "uuid": "7c353591-5cea-4e6e-87e6-70b1d84cd692", "value": "Revised Purchase Order_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9888fc20-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620212640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212640, "uuid": "261bb94f-3823-46d7-b790-a0f64c8c184b", "comment": "Malware payload (Dridex)", "value": "2dc7430544d5640fda3f2793d1941c58", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212640, "uuid": "fdbf674a-1147-43d9-bea4-7ea5cd6d5c74", "comment": "Malware payload (Dridex)", "value": "0707fb698dc8c2b2f2346d1e1013916785f157845f85ca800c3db93590a3c6d4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212640, "uuid": "398fb256-3545-43a9-9a3e-9e1624423c4d", "comment": "Malware payload (Dridex)", "value": "0d18da83bfc71a84d1dbd395e5baa61d66e3c6cc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212640, "uuid": "71614b5b-3c3b-4bd0-8afe-d60164d64f0d", "comment": "Malware payload (Dridex)", "value": "b7d47b8066845373bc7194e648c4dcf30f95466333b355bd278eb76aba54eab710bd4c4ae71cf1adcef8a0b4e4b11172", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212640, "uuid": "1f918f51-fa36-4e95-b528-664eab68112a", "value": "C3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212640, "uuid": "2c5f8fd6-84a6-4b0d-9af2-b994ffe95cf2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212640, "uuid": "a20423ee-d7d0-49c8-8511-d14f8f82861d", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212640, "uuid": "4e7a7a67-cb89-4191-adde-b1a97aea8737", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212640, "uuid": "7959dd33-b445-4cd6-9dfa-cdb9ec2fb936", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212640, "uuid": "bac8804c-78d7-472c-b106-6d46afbfbd15", "value": "2dc74305_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "570e7abe-add6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620242166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242166, "uuid": "94a29e4b-db0e-4399-a24e-04cc34dd650d", "comment": "Malware payload (Dridex)", "value": "5a3a91a774f333fe15d3a17896795501", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242166, "uuid": "97ed7da8-6ef2-493c-bf22-2b9be8eb928c", "comment": "Malware payload (Dridex)", "value": "070ab074b55e30ec7095ef3c47e761c79833a346f4d8ad59a0a5bf43e002d0c0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242166, "uuid": "0e3951a1-7ea1-4c24-bff0-8287cfec7721", "comment": "Malware payload (Dridex)", "value": "a080b2e53804cc49f515f7aa28572d82ce19078c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242166, "uuid": "948e36cd-107c-4bcc-a77c-053f9a828c8f", "comment": "Malware payload (Dridex)", "value": "7673c58cfcb0a642e743adf56554fc1d4c189708d81e01f998bfd5f815422f1adf06df7f09ab81e90e8fc14262f3e79c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242166, "uuid": "938b2b61-b101-4c63-b4cd-d3aba740323c", "value": "7BF3C085DBABE87FC45A35399072DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242166, "uuid": "c71a4dee-58a7-4296-a3e2-7a61ab1ffdd4", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242166, "uuid": "743c8a36-1402-44c7-ad8b-81827db6fc86", "value": "3072:8y45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:V4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242166, "uuid": "4771d42e-ad9d-4648-a6d6-8a7a717ada84", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242166, "uuid": "14cb10ad-e331-4f4c-82e9-bf507161726d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242166, "uuid": "30fe3f9f-d4b3-4214-a912-a5553d54e6c2", "value": "5a3a91a7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d465d1-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241954, "uuid": "868560b4-1d8f-47c9-aafe-396a28ba2686", "comment": "Malware payload (Dridex)", "value": "400a76c4df15e6d63cd757c95b884cf3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241954, "uuid": "b318f447-f8fe-4ebc-9abe-2b4b57d06fa5", "comment": "Malware payload (Dridex)", "value": "071717a9b0855c58c939e7be4da31c49ab5ccef30774f7bb291f54ba86ec6e45", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241954, "uuid": "f0cecfb3-9917-4aa7-bf28-7814acd2fbed", "comment": "Malware payload (Dridex)", "value": "78f47558bf245a011c6a37a5a6e4b25cffb420a8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241954, "uuid": "c437d0bf-8434-4631-8071-d5635b25a32b", "comment": "Malware payload (Dridex)", "value": "f23bfc441a5c44ea7dc4a98322ee314e39db37448388ae7e58ac01af26dcc0d4aa12155460f1ad53aa3dbebbdc5589f8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241954, "uuid": "6a5fcb43-479e-4907-a087-ffbeccb0605a", "value": "72F3C085DBABE87FC44A35399471DFFB5B388B149250C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241954, "uuid": "61c342b2-a36d-4894-a7ae-acba26586747", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241954, "uuid": "61e8e46e-1fdc-4535-baa4-c0ac39086cc5", "value": "3072:gA45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:r4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241954, "uuid": "ee12d2c1-0c48-4daf-9f7c-e2871fbc9ce7", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241954, "uuid": "3be84cc4-7ced-4640-aeb2-b7acedab202a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241954, "uuid": "aaa4c3e3-a53c-40e6-beda-c926dd4c3a06", "value": "400a76c4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "101a93b5-ad85-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620207257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620207257, "uuid": "3ff1dd8b-f2e6-4f3d-8492-139e9593c0f8", "comment": "Malware payload (AgentTesla)", "value": "bb45f5360fff79590afe56ff024fe334", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620207257, "uuid": "7bacd7d5-5e36-4849-9132-d41483dd8731", "comment": "Malware payload (AgentTesla)", "value": "07574ee7adb6f02911af112d4d3365be02ad7fefc23b672e910cbf13ff029683", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620207257, "uuid": "f696ed6a-5dfc-499c-9620-62ac1402e061", "comment": "Malware payload (AgentTesla)", "value": "455790b48c2d012ae9eb0cea62149a7e5d62f16b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620207257, "uuid": "67a35978-aeba-4ce2-a055-b482f043265e", "comment": "Malware payload (AgentTesla)", "value": "c428fd95519b1c20182de7010a7e505229661e8ee6658cf8e561f2756d7973695cd00a8b02d927a464f647666d1dd55a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620207257, "uuid": "7fdf355c-3221-4da8-957b-6f27d6546fc8", "value": "0C359D113294AB98F57ADF3565188500D3F5BD06F721DF8ABDA432CF48F3A808B517AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620207257, "uuid": "0db09328-4eb0-4891-b50d-c0a88fc8d84a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620207257, "uuid": "6607e4da-2d3c-4294-abe0-da2b0503ea8c", "value": "24576:hgyvj2KOHGWGlzhLbj+szVDsNooRqhD1/U4H444h:7VOHcZj+siNoo0Hs4H444h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620207257, "uuid": "cd12c850-1b2a-4ca5-af16-47e98c6ab673", "value": 1080320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620207257, "uuid": "dfac177d-a04d-43f9-af3b-b18d535885f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620207257, "uuid": "7b871382-7d94-4960-aced-b1110a9efe7a", "value": "Versandbeleg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329838f1-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209033, "uuid": "6f63f9dd-2c0b-4b6c-af26-77ce92795dd8", "comment": "Malware payload", "value": "93b61135f9d802da71c3cdd3a364fcda", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209033, "uuid": "6152a1a5-65c1-45d0-84eb-d510778858ae", "comment": "Malware payload", "value": "0798c1a5a9aca40096436d1fbd3d0273acbc20f6b97c21a24e530db9278fc979", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209033, "uuid": "14414ad2-e1b0-4dc6-b2dc-3bfe3f272b14", "comment": "Malware payload", "value": "437462e130c2fcdb319ac2cfe465e09a94235980", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209033, "uuid": "79073183-7ef8-436c-94a8-6cfacad3f687", "comment": "Malware payload", "value": "dfc51b6bdd17430b8be774652fffddaea195f9baca1abf606f6b6b19294209e87458cc93a34fed29cd8955c1d4db6a50", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209033, "uuid": "eff22404-3e8e-4fcf-a04e-be9f5aba0e9a", "value": "4A85E05B897A7D0DE2C763F2433BB185EEECA371A1376C8107674B42B6293511B9EC21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209033, "uuid": "3c5bebd2-500c-4c3e-83f2-78351e7c1910", "value": "b6e3af5f4e75de3d0da27dc2d40d1e0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209033, "uuid": "9f62500a-ef04-42ab-bbce-a0127ef71a68", "value": "24576:vipKEKExgXVW4E1JJ9ojfRAyjU5ERMt7FeYO+J5m5C+BqxR/H8vwqxhnnnnwnnnx:6kEKDhAP5E47Fesa5CAquVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209033, "uuid": "f7a9e498-8c5c-40ce-a295-765360d498a7", "value": 1723392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209033, "uuid": "7860e28e-5128-4e69-a946-db8e9705445e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209033, "uuid": "b6dca362-d066-4095-b20a-f75e06e10f53", "value": "93b61135_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4036475d-adad-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620224518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224518, "uuid": "58dda5a9-f754-4d29-9c99-7d1277e0bf11", "comment": "Malware payload (RemcosRAT)", "value": "5810ce2501a4eb374d6645f732c7a09c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224518, "uuid": "b4765917-65ed-455a-83ae-d611388024e6", "comment": "Malware payload (RemcosRAT)", "value": "07a065c4b19b8f98199e9ad84c2b2073e84bf0abdc3c075b9976abdeb5e40e73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224518, "uuid": "e7685a5e-090f-4b9a-b42b-95ee78ac0f97", "comment": "Malware payload (RemcosRAT)", "value": "b10725b4231b66db00b7d070b1598d97b6fedd39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224518, "uuid": "73ddbbf3-c3b8-4106-9386-82fd72ba4154", "comment": "Malware payload (RemcosRAT)", "value": "dc7962b87a0ca38d7f29b6788faded418734cc04768e1ba8058b4b01560490b53599ac014dfe4d328aee4e612b16792d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224518, "uuid": "82f55855-0b23-4dc3-a413-31b647ae1cf6", "value": "EDF4AF36F3C14537C1AE17385C5BB6B51C25BF002EE4A84AABF86E4C9F39AD138251D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224518, "uuid": "193ebce0-b1a6-43e2-896d-35c3ff3a7089", "value": "6b1c05b0b684805cab835263a8e57edd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224518, "uuid": "e84f9090-67c6-4327-86ff-64e99e5af950", "value": "12288:qo5FgaAY6Lwp/38cRQAr/sCu76nHqRAHqb2wrLiU/Oy/O:qv5rwp/Mc+AoCW2quKNuUD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620224518, "uuid": "c3cd7684-9d4e-4669-bbcc-b66077906561", "value": 777368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620224518, "uuid": "03750041-2399-4bfc-8fe9-842f4a25ce0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224518, "uuid": "f1072b9d-a40d-48af-8377-02478b9e55ba", "value": "RFQ-00421-0505.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2744956-add4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241567, "uuid": "26f6f64e-d757-48be-90d5-b7be04f93b6d", "comment": "Malware payload (Dridex)", "value": "1f9990c99ae3bf0ee887c21baa861f83", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241567, "uuid": "7191acd3-ec93-4ae2-9b29-089161824b83", "comment": "Malware payload (Dridex)", "value": "07c96ebfb8d6537586bbd2809484ac12768ba80d492185ad51ff2bed7613c472", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241567, "uuid": "694adafc-27d8-4404-8f8a-8a22643ab006", "comment": "Malware payload (Dridex)", "value": "ee591756e2d163436fb7e9f945219074c377828e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241567, "uuid": "842a3373-067f-43fc-9c4e-0afaba854121", "comment": "Malware payload (Dridex)", "value": "8d604fb11aee0e0fae1fadc0818155ae8bcb71e20c2f8ded53d6762713341c287ed6dbbb5006306ac819468100653d90", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241567, "uuid": "0a5c1d11-1cc6-45a1-8d9f-3d12e2090df7", "value": "1DF3C085DBABE87FC45A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241567, "uuid": "214b5a45-dff7-4b2d-b813-b6af3141af3e", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241567, "uuid": "0e292229-5302-40b8-aa73-cd3f8873201c", "value": "3072:Ly45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:e4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241567, "uuid": "85c3c921-be12-4793-9ab3-16ae004296b6", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241567, "uuid": "61e9f42b-78c1-49e0-ada3-a30f30c5a01c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241567, "uuid": "b1d7821d-b5c7-442d-ae8d-ba1c542f73fc", "value": "1f9990c9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b3172d-adb3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620227022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620227022, "uuid": "6bb91c9f-c8a2-40b5-acd9-527f7b5cbb40", "comment": "Malware payload (Dridex)", "value": "3fcc7d15064f4f16e2e79d8e4c94ce78", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620227022, "uuid": "43e25603-b8df-4587-80db-396dfe1182e0", "comment": "Malware payload (Dridex)", "value": "07e1b828ce8b4eebfd73b050448040614b371a7366f1270735d9ab8bdb44889e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620227022, "uuid": "36a97333-6048-4eaf-883d-620e76d1afda", "comment": "Malware payload (Dridex)", "value": "a0895801a8ad8c2d6cd64bba179ee457afdd96dc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620227022, "uuid": "be54c98c-221c-409a-9b62-afd5aa8c48f1", "comment": "Malware payload (Dridex)", "value": "a447baec0114ad7714dcaa64157d5451654231a1dd3da9d7eb39b7435ff8564d92b7de3f272d24f44174bad13458df7e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620227022, "uuid": "cfe03639-9fc8-4926-8d89-5ba0f66b9e24", "value": "0CF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620227022, "uuid": "7e2018c0-7be2-4915-a36b-c58b6ec315e5", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620227022, "uuid": "96ab1557-ecc7-4185-8197-509a7fb046e7", "value": "3072:2lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:2lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620227022, "uuid": "09839bcc-887c-409f-a6ed-eaf08c837a22", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620227022, "uuid": "02f79ecb-cfbf-488a-a7ea-2dee788aa07f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620227022, "uuid": "7861b52a-6d26-4ac0-aaee-3e4efecc3a8c", "value": "3fcc7d15_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c803a8a5-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201982, "uuid": "a7371d36-7c5d-49d6-86e7-d9be4e22ab75", "comment": "Malware payload", "value": "969cf84abd72093695ada824fb7bb899", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201982, "uuid": "641bbc91-ea34-4d4a-a6f2-fcc160fee3d0", "comment": "Malware payload", "value": "085a972774c849ad789ce702eed1c52156463bb630598e2e8b33a20913ba981a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201982, "uuid": "ddaade0e-d557-412c-9770-194da184ee24", "comment": "Malware payload", "value": "a861b1ca2b07f3236c4b52a686338b1b616f1320", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201982, "uuid": "ff2f74eb-0eec-4fd9-b655-d9ba760d2c36", "comment": "Malware payload", "value": "c0f9c096cafbcc3a982f12b38aa2eb437233ab538cd71434f58a0fc551f1c83cc92eb56abc7990c6bebbaa8f200b9a2c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201982, "uuid": "9d883c7a-1b41-4566-8576-f1432067717c", "value": "96D4BE5AB3220668D30BA577947CDD5DED875C0B2F98AA3F217134BE4F998F0A99D00C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201982, "uuid": "97380e8d-5d45-482e-8ba2-e4e3eaadf2f1", "value": "536594a38d77bbdd59a12634f65863be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201982, "uuid": "50154598-c7fb-4e92-bc12-4accf36c75dc", "value": "12288:WN6QJS8JBH9qRPwQjKGIfqzB48NGFcjD+gABYrlOwTm:eBJS81EKqzB4sYgA0l5Tm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201982, "uuid": "63cc8f44-b413-4926-a202-e485024647eb", "value": 642560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201982, "uuid": "0ad8f640-b219-49e3-acbf-e712c0c8e88a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201982, "uuid": "21130af5-f328-45e7-ace1-0330ba2cfd66", "value": "969cf84a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4739f9c-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252201, "uuid": "f01df06b-6c3b-4e21-92d8-f210f3846daa", "comment": "Malware payload", "value": "34e429b8f317dbd6d4101282c23698f1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252201, "uuid": "cccc01bc-bf34-4a25-a824-5b1270c64229", "comment": "Malware payload", "value": "0885bc96d92ed7e20b695f8081988f40e4c55ec834d0e59c4dabf4574f8838de", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252201, "uuid": "c062e4e4-1669-4ada-9da9-d768c091cf60", "comment": "Malware payload", "value": "2de805e171ee8669e254562054920f244b208e8f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252201, "uuid": "0974575e-5d71-49ea-9930-c9d9448b7ae3", "comment": "Malware payload", "value": "70e6c31c44b3adcad9babfaffdecac45d7b568dc9b20465349ff9e0d5f8955278c268d12bfb6dc8946ac241b8511f136", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252201, "uuid": "ca05966b-a6dd-4515-a321-415a41b6d53e", "value": "3CF3C085DBABE87FC44A35399072DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252201, "uuid": "b9c83fe6-64a4-47c0-a14e-c2ba02619519", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252201, "uuid": "788edb17-3708-4d33-aaff-6670777ea7af", "value": "3072:tF45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:r4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252201, "uuid": "e3f0df22-7e3a-4373-beb0-12f03ed66996", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252201, "uuid": "ecce1711-5b65-4d54-866b-47ed2f678843", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252201, "uuid": "1c46d8d3-086d-4a2e-90cb-2e57a6d053c3", "value": "34e429b8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea7dfc2-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241856, "uuid": "4b81c442-9397-4100-9a67-4f95bd829abe", "comment": "Malware payload (Dridex)", "value": "3c0e4b5c50ddb0eb508f0a0d06ffdd8e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241856, "uuid": "30e2597d-a08e-4c69-9aaf-d472780b1729", "comment": "Malware payload (Dridex)", "value": "089595fc04e757455f15a2809093f24480bcf3d43507ad28ba1a45557507a421", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241856, "uuid": "08b05267-fb9c-4ee3-9818-90684835c828", "comment": "Malware payload (Dridex)", "value": "f5500f8b447acc8ee36faa8752c80cc5c812f120", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241856, "uuid": "d0bcce35-cef7-4878-8a86-b79443aef0ad", "comment": "Malware payload (Dridex)", "value": "de1a643df138c82bbfb0c274cb5b96b82e8fdfd913e02463877b73bc64e9e3b96034ed812278f37e052e4efd415c172b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241856, "uuid": "5b090865-0d27-43e0-b2d9-6f479a1c2e34", "value": "08F3C085DBABE87FC44A35399071DFFB5B388B149240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241856, "uuid": "992b974a-22a2-4244-8171-3474a5ad1ce5", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241856, "uuid": "f7adbfa6-df3f-40a9-8554-a55cf5f50196", "value": "3072:Y945bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:S4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241856, "uuid": "480e54bf-7eb8-48a6-be4a-9958dc919638", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241856, "uuid": "259dd2d9-19a3-4c13-adc4-384e808f035a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241856, "uuid": "661b8c0f-1831-455c-91c8-3b667e2b6854", "value": "3c0e4b5c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1a31cc-ad81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205585, "uuid": "e8604a58-7dc6-4d4a-9a4d-b634fb67e4d8", "comment": "Malware payload", "value": "3157f9cb6965ca3c66fcb4bbdabd1e1d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205585, "uuid": "30a5cb60-492b-4483-ab19-f12f558b516b", "comment": "Malware payload", "value": "08d8403f59512074bd92cbe42f21dbe9120b87b8ebf1f11eaf56013ed332bd32", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205585, "uuid": "ec98d722-7fe5-4871-b9f8-1007ab62aed2", "comment": "Malware payload", "value": "fd98af8a503d333e7e133865cd3ce140fe8b470a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205585, "uuid": "6141139c-bb8c-43aa-9cc8-6217411eace0", "comment": "Malware payload", "value": "eea5dcd1ce32a112fe1f7ac366902572c8e3e0f803fbb042b17736f8070515aa7791d20a0c729e35b4053682a6405e7b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205585, "uuid": "31e0c69c-b38b-4655-b9d9-6caae0e84aac", "value": "A86501D5F3D6AC06F53A1971C0D79AF12287320E2AE4893BED694727BB71414BA4F360", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205585, "uuid": "a9b13eb9-9317-4379-91c9-297e567dc73e", "value": "8561a45b84f0f6c4a9a90b2bf5116baf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205585, "uuid": "ddc40721-aca1-42e6-88a3-3a7dd26c8e6b", "value": "24576:7oyrIlALApMu1slnGrIJK8s1oiBZ4aIYg9/Gii18xirT0tZzNwI5UeJ:k1AS1slnGrIJ9s1owqaIVtpi1ioaFn6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205585, "uuid": "1fad9a90-4231-4a96-b319-ea6ace2f64a9", "value": 1458176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205585, "uuid": "916df1d8-6db9-4744-a1cc-fd2268d16629", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205585, "uuid": "dabf3afb-835a-48b1-aa6c-91d0dd1cf3e7", "value": "3157f9cb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e8f1329-ad79-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620202235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202235, "uuid": "8e2e7c4c-6a21-4092-95bf-f721314f5cce", "comment": "Malware payload (IcedID)", "value": "a6e088b16663d657aec3f8a98788afbe", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202235, "uuid": "0f5b4f23-cfa0-421e-948e-9bf3c1a14706", "comment": "Malware payload (IcedID)", "value": "0957c8e560a30e2454f907d5f56cf13f4d841008ae80754c7d740502f3aacd4a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202235, "uuid": "01f6b617-9abf-435e-8c88-2f02a7c3b655", "comment": "Malware payload (IcedID)", "value": "16341599fea0c15b78199a816b9cf3a844288e0b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202235, "uuid": "35ccff0f-03d5-4378-8616-c65585b15fba", "comment": "Malware payload (IcedID)", "value": "d335006cecc805410ac5e9e241e1d29c6a9995691d15108951484c707dc9b61ec4d0b0ce9cb8088ab5b1db1d4cacfd37", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202235, "uuid": "a0715d1e-9ce7-4432-84c5-c2b85b0de0d7", "value": "77434C91F690F1F1F6E66F7141794F2A903463A09B83359F909C37F6CB7214E1B22A4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202235, "uuid": "7f42a567-b31d-4f1e-96d9-4a8e1eb617d8", "value": "cfa8dd488fd4044f7dbcc5838881a33c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202235, "uuid": "103a8011-d995-4a87-9681-19f05bfde689", "value": "768:Pn8Sg0+bpDPQPqxBtfQqxonY1rCsxPbEBJHVpEyVfkgAv36HAV1Mb7nTaTx:kDtEQBaQoSPIB5evK6qbnad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620202235, "uuid": "26854972-52ac-47d9-ad19-7f03877bfa8b", "value": 56408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620202235, "uuid": "83e954f0-8dc2-4192-abf6-29dfc40ab36f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202235, "uuid": "4899f01c-97ab-428d-81f8-b91ffde742eb", "value": "a6e088b16663d657aec3f8a98788afbe.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e1dbd6-ad87-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208503, "uuid": "60a62627-1ec2-4d38-b97d-b7196c2502fe", "comment": "Malware payload", "value": "a4df03d26e30bf20b85b447d7e8fc787", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208503, "uuid": "0de7773b-3a9a-4051-806d-69ec3692aa0d", "comment": "Malware payload", "value": "099bdac0037d44fa25c78221ceaf4af48696d70ce90648aa9e7b0dcf880e179a", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208503, "uuid": "0396737e-291c-42c7-a288-058b4546edd7", "comment": "Malware payload", "value": "842f51a5aad6476184f6f326039b70b1c97ba7fa", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208503, "uuid": "6bbf7aff-bd88-4e13-a208-baa34c5cbcb7", "comment": "Malware payload", "value": "47ffd8d885aade1aa794a2a84855c28bc0e72701d05b6c0de8f0b813e9357cb6a2cc3bdee0460e795e206d76c14b5e08", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208503, "uuid": "657881a1-d8d7-4e51-8870-002ca6808f49", "value": "E6953379B6DF34BD5AA4A177A7FFC928303BA2CCA05587E06DAA11CE14021319ED4F1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208503, "uuid": "3f4a3f03-7224-4e4e-a97c-15d8bd7f6b1b", "value": "49152:tT0+oOBiXLUNaRHKmjsbS21i2F/ecE+0n9aFctnpbbTruN3MKC:tos909Qg6ecEZHym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208503, "uuid": "7660ef9d-316d-468d-a53c-4dbebfdc1305", "value": 2039808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208503, "uuid": "a78d1d8f-333a-4d4b-b612-894738186aaf", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208503, "uuid": "96f3596b-35ed-4a99-88fb-8936f1c3905a", "value": "099bdac0037d44fa25c78221ceaf4af48696d70ce90648aa9e7b0dcf880e179a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d19786d-adb3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620227009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620227009, "uuid": "342d7ab9-b9b3-43cb-8956-341d966ac1fa", "comment": "Malware payload", "value": "f241f1c41814a4079d5d743ac1cc2a64", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620227009, "uuid": "b255e66e-bd10-4571-881c-93a799393241", "comment": "Malware payload", "value": "0a0fb27fe881390721af84bce20325ee887c1da01566b5644a82fec531c89692", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620227009, "uuid": "fc977c09-b34c-4199-b872-b82fa235423a", "comment": "Malware payload", "value": "a2d6d0a9bb1d0bbac3a4b00c8f2cf02c2c1a1936", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620227009, "uuid": "df8025ec-50ce-484e-8d57-11b357a00466", "comment": "Malware payload", "value": "c8386f7778dae3d1805bcf825f09b2946cdf7e64da834578ddcb7ccadfa425fbb3152176aecc78e86dee76741b4c0c6c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620227009, "uuid": "1da54a14-4f66-4f2a-9e5a-614c75b4136e", "value": "A36421660054F1787802A6AEB73CD3D0D0E0BDF05EDD5DEAA1E6D4661E138F16B83B92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620227009, "uuid": "ce78e805-725f-4ba6-a2c6-f625d177e7a6", "value": "e0533e6b0ac9b87b7ad9ea052e7fa74b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620227009, "uuid": "9a8944a3-ae29-48d2-9dc3-babe86b64df6", "value": "3072:sb+2Xqz9iqQvgFEahrOombc/q72r7PnAhCBy:I+2Xqz9ivICYrOombc/q72r7PnAf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620227009, "uuid": "0a0153db-f74e-42d5-a5dd-ec7516fb7791", "value": 320600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620227009, "uuid": "2556a60a-dbcf-48c2-8bd0-9d6644d64690", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620227009, "uuid": "a947448b-60d9-4cbb-8afe-0660caaf72a0", "value": "f241f1c4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59320151-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620212534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212534, "uuid": "4dee12a6-453f-4d01-9d1d-09d2d2e04bcd", "comment": "Malware payload (AgentTesla)", "value": "f2edca86bb66efbe729d9086345d2aa9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212534, "uuid": "3ddc26bd-8618-471f-98de-fd6602d3a8d4", "comment": "Malware payload (AgentTesla)", "value": "0a23b7f6c2790165d41ce79ee23cb01c8d1f0c2716775a9bc614e35ca1b11a53", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212534, "uuid": "e0088ff6-ef07-42b9-a56c-a0c37b040098", "comment": "Malware payload (AgentTesla)", "value": "921062e07f47b9710bdaa716ac7a6e08fade56cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212534, "uuid": "f94267e2-1d41-4e8a-9e66-a4411719b3b6", "comment": "Malware payload (AgentTesla)", "value": "4d5ea930ce29a22e440019abffd548a45dc6a9cef3bb700f143e0df9f0fcc43cad0821573ddd1b9b8fc7c8920ca42cc6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212534, "uuid": "dc48a598-627e-4064-9248-53b75c19658c", "value": "B9454BCEA090C8D7E96B05FD6D6BA53012A36EDD94A4C1CC675D771A36B3342209FE0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212534, "uuid": "439bef0a-e391-4b2b-a4c1-55cd3d0b594e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212534, "uuid": "610dc138-aaa5-4eb6-b74b-c688aef1a9f4", "value": "24576:7QiJbaiJbxiJb++GDv7bPkwYIMPtYy4V1qZdB0:7QiJWiJNiJDW7Q0MV74VkZdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212534, "uuid": "191e8cf5-4196-4929-a875-d70de6d0af76", "value": 1194496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212534, "uuid": "36eada83-7a63-4263-8fd5-dea7c5eb2c17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212534, "uuid": "e2bb28b1-9f5a-474e-8864-46133cc26375", "value": "12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb791f0-add4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241480, "uuid": "54994745-2c07-4792-b2c0-02a01292a60c", "comment": "Malware payload", "value": "7a13cb41e231348f2b817063f5ed156f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241480, "uuid": "b9c25b51-ace6-4eeb-aae2-8c27227ff662", "comment": "Malware payload", "value": "0a42a801021fcb0cc7913796b092f2223ddb117b732d3bce8605b20ceeec1d14", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241480, "uuid": "df4168d8-7a50-4a77-a2c6-9c3047ee5317", "comment": "Malware payload", "value": "21f71ac020cd1609d840b4108c33d3cdd2a6da51", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241480, "uuid": "9c46c4a1-84b2-45b1-8a3e-94008e131e89", "comment": "Malware payload", "value": "9a1b245cac93231cb3584ff0052cbd36c87a8f762ddc24886a00991db98d7e03b357e0ccc9bf91e3f6bb586f3710f2b8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241480, "uuid": "9ba2f8e0-054e-4b9b-a2ad-41a4b32ea257", "value": "39F3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241480, "uuid": "f07a0a1a-6b5c-4593-9bb3-4a4fc8fbfa2c", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241480, "uuid": "f4676fd2-5118-46e2-a2cf-02f6ef586ccb", "value": "3072:Hi45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:C4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241480, "uuid": "73d9f2f6-ccb8-4b58-a1b6-5585c57d2e72", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241480, "uuid": "fa5c67e0-5b89-4868-b704-d0c49505b33b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241480, "uuid": "9c6c8110-6708-4969-99e0-76c24912e328", "value": "7a13cb41_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb10ba50-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241984, "uuid": "35af73a0-8b3a-4e7d-86ae-10a4e6c4ac41", "comment": "Malware payload", "value": "b44ac0a72ac1dd5b2776e70d2e3088d3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241984, "uuid": "b893567a-849b-4608-ab44-fa55f4949524", "comment": "Malware payload", "value": "0a5094f494807201197c0fb9bbcfa4940f8392716fb4ee9d4a3d7307ede7e099", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241984, "uuid": "ecdf205f-5841-4cfb-8c39-7d0785370bd6", "comment": "Malware payload", "value": "a337711bb30c79ea7771a7d3530f94a971c234aa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241984, "uuid": "c1acc1ea-e0ec-4076-82a2-b9eafdda4d54", "comment": "Malware payload", "value": "7e0a255257828470f938a9d3aece92808155419c7819f521d0785da39581bcf70fcc7464d5d20a1f16113636f15117d6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241984, "uuid": "0d542cc1-c071-4f6f-93db-5e555582b96e", "value": "75F3C085DBABE87FC45A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241984, "uuid": "c3dfb354-e3ef-4234-99dd-b060a374dea5", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241984, "uuid": "199d0f44-655c-4125-b7c1-205c4b4c6698", "value": "3072:1i45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:c4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241984, "uuid": "1afe396e-5532-414b-956e-886f0905ff2b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241984, "uuid": "c7efafdc-75c0-44ca-90a8-24b11c28f16b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241984, "uuid": "05d8736d-d72d-4730-9ce8-7cc88f5ef2e3", "value": "b44ac0a7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d36c9a59-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241945, "uuid": "fcb1100b-04e2-422e-b308-87cdb821930c", "comment": "Malware payload", "value": "cd8376a9ec91f00324a09af2302ae64e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241945, "uuid": "d02c2390-20bc-4964-8761-7633e2647a18", "comment": "Malware payload", "value": "0a6408bc32ce20278d413e03f6e9d86798e0ecb4582fa83c8d2513c32dee73ac", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241945, "uuid": "7ada4644-6538-4c6b-81fc-55f27d63867d", "comment": "Malware payload", "value": "1118cc99b66acc55132cd823d05bc8805d3a0c06", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241945, "uuid": "eea4a927-09a1-4a12-97ea-df785c33786f", "comment": "Malware payload", "value": "afdac6b7ddbf30628fcf050d797e766d0a075beb58159dab36bd4f4c23a8fbb946f1d4ec74e8df1fb441ce31d981727f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241945, "uuid": "0f5cd597-0768-401d-832c-6f01038e42e5", "value": "FAF3C085DBABE87FC44A35399071DFFB5B388B145250C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241945, "uuid": "ec74669e-2cd5-4e70-b9c2-bac7b9ef711d", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241945, "uuid": "2548dd62-c8c3-44d8-9a0a-6891485cdc34", "value": "3072:Fw45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:24KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241945, "uuid": "96f36115-6fc0-490d-b346-0cbbfe6c4164", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241945, "uuid": "20611951-920e-47d4-a80e-a6a0aeee4ae8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241945, "uuid": "42b7d6e1-0996-4eaa-a3ce-f6df31e15276", "value": "cd8376a9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d6e4d02-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252511, "uuid": "2b7c1637-a7d1-4048-9016-4d9347d2632e", "comment": "Malware payload", "value": "37ae9b8b858b28b9597798b6da5d8f27", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252511, "uuid": "cf34dff4-5b86-45b0-b72f-14642324f773", "comment": "Malware payload", "value": "0a691b51946c0c94cb5240779acb4586626b909e7630915a66600ceb81cb80b8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252511, "uuid": "c37799cd-5f66-4df6-9d62-904d9e2e3dd4", "comment": "Malware payload", "value": "a2dfe9137237add5e5c0d99857725906a38c4bb7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252511, "uuid": "aada68b7-4773-4b1e-813a-b8d46fa75891", "comment": "Malware payload", "value": "05634059af46955a52d9678c2c0393881e1464328371c7d12fe5ed4d8c1c42bd0239b37b6cae76137e9b5a1b4369db2c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252511, "uuid": "c7b299fd-3537-4962-aa75-6d80aa589638", "value": "DEF3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252511, "uuid": "ec03370b-ab2d-4a40-854a-ebbe12a83ce1", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252511, "uuid": "24da199c-c8fc-4965-9b83-81e693991a09", "value": "3072:Dc4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:fDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252511, "uuid": "404fad2d-c156-4d0e-8985-0eaa296c4fda", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252511, "uuid": "e970a49b-4cb1-4b85-898f-52939e2643be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252511, "uuid": "e1f47605-7e7a-4aa8-abba-32009dc5dfb6", "value": "37ae9b8b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef08ac38-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620202048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202048, "uuid": "d8d7cb18-6ca0-4ec5-8562-fdb80ca03403", "comment": "Malware payload", "value": "5feb75db85c1c1b7cb88b8dbc250d500", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202048, "uuid": "ed81a4d0-baa1-480e-98ca-6f67e73ae106", "comment": "Malware payload", "value": "0a9e2160871be8409cb531b94c71e5411d8f5dcfcfc40c37b65a56923ec71daf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202048, "uuid": "d9a8c05a-8642-4932-8b5d-4b7e634ead7a", "comment": "Malware payload", "value": "ae8fdb801b84a4d586f073e41549bf4c194b0533", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202048, "uuid": "f94343ce-a659-48b7-801c-8f5d2607672a", "comment": "Malware payload", "value": "fcaf5c013437010c1c3ab1fd8830aedf06a0cb5ce82423eebaf6ff1124e2c63b42a18642f355712d910dffaef384a793", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202048, "uuid": "a05b879d-068e-4249-9360-a1cdd864b84a", "value": "52D4F1748ED87AB4CC47E23AF9500B9DCDF794A0925FE8C68EA15331AE98531D61C90F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202048, "uuid": "584e2fa1-2965-4fcd-bf96-76dda556afe8", "value": "95fbae75c540f8dcb85c5190e0ee2cea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202048, "uuid": "3e2eac88-f6f3-4ebd-a908-822c56021610", "value": "12288:rG4OWWjugELGTLgyQ2kFuB5tDFfH4wGFihxPKqQV5cpsGZxxQ6nqsiDY:rG4O1yOB245EXFihxYQDxvnQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620202048, "uuid": "b6141c1e-3510-4332-a214-87e537c903fa", "value": 633856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620202048, "uuid": "b4239760-d727-4ce7-bc0b-fe94c44add6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202048, "uuid": "9ac50fd1-98c5-4fb9-b9e1-8837e0f4f8fe", "value": "5feb75db_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4666cf4e-adac-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620224099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224099, "uuid": "36758a52-8bf8-443b-8f47-c9e854e4de0b", "comment": "Malware payload (SnakeKeylogger)", "value": "96b28cc82f6d16c41c4abe1971bcdb53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224099, "uuid": "7242f507-ee85-4b50-b073-1b83407ade67", "comment": "Malware payload (SnakeKeylogger)", "value": "0aa01e452dadec50166b85111f228e25ef59f51b92ccfcc148f24376c7265eea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224099, "uuid": "501f4532-68ac-48d6-9e8f-af55a3433afa", "comment": "Malware payload (SnakeKeylogger)", "value": "183d1696b77958cf93b60173696b184e41355168", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224099, "uuid": "063dcef7-6035-431c-94ff-b280242e3428", "comment": "Malware payload (SnakeKeylogger)", "value": "04f5ec10b0fa64a244d15cf2a90f6f12e91597ded30524cb8e5375a7142e2175b83fe52c02f600a9f450364bfb18968b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224099, "uuid": "2047625c-454c-458c-9fda-a1419bc60d3d", "value": "3B15023E25087E01D87D1B3BCEA4D460A37AFD16AA53D62E6DE0357E6977BF40210227", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224099, "uuid": "db349f93-b494-4ee0-9ba7-db3f1c7a97f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224099, "uuid": "fec1a6f1-5660-420a-969a-94e23ef37fb3", "value": "24576:KnU78EfIhohLZ/QiJC4eHuP50RariZDcqzSxc8IN:KnenauJC3OqgriZDYcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620224099, "uuid": "8fd9b1ac-f03e-467b-8304-4efaf3903bd3", "value": 904192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620224099, "uuid": "00dea6b5-1abe-4307-849f-01541f81d4d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224099, "uuid": "6a0e9ceb-7ee0-4da6-a7bf-61a0568c6266", "value": "Quote 61095439.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fae15fd-adbb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620230530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230530, "uuid": "1e8accbf-2433-4a7d-8a6c-299665fde886", "comment": "Malware payload (Dridex)", "value": "cecdf8565540411943a4f98a1535fe93", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230530, "uuid": "ef510b30-c874-4334-8905-b33081a684ac", "comment": "Malware payload (Dridex)", "value": "0aa679cbd933f516eae2d2673d12ed7d4c373cf0ed5c3a76447949ce3744e6e2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230530, "uuid": "e3a11661-60e7-4f81-9086-0a2f46933d44", "comment": "Malware payload (Dridex)", "value": "c67e7e9389d6293945d1c0202822d4e32ce8eba3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230530, "uuid": "a2a2043c-92bb-4260-b62a-f4a9d838687e", "comment": "Malware payload (Dridex)", "value": "c669325dbb7d5446b3469919e2758ae0f3b82ca0be4313351671370e6069788b9ff6e58f1982ba71e44fe9177a3f0c74", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230530, "uuid": "022e2b01-c890-49a6-9218-1fd2c5e8e0bd", "value": "13F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230530, "uuid": "ca2a0f49-7b18-40cd-9fdc-d74de599bc3f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230530, "uuid": "4a09ad4b-b293-45c6-a78c-ac197f59267b", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620230530, "uuid": "053a5415-db6e-44f4-8e00-ae54a632c6f8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620230530, "uuid": "899a6f83-fe30-4e45-a2e8-45236866b6cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230530, "uuid": "1d970486-10fb-4353-8009-335404411436", "value": "cecdf856_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1472e9e4-adc4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234323, "uuid": "38644032-4b0d-433f-9d9d-c3e1afc223cb", "comment": "Malware payload (Dridex)", "value": "f9d689b634e299dcc7c3e369dc762a28", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234323, "uuid": "108d4b76-9767-4607-b804-6836618c3452", "comment": "Malware payload (Dridex)", "value": "0ac7b0db60f2e52bbd3f6ed408116592f6d1b427bd60054ceb3ea7431d2098ed", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234323, "uuid": "221769f8-c6c9-4716-8c37-cff096ab1f37", "comment": "Malware payload (Dridex)", "value": "34cccf7255d2a265e962ca5e75fbf7b05630adf4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234323, "uuid": "e17293ab-0d5d-4e7c-8400-3b6422f304af", "comment": "Malware payload (Dridex)", "value": "b99637f8aa329f81b88ac542091af3a1c1fe6ffaa54a2a7d3007af4a6b64eb424c6720a675d6e5f5b0b4db97c9b7d478", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234323, "uuid": "a1894bce-d9dd-4fbb-9cf9-01caaec61d76", "value": "BDF3C085DBABE8BFC45A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234323, "uuid": "0915ae52-2843-4df0-a859-54de3d285e64", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234323, "uuid": "6031f9bb-343d-4eae-996e-61c26f362810", "value": "3072:nE45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:E4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234323, "uuid": "dc0df154-c457-462b-a0bc-fb1cc3ad5418", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234323, "uuid": "957c5b1c-7a1e-4f99-a14e-255a198cc033", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234323, "uuid": "dd6a58fe-d84f-450b-bd12-c3f3f9d25a6a", "value": "f9d689b6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d499ce69-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212741, "uuid": "8c0c047b-2f79-4ad9-a050-d36e047e6d82", "comment": "Malware payload", "value": "edd7f20cbf0bbeba8f89b34478d2559b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212741, "uuid": "cc4372b8-e1cc-4c34-9485-168f0662fac0", "comment": "Malware payload", "value": "0ae761262984932fca03895ba51579af9f39918b2bd4e69a77c4c3d395114d8c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212741, "uuid": "6fa3bf1a-07e6-4a15-a4dd-4b1a74ff1275", "comment": "Malware payload", "value": "622acfd10f94f56af383ef3a6e5f09ad4b3b6ee6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212741, "uuid": "64b9525e-dc60-49a5-a33d-f2e5c06d50df", "comment": "Malware payload", "value": "a8062de941828207b88e92b2e917b31e9fc529cdb0c46cc5650c9b9b5e47c466a8df8b09aedf346bcf2f431c8df9d38a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212741, "uuid": "5cbef85d-e666-4b6f-b55a-4151377e4916", "value": "6445A2B589666F3EE76BDE1F89BF392DCB1523B7BB43B18B002025450532252AF0255F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212741, "uuid": "b654a141-f1ee-464c-a665-737a140dc340", "value": "53b338a5a343440770be2403e59415fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212741, "uuid": "bdec7986-dfc1-4972-b716-8fd67768e640", "value": "24576:OmEUndE0ksUDLQupipsz1BAv7Y6TNbwzQCiW0+n67zZ:0Ud+bpimhBVQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212741, "uuid": "35e3bb22-9f07-49ee-8045-66117d521117", "value": 1244112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212741, "uuid": "88d4cf53-ffb7-44eb-9deb-c4376023d9cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212741, "uuid": "3628c5b6-3cf6-4703-8eff-afa9afb6fa81", "value": "edd7f20c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c66db80e-ad63-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620192960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192960, "uuid": "a6685052-b1c4-4fe3-9bd8-195291a1438b", "comment": "Malware payload (NanoCore)", "value": "a3504dd22a41982120e2bc927ed8463b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192960, "uuid": "18d235e6-df42-46e6-9fdb-8fbb49f48fa2", "comment": "Malware payload (NanoCore)", "value": "0b27d1793f760c395a4ebaef46c3cd6aaa8eb876e3688768691a3b6121a479e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192960, "uuid": "dae10953-ed12-49cc-9f76-cccb0f239c19", "comment": "Malware payload (NanoCore)", "value": "c6be8c15884315987975cb32f01e72abd84d254e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192960, "uuid": "fa46a57a-20b2-4356-a988-73aa063ed387", "comment": "Malware payload (NanoCore)", "value": "b6dc1dfb98ae1e6358735d08cd400faeff1be37c53cbec895cd98d221da3ce6a341ea08680b1d37930b702383a75ad08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192960, "uuid": "655e5752-0644-45c7-a193-f2c1724a9c7a", "value": "0A14BE5537A94A2FE2DF86B9711256029378C2E398C3F3DE18D459B78F223E50A0B1D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192960, "uuid": "e136c11b-68e5-43de-9e2f-e97d89685e91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192960, "uuid": "71dd94fc-1331-440d-816f-ddcce852d5a6", "value": "6144:QLV6Bta6dtJmakIM5agCpVBVl30m8A2CSFixQf3:QLV6Btpmkngqv3ftEFnf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620192960, "uuid": "a0bb41fe-c784-4b11-88af-b8495f57164d", "value": 207400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620192960, "uuid": "f7490adb-9890-4565-9889-a5959eb82f34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192960, "uuid": "33ea98b2-44be-4bce-984c-948d140930e4", "value": "A3504DD22A41982120E2BC927ED8463B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25db04b-add4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241540, "uuid": "ba055faa-1d3c-4be3-98fc-0f4afa0b4f8a", "comment": "Malware payload (Dridex)", "value": "0995514de5358af45ae057e5e628ce6c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241540, "uuid": "bf35a93a-5321-46b1-911c-b353e18eeabf", "comment": "Malware payload (Dridex)", "value": "0b293514bde0339043226cf46db1f0370bbf60a2a80b0d33c9e67d9cd9b67b01", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241540, "uuid": "60a296da-2f35-404a-af53-5ce544351f34", "comment": "Malware payload (Dridex)", "value": "3e9e3641bbcc6d5777aa37af42b346cb64539da7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241540, "uuid": "bf4e53aa-17c5-4335-a1c8-3fb67e54f5d5", "comment": "Malware payload (Dridex)", "value": "5fb179c127ceaa3251af8fb6ebf745d763d2b8a6d433da85f5d1eee1beef83587a2e24eb8ae2ac07c52cd0988d5f105d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241540, "uuid": "25f2a8ce-badd-4f49-a6a5-5770a9485db8", "value": "9CF3C085DBABE87FC44A35399472DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241540, "uuid": "ed3d8bab-b3ea-4b43-a3f5-ca55ff80b80b", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241540, "uuid": "8af12279-fbc2-42c9-ad02-67d95d92cc97", "value": "3072:NX45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:54KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241540, "uuid": "b9c684d4-ceda-43bc-9748-9c1cfc6edcef", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241540, "uuid": "8a5beaa3-433a-48e9-beae-8d004f8e9312", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241540, "uuid": "14600e17-8183-4c93-835b-1153d034fc66", "value": "0995514d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b57277-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252652, "uuid": "bb2e0f01-55f1-486c-b408-4fd58ff63412", "comment": "Malware payload", "value": "1e652a896315ae35d3f948c29ecc1a6b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252652, "uuid": "fe0c43c1-122e-4371-bee9-96ce5fdf5dc4", "comment": "Malware payload", "value": "0b3da59a540b25f2f283552427688a06e06fee7f7d768438b44bdb124a7a90cd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252652, "uuid": "121a75a8-5255-47e2-828d-a6afd8cc0799", "comment": "Malware payload", "value": "dba2769e40a12369ab0115020f199f9f7f23c743", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252652, "uuid": "7258cc4c-ca29-4990-b09a-d6f1f2da62f3", "comment": "Malware payload", "value": "8499fe4787212ca5b8597607b69be799cb7e3e897b22c6b96487ad1529d151df8b44c4de28c3bb34ef7e0c00fc230f96", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252652, "uuid": "683685b1-c4d9-4183-801d-d8dcafaf31a3", "value": "C2F3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252652, "uuid": "48feb54d-7a5c-4f43-a25d-a8b6f8d29d6c", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252652, "uuid": "beb785af-243e-4a17-bacd-2ff6a9753ef6", "value": "3072:cF45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:u4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252652, "uuid": "0d28a174-7177-4ab9-bbbf-6c183a8aeb07", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252652, "uuid": "46604721-5671-4228-b1bd-6d6c253fc7f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252652, "uuid": "aa5d5afa-df26-4ab2-bcbf-1626974a5f6b", "value": "1e652a89_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a4656e6-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252452, "uuid": "4a105d9b-348a-4f1c-b4e3-a50156d08c21", "comment": "Malware payload", "value": "67557543e305fa66e2f0f922ac59039a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252452, "uuid": "f26a24d0-1fbd-4fdb-ac9d-310bf107d6ae", "comment": "Malware payload", "value": "0b4d59297ea2d31f47c3f0f3444638ca37ff569dd6aa948e42f042a4c007918c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252452, "uuid": "d8bc695b-f410-4c1f-aa91-2f0277f11a0a", "comment": "Malware payload", "value": "d1b2c86fa9cb832c9cf0370dce27f6e549c10016", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252452, "uuid": "20cdb18a-afbe-4b87-8c84-cf2d5abf6516", "comment": "Malware payload", "value": "31a4243793b1f52fb876dc568cc40476f468a9bc02359c85253dd18cfe30f03de9ed94d13f678739db2d7c35907a00f0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252452, "uuid": "9b598b31-a548-4635-904a-54a0bc8d30b2", "value": "CDF3C085DBABE8BFC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252452, "uuid": "9106b9dc-78a8-44a1-aa81-31119bcaea94", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252452, "uuid": "9b26423e-446b-4165-8845-6c7af5450934", "value": "3072:GQ45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:t4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252452, "uuid": "d58bb462-36a1-4f0b-8b51-8829b747ecca", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252452, "uuid": "6d233240-86be-4888-9dc5-3442f0754eca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252452, "uuid": "ec9523de-0d3d-4bc1-999e-2f42ee70606c", "value": "67557543_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c49a4f1e-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209278, "uuid": "cf4e85a7-386a-4232-94b3-eca703cbd06c", "comment": "Malware payload", "value": "2a91055f33f489374427581856a2b245", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209278, "uuid": "648820f7-ca40-472d-a257-7fcbdf076b8e", "comment": "Malware payload", "value": "0ba08feb0706a11d009ed6bb5edbebadb2d860ca0451d90677a79abc917f67fd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209278, "uuid": "73b1b8ad-9036-4648-b9a3-de7c83915a1f", "comment": "Malware payload", "value": "85341bef903edfd814d0d7f897d6b53eb428aa8a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209278, "uuid": "69c941fb-163c-466f-9e3d-20f2ce0acdf0", "comment": "Malware payload", "value": "da7ae792f98532b76acdca48af3fca8e57a7ec810cd971567d6397e9d8dc4430cc5c66e5cb3da28bb8eabab48e422fdd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209278, "uuid": "11fae0cb-7d0e-4852-8642-0b0acd1f92ed", "value": "E965F11A0950C2FCCCBA11B0DD526E4BEA77D7295B43DC9C149B0A1E620CF5E977E0EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209278, "uuid": "25bf617e-4bcb-4896-b345-f6ffde794013", "value": "aca406964cfb73e9629081783689b909", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209278, "uuid": "15cf7fed-0336-4984-b7a8-a18620a6f909", "value": "24576:ESI5xByoEgdbDviJnzjVs85v5kerHNrEaodYurXxS/swi5sdimJ1/ggYDAOGULLy:ESI5xEGipJs85OeRSYUXxQC5Ah14GUXy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209278, "uuid": "4b633e82-52c0-4f62-8d82-78bc2b93415b", "value": 1463296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209278, "uuid": "00bf80e3-0cf8-415a-ae7b-b12190848dbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209278, "uuid": "db66eacd-803d-43a9-a3d5-04638c69df7f", "value": "2a91055f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a92544b-ad92-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212885, "uuid": "fdeaba83-810b-43f6-9a56-7bc343f184b4", "comment": "Malware payload", "value": "c9c177f6cedaf826c0ddde31ade2ac31", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212885, "uuid": "bca5f956-6db9-4c96-9aaf-c891fc7a9ad2", "comment": "Malware payload", "value": "0bbd7808a451a726e2bb1226af19054f1cd7689dc9ed8f9d0d54121cb6662842", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212885, "uuid": "32e8aacd-e463-45b8-9eb6-967f6dbafbb0", "comment": "Malware payload", "value": "5d231be3e6d48a6cdac3869752c8ad0bfe326215", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212885, "uuid": "3db546d2-7e70-4386-9b4f-e4e1b0920a06", "comment": "Malware payload", "value": "4991ce940eeeb8b36476bafa80a14089544509d9e6a7bab50abce0471d2dcf18f323afe6f3d10826104f8c8f42e66819", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212885, "uuid": "26910a29-bea6-448b-ba1b-acc300f24f2a", "value": "190501E37C3340EFE58AD6FEF44CB591E551B511BDA4D8E61A802E1D253AB80AFB0523", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212885, "uuid": "58e0842e-8ee2-4213-a5e4-b6a9733d8ede", "value": "9afcebeaaa99867fd7bc7e270cddabd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212885, "uuid": "f52e0b37-7954-40d2-936c-6d55857f1144", "value": "12288:NUa+R8hfi41hcY7pTMmLcN1bFCFW80C0GWWT2RCahVDFveC5R9Z7mcZwTnRXg:xQQi4zcY7pT41xUW80nGLdg2C5Rrmc2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212885, "uuid": "3363b95b-ee0f-4a6d-adfa-0f490bcbb7e7", "value": 845824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212885, "uuid": "c083ce17-7ad4-404e-90e1-6b0d8b3ed5b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212885, "uuid": "5438c7b8-9c83-4ca8-ac64-2dac8afa2c7e", "value": "c9c177f6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a514722-ad9c-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620217287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217287, "uuid": "41bbcf10-9b96-49df-afee-05e3627b39f8", "comment": "Malware payload (RemcosRAT)", "value": "9f910ba7ff05efd30eb1c2316bb488e0", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217287, "uuid": "d65b3434-7b6a-43cc-932b-4a0a336b7c48", "comment": "Malware payload (RemcosRAT)", "value": "0c2f78458061b2e848305409a90351eff2c4c31eed1a4667b6366bfdc43ef52a", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217287, "uuid": "5295be25-470e-4524-8724-d22c8eb35142", "comment": "Malware payload (RemcosRAT)", "value": "3b428f5cf8b0c43b8b63bbaf728669a83f66458e", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217287, "uuid": "5f376d6a-03ec-4b8f-9bb6-9fb71afa416c", "comment": "Malware payload (RemcosRAT)", "value": "73ccae8b767b4224e65d02c08dbf82279f6c6c692473c996332a6bbe7a0544663c1006b73d88842fe2dfa4303b16808b", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217287, "uuid": "c125dbff-2b7a-4389-8eab-c6fa8ca31092", "value": "10159E097380A345D2D56A72DF02C1B44BF29D7BA521E28B50F83DEBBF5C607825ED26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217287, "uuid": "c5050ac0-5cef-43cd-bf14-786fb043bd27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217287, "uuid": "19815587-c06f-48b0-a06d-c796b4d64842", "value": "12288:SDsh2mxMdeo86HiBADJuSxRvi1W8rLZ23mcD2zvdxmos7QTLlzZ:S1X2VI3mcHos8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620217287, "uuid": "8b735488-d8ef-4c81-bc34-b9b853704d4d", "value": 918528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620217287, "uuid": "44791b97-a7e8-4163-bc43-2da7b28c5154", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217287, "uuid": "a5782741-8028-4c18-96b0-a7a873d6748d", "value": "SecuriteInfo.com.Trojan.MSIL.Kryptik.4625f314.19991.25291", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ea38c5-adce-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620238963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238963, "uuid": "830f31a7-c2e2-4c75-b938-caf46c8b2ea7", "comment": "Malware payload (AgentTesla)", "value": "4d8f8975d80b7d75f3c31138336b93b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238963, "uuid": "8473cee0-6d81-4974-aca1-1f298692bc58", "comment": "Malware payload (AgentTesla)", "value": "0c469bcb6a1bf348de2a5055fc2266ac2a8371627b88cb9f630703b958f13f13", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238963, "uuid": "56c1db52-8f92-47f8-93c0-1bfd75c8dd17", "comment": "Malware payload (AgentTesla)", "value": "b2062c84a450ca3bb43671610f2a828402887aa0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238963, "uuid": "eb9ecd97-bf1c-433e-a2d5-961c29fbba97", "comment": "Malware payload (AgentTesla)", "value": "7b7937ab80511ab5a1d8afc44a7fd4d9dfa7cbda5d01623a2cd176b37e0f77ba11eff03531ac89f666b6dc49329b2ec2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238963, "uuid": "0fc8a6a1-261c-4a63-bf18-d34bad88e53a", "value": "17F47CAC751469F0D35B5D22A3CF4C0643651274A93BEA0A8F6013FE1A67F173E3998E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238963, "uuid": "fa5ae887-5319-491d-968e-00823a15e396", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238963, "uuid": "26411038-cc63-4315-a1ac-c691b8a3e83b", "value": "12288:wocOYqoLLoS60/K7yh0Nk7IOvIONyGB2ley4CqBIYemFjhQOP4a8d3Or:HcOYqoLAN4IOvgGMuBIwFdQO4pOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620238963, "uuid": "1e50364b-6b7d-4363-8c50-c694adf73a6f", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620238963, "uuid": "223920c3-e700-4962-9b31-a6836a8394d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238963, "uuid": "acdf54cb-3f85-4f46-af66-57620fbc063a", "value": "FACTURA 6476.BAT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffcf234c-adf5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255763, "uuid": "17afda22-cfd2-4cfa-afe8-cc3cae253106", "comment": "Malware payload", "value": "8a38501be59c3ed1e08b97e58bff752a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255763, "uuid": "100c19dc-dd96-436e-aa86-a7a65b6d7048", "comment": "Malware payload", "value": "0c684b7209c452b2fca718f870f0e60a5862612d31f24bdd348b01b8f4bcb0e9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255763, "uuid": "eb0d0f95-9499-46b3-bbef-0db7df04ba21", "comment": "Malware payload", "value": "867b7143a315cb09bfba5ced9bf17ac4bd2c43c2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255763, "uuid": "8c5cb027-296b-47b6-8bab-55f041d3203f", "comment": "Malware payload", "value": "773b524225a088fff3c86835483109341e8195454716bc9d3a8285e7a97171e0bf7c4370930353632815dc443f3fd39a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255763, "uuid": "f98673d6-067f-44cd-b15f-11a132edb7e2", "value": "A9F3D088CBB3E4E6EFB3D37866F85E1B561574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255763, "uuid": "f77f02ad-1133-419c-8de0-34155855c018", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255763, "uuid": "608d86ee-925c-4659-a2de-3ebd3c8ff95f", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255763, "uuid": "8f4e2ab5-c5c7-4919-b575-22c3b6403144", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255763, "uuid": "84d6a094-ec6b-4fca-9153-7dc80a93d05d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255763, "uuid": "37563dd8-13d9-4ab9-b371-5dc5b5ab6340", "value": "8a38501b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dbb33c5-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201750, "uuid": "122b7b83-48b6-4c42-8811-041ede571817", "comment": "Malware payload", "value": "4ec4a9fdc6c32b36576b76da94cc1efe", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201750, "uuid": "07cb379c-e46e-4d1b-ab2b-d7762fac9ae3", "comment": "Malware payload", "value": "0c707a14cb7de3e7380454c6659a0493d8b328b09d38204e431dc584d9e66249", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201750, "uuid": "e90982ea-c1bc-4f01-92ac-bebe48cf717b", "comment": "Malware payload", "value": "09ba44ec9165828c4612d5dca74b0e080c95f2e7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201750, "uuid": "9c0ddc26-7c37-480c-8571-1196f734522a", "comment": "Malware payload", "value": "32ad8dbaf6273d55af822783a0d4d13a8fdea54f3ff7f08232d1d374076cda553e2891d5ca6915681bc8dbb8ad319ed5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201750, "uuid": "a0a47906-f8c2-4d5a-b6cd-1a7fd72aee03", "value": "90D4F1997F3F13BEE02712F37ACAC471AE4C5AD1E2D5DA91D3901604C29BAF08135A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201750, "uuid": "6dc019da-5981-404e-934f-7ed987c9a8d1", "value": "26696c51e47e53ac8808268059864ca2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201750, "uuid": "1388edeb-6e97-48db-91cf-7c438e636006", "value": "12288:FvXg5jPsHrSWmQ2BQIxDU+r8jpKfuYii8lXpY4a/XV74YvvyRk5YBFnhVNwN:N6mrjmJxAUxV8lZ+t74wv2k5YBFhVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201750, "uuid": "54c18e35-2e65-4c07-b6fa-615272d8b97a", "value": 628224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201750, "uuid": "a18bab46-0ba2-46a6-99f2-6d66bc9fe009", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201750, "uuid": "4d0d461a-7f6f-464f-9cb1-9a756060db35", "value": "4ec4a9fd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b1443d-add4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241361, "uuid": "22d2cc37-cc93-4681-86de-048ac28ae389", "comment": "Malware payload (Dridex)", "value": "09f7f8b95d98266185968c08b8eab693", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241361, "uuid": "75522c9e-759c-4698-b262-ed7781a69d96", "comment": "Malware payload (Dridex)", "value": "0c950d69bf5e21c48a961ffee1a0e059b59d8445e65c527df794aa9def17b08c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241361, "uuid": "547d3efb-ecae-49b9-bd78-30a51d1ed337", "comment": "Malware payload (Dridex)", "value": "66bdd9812eeccf6fbf4423b3b33682af34c3a66d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241361, "uuid": "275a2780-dd16-49cd-92de-f38ff6691354", "comment": "Malware payload (Dridex)", "value": "a44df4d385b08cf23ea34450f923b9e956c6e03d7a5096e96bd3de5391d6da7a0b222523d0e1d8aceed5b234d84893f3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241361, "uuid": "a921fba5-78e8-466f-b864-aca255219660", "value": "29F3C085DBABE87FC45A35399471DFFB5B388B149240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241361, "uuid": "eb7f6167-9150-4154-9f8e-97f3658267b0", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241361, "uuid": "5f9eef1b-7399-4f4d-befb-55d075d32252", "value": "3072:jz45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:X4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241361, "uuid": "00508d99-a6a2-4cae-ae9b-2a45343576e2", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241361, "uuid": "b1fb3f49-3908-4e84-a8c2-06c57dd059d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241361, "uuid": "f703d8fc-f2f4-48e1-9c19-c90eb6d58d26", "value": "09f7f8b9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6190cd9e-ad47-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620180765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180765, "uuid": "0c2ebefd-2d8b-4394-b4da-c07a5be1f5be", "comment": "Malware payload", "value": "64bd065255ecd979f3ef242356f2839e", "object_relation": "md5", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180765, "uuid": "631da769-69de-40eb-80cd-0d8bc130e310", "comment": "Malware payload", "value": "0c962c7f12c69f51db3acc8bbe2d914a90b8a02dfb4cd33ff163a51c135451e6", "object_relation": "sha256", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180765, "uuid": "dfc2b959-84f7-4872-bb9b-8f122439345a", "comment": "Malware payload", "value": "5e141c4b2711fcdcd10d17761eace7c2c3279f95", "object_relation": "sha1", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180765, "uuid": "92085a01-0c8d-4465-85d8-b9c440177f87", "comment": "Malware payload", "value": "c8259edd63e617594c12e8d189bba04608e4781af3288a4fc354f8a514cd84a2612d2111c848465ff3357bff741d8532", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620180765, "uuid": "f3744345-e14d-4bf5-8d62-7b867d1849ce", "value": "23B3F489878AD897D1E37EF02507F4668663DD6D11E3A4D536DBFE2C3031291488DB93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620180765, "uuid": "7888a716-c37c-4538-85ee-2ca03d4acebd", "value": "5932b570a5feb5cbea054f78d4403601", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620180765, "uuid": "1495d4a0-0169-415f-b593-159cc6542f1e", "value": "768:6M+multHxr1P5zdO80kW0R/I8V43Vh8ac5eyzTId3SkewY:6M+3ltHxr1P5zdOjApjVSyz4VeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620180765, "uuid": "8e1e7b95-1466-400b-a4bd-e83c01eea9a2", "value": 116736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620180765, "uuid": "c0177d88-6875-4132-810f-bb634ffb8d24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620180765, "uuid": "d57c073c-d81f-4c46-bc2d-7fdcc5ef764d", "value": "0c962c7f12c69f51db3acc8bbe2d914a90b8a02dfb4cd33ff163a51c135451e6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7453f6d-adb2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620226919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226919, "uuid": "644fe83e-6b47-4ecb-b72a-48f0a485e701", "comment": "Malware payload (Dridex)", "value": "4549f83c7f802dd37b41c9420c47b090", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226919, "uuid": "be0f16a0-ce10-4e9c-8a7b-b7e83dc4402c", "comment": "Malware payload (Dridex)", "value": "0c9d9d9baac77bb536db442e3e1ea257c1ffa0fbc44386e9d64edd5387768d4a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226919, "uuid": "bb99a0f4-ba5e-4b72-a426-dc30785c086e", "comment": "Malware payload (Dridex)", "value": "9951b0b0debd15026cbe00d8bf20ead4dfe33627", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226919, "uuid": "6f9ab443-47f3-45ba-8fd9-899504c7ea72", "comment": "Malware payload (Dridex)", "value": "8c507483cab8b5b6d96f86736580b986557cd1bf603445a924043746abdb73bc42dc45e0d019f9b16a5fb4043ef0a007", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226919, "uuid": "13c1b434-1c10-4146-bf82-891e645edf54", "value": "38F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226919, "uuid": "74dba133-3942-49c0-a371-55e485fd20a7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226919, "uuid": "1b279495-47b6-4ee8-b11e-5cdc7cf0811e", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620226919, "uuid": "e83c2464-1afa-4b59-99d3-d8560ac3d236", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620226919, "uuid": "e88c12c3-d8b4-48ae-9a30-576106ac40fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226919, "uuid": "e4dab3fa-aa8f-49af-b354-46acf00e4848", "value": "4549f83c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c967bf88-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252665, "uuid": "dba96caa-e32b-4e7b-be3c-191fe69dd032", "comment": "Malware payload", "value": "5bc5ec88624aa3a31714ca08868cb066", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252665, "uuid": "7271db76-df07-4f92-a887-b8392f98ecf7", "comment": "Malware payload", "value": "0ca8dc702d20c062a7335a4e618374f981b8ee5f687d4743e2998bb764e90f9e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252665, "uuid": "99ece007-06c7-4e7d-becd-fc320ce9ea73", "comment": "Malware payload", "value": "2ae1ffa35961fe21159ef06214427dad75d2b4f3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252665, "uuid": "48c62f0f-826f-4f37-a276-713ae303b46b", "comment": "Malware payload", "value": "33f7952f788cbf4c4f5b1f4b48c24ed2c03c7f1da405e1dc7ff4b3e055d792378822227734c7a50e9712c896727e604e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252665, "uuid": "c154ed41-a583-4f26-958f-5a9a9ec1169e", "value": "F1F3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252665, "uuid": "a73bdc00-35d3-4e9e-afac-fa6daf29a3f7", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252665, "uuid": "046c8ce6-2547-4d58-a6a1-436bea9a698a", "value": "3072:JB45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:D4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252665, "uuid": "3a8cd2f3-f33d-4266-a367-1eb2fd3da46e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252665, "uuid": "400c8f63-6df6-43f0-90d1-faa8bc18907b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252665, "uuid": "f1b7323b-6bb3-4625-8833-7e7439e872bf", "value": "5bc5ec88_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b98da0-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241757, "uuid": "da3e41cb-f8d6-4967-b185-a8928a2faff3", "comment": "Malware payload (Dridex)", "value": "0e07279fff39e23538ad1bb4164dbab6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241757, "uuid": "826341b6-e70d-4bbf-9802-eae0b2cc5eea", "comment": "Malware payload (Dridex)", "value": "0cb56886d7ec754f13de79af310242f4e09e30392d1f9acf99456d95c37a0887", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241757, "uuid": "a25504ee-1fe2-4473-a0a6-e60e971cf5e0", "comment": "Malware payload (Dridex)", "value": "b0476887a9c1515d1f658bae3f7de1ec0b5150fc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241757, "uuid": "ce662716-3bf4-4832-a13b-fc00bbada70d", "comment": "Malware payload (Dridex)", "value": "42a25639d36ec6428d9a6a654abc0f4bb7af653b4dc70546442f370c85b232aeb18c67a1870d3e7d0e8b43f23ca967ff", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241757, "uuid": "672cbbeb-e6d8-4ee8-9a1f-f0d0aae6d3f5", "value": "54F3C085DBABE87FC44A35399071DFFB5B388B145250C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241757, "uuid": "e23943da-0b74-4d14-99cf-7e9ac45c6c9d", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241757, "uuid": "b52809c2-f279-4a31-bffc-e63c486112cc", "value": "3072:/w45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:44KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241757, "uuid": "ec37f51e-8832-48ea-8ec3-9f3a30b082de", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241757, "uuid": "1b8a35bb-8fd7-4fd4-a40f-8d84c27c041a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241757, "uuid": "299b5cb0-3786-4228-b907-53052f6d95e2", "value": "0e07279f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f1143f-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241618, "uuid": "fc49957e-a9ab-4665-a2cb-9ed690f16fe0", "comment": "Malware payload", "value": "9451c78d6f2af15cc569daddbac54343", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241618, "uuid": "b9a16b69-ec9f-4157-b230-bba7e52c131c", "comment": "Malware payload", "value": "0d03477a3849516da0f2a628e23815cb76275e911c08359f2095204240834f5d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241618, "uuid": "5dbf0594-0ff5-4204-beec-65cb68dc7dc1", "comment": "Malware payload", "value": "e0b84b94b7dfe42144d4a768de28bf2310b7d175", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241618, "uuid": "1e16e041-3bb7-4298-b374-9469de04fb70", "comment": "Malware payload", "value": "6d79045afa17cbe5671e92e1d8d7da52bb0f6d66ec9a6d07e825d85342a1d97d69e522b8a37527585de85c92fb4fc93a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241618, "uuid": "8a5e5c59-651b-4194-b38f-079ea2c8c1d4", "value": "C7F3C085DBABE87FC44A35399072DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241618, "uuid": "e1a2e235-ba0f-47f8-87cc-cfac6f68a0bc", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241618, "uuid": "c56e420c-f645-4b8c-8790-670b3a8e9070", "value": "3072:6545bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:k4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241618, "uuid": "88cec714-4bb8-4f4b-9056-7c62d96030da", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241618, "uuid": "ec3db8fe-63e0-49b2-8e76-cc46fdd04146", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241618, "uuid": "1baec886-b4d5-4fe6-99a6-3e0f7f5d9516", "value": "9451c78d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97432b3d-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201901, "uuid": "a4a48e6d-f2ff-4673-9570-100e0369f541", "comment": "Malware payload", "value": "b5d2585a9d50e788a37d6700ed8133cf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201901, "uuid": "da39e060-32c5-430b-be40-b1beae17bab0", "comment": "Malware payload", "value": "0d1fbb35e0a41955bb9e49e3e765be71121a661ba0b374c5e352be5a87639240", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201901, "uuid": "e27e5f41-322c-4372-8f19-0c15facdd2e7", "comment": "Malware payload", "value": "c6617ceea2106f76078c195a4a86cb7e6fc31507", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201901, "uuid": "c39e88bf-1336-4e6a-ad95-24fc3d0debb5", "comment": "Malware payload", "value": "c2ea528fd6c099e95951e7a76285a6eb4af62b5aa78ba3395952cf86a2443b1c8be3fe7ffe1721a5c7f07a77c6a61a5c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201901, "uuid": "433d9b5a-a7fc-4a70-9f80-c9e208a23a1f", "value": "CB73BF42D5C42112D1A6127D2AB63BB65A71F1F73605C1EA3A8CCCF5EBD0DB0A6263C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201901, "uuid": "47232fcb-2777-41a4-a67b-5c46b8177491", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201901, "uuid": "f44a9d2c-fafb-4d64-b136-aa97314f4283", "value": "1536:IaOtrAo+1M0i1ELsmI4oSGEsKlJsM82pj9JaMb+KR0Nc8QsJq39:pXok21EXI4qtFj2pj9oe0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201901, "uuid": "a2b44d5d-af0c-4812-b84e-47f15c62c818", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201901, "uuid": "2b55e3d4-1ec0-49ec-bdd4-a4766e09cb1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201901, "uuid": "cb32bafe-9b42-4c10-9430-526cbff3ad8b", "value": "b5d2585a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65168f5d-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241760, "uuid": "0f8c8ed3-2dee-4c0e-8eb0-16dfa5d7e427", "comment": "Malware payload (Dridex)", "value": "7a31daddc1c2b922ba9995dd3d10443a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241760, "uuid": "1343d20f-71b9-4863-855e-67b5d26f6413", "comment": "Malware payload (Dridex)", "value": "0d2fbd562ae680cb2b318a1f920f86077ba840b3ce1442d29dfe118be4a44f28", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241760, "uuid": "c9bcd6f0-a9d5-4b5a-b59f-6740cae6500f", "comment": "Malware payload (Dridex)", "value": "c6b4e7ef3ba31e8b590dadecd49dcdb05e5f07ee", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241760, "uuid": "b7234dbb-1258-4f66-bf85-683e303debb1", "comment": "Malware payload (Dridex)", "value": "dc21cbf6726bb9d4787e1e292811aefc1d30e81d75676e63f0d44fba013d003ce1a89a10159141ae380c6a91619bb64c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241760, "uuid": "340abe27-b31a-4d16-a140-4843e112cdea", "value": "BCF3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241760, "uuid": "8f96aa73-0c42-4ef7-a0c0-a2106db3d1ab", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241760, "uuid": "3ee1e36b-b9dc-4686-9856-3aab6a2c0a61", "value": "3072:Ye45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:t4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241760, "uuid": "2824ad01-2cbc-407e-81b8-c60c5bba851d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241760, "uuid": "ef67810c-d9ce-434a-81af-acb32f9d7e3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241760, "uuid": "dd1191ac-8287-4d99-afed-6477688736ae", "value": "7a31dadd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc28490-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241724, "uuid": "459600fd-53c6-41ee-9eba-78dcd0cd718f", "comment": "Malware payload", "value": "6645ab8c0575dc53b416d21c10cf8562", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241724, "uuid": "dffc859c-4668-4cc3-a912-a9d87a798bd9", "comment": "Malware payload", "value": "0d56100e86162e9e8b7e2a06b36bafbcf14cfe19aaa38bdea2c15fc39dce0fbb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241724, "uuid": "eb067ecb-54fe-447d-960a-6432513f25b4", "comment": "Malware payload", "value": "45f1fd2b92ac02570df84f994c4d5326a0036ef8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241724, "uuid": "cb612a0b-4702-48fe-be45-8725f38a3940", "comment": "Malware payload", "value": "7614ca65d57a25bdd0a821e7ade0343fbbb505b2f13a150656a7085273ce9f4a2c758b6947c4d155655a95e08be7e9fd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241724, "uuid": "0859c432-c4c5-4054-bc55-4478d1a4bacb", "value": "C9F3C085DBABE87FC44A35399472DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241724, "uuid": "7a98fe97-000a-4909-ba4f-0316976e3e15", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241724, "uuid": "e419cf05-8679-480b-a0ec-0947b239bdb8", "value": "3072:wQ45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:34KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241724, "uuid": "7e2d4bd0-3742-4992-8918-5eebcc4ae66b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241724, "uuid": "05a5d577-b796-4db4-b0e1-bdc354859c86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241724, "uuid": "3f24b600-8229-4cea-acb0-db422e07f0a0", "value": "6645ab8c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead5790f-ad94-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620214067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214067, "uuid": "ccde1645-9362-424f-8ea3-4e5d7a8db518", "comment": "Malware payload (AgentTesla)", "value": "f93e6083574dd40c9063ee6ab0228710", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214067, "uuid": "0d201198-abf9-4c09-a055-180f7507d47e", "comment": "Malware payload (AgentTesla)", "value": "0d657750c578d2f3700fbdb2c2ed7594bdb1b5f0ee275ca4fb698b7cb7b62100", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214067, "uuid": "adb0e4cf-7496-4f6f-b790-fc936f59e96b", "comment": "Malware payload (AgentTesla)", "value": "7936a044a5808f0df714e965a05f1cb2ff094c9a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214067, "uuid": "7ec01972-2017-47c4-a5a9-b21abd603322", "comment": "Malware payload (AgentTesla)", "value": "1c79e785096e4f4f2383c1edcb11d0ea1aa2d4380680096436ddbd095f5b5f84929b4331669c42ce2441e9a2818e7074", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214067, "uuid": "00ee1ffb-1390-4cc8-8d14-16daf3671eaf", "value": "62158CE83144A8E5E3171D7367CF8C1142742678A43BDA0E1B51277E5AA7F133D3AA8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214067, "uuid": "8a321917-f079-4516-8d53-dfe931c6264b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214067, "uuid": "357eb32a-3d9e-499e-9ccb-4bd27bf77e30", "value": "12288:G1AZoLLoS60/K7yh0Gs7LPXmefeGJFDiJjx4J3vs9yxBzwf5gHH68g8SiyyjKd:GGZoLAGgLPWFCiJjWpvkyxBs18g8d8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620214067, "uuid": "cf43dc7c-a706-49aa-b436-3a42bf3c4c95", "value": 936452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620214067, "uuid": "f68675b0-1dcd-4f78-a7ac-d474fd3f4cad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214067, "uuid": "c2b797a4-4571-4d09-937f-72ed7b1bf942", "value": "4Rn7MQbDuOP5l5y03MU3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdafb139-ad6f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620198126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620198126, "uuid": "b0369fc7-acb1-418a-a5ba-9d0a498f1201", "comment": "Malware payload", "value": "0c5a15845fa06263b8c151ec70c6898e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620198126, "uuid": "f0a87f96-4d82-4f93-aaf1-e223acd8f859", "comment": "Malware payload", "value": "0d6f4ca76b0cb477acbf59abedaf5e085bc9d63910b285f1f8324f053099035f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620198126, "uuid": "8493e101-971c-4f1a-94a1-b3c434c4e418", "comment": "Malware payload", "value": "c1ecab8821b18f01889639325babcb728ebc1cd1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620198126, "uuid": "8ca6807c-a0b8-43b5-b9fa-d90b2e6f92e8", "comment": "Malware payload", "value": "66b85838a5d0a92f7396cd3ac298a857128cb92b949b064cd2a7bf0454ff760efe546067ebaae356fde5633fa72a758e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620198126, "uuid": "fdb23a78-750e-4a5d-87a7-aa3306d4b877", "value": "1A5645911B7360B27FCF8916540B1EC8D7B34D01646C1AE1F7BAA6178C3BC9C9EB8925", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620198126, "uuid": "d2692be8-8c6f-4105-aeec-48d393fbd78c", "value": "6144:AwyRCKQx1Q5SU5UXQtm6oh5+O/jNLjqYW6TI1ujqhEsD2BkcKGgGYu1ps8QQceoY:K9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620198126, "uuid": "83e911fa-38ef-40c4-8bac-eb8bfd8e47e9", "value": 5968068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620198126, "uuid": "2a2a077e-2673-41a8-8693-4e0fdd20792f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620198126, "uuid": "e569ea95-2e13-4241-9246-66d0cd52afcf", "value": "file_28675.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6964b25b-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241767, "uuid": "b1f2d747-1e0e-412a-b0b3-860f31feb107", "comment": "Malware payload", "value": "4cb8082a4ec7cc58bf44c0820833c2af", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241767, "uuid": "65c9ae2e-0338-4b9d-b4a9-5c816412d741", "comment": "Malware payload", "value": "0d7a7d50b5159a041a6f6817fd9f0a31c3e520501506947c76e1c6cb04b88cb3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241767, "uuid": "d173228b-0b11-492a-911e-000e84de159f", "comment": "Malware payload", "value": "acaa87ada443e7629ce43647058f9a533ebf619c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241767, "uuid": "58a5d889-b2f2-43ea-ae37-93e849b5c415", "comment": "Malware payload", "value": "b034ecc8b48903c02d256b9779212a6057f5f02ee03087252c3b7a15114db067fe021b239b09fff8f26a09946d3dcb39", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241767, "uuid": "f93b4f28-adfa-4c21-8162-eedab4bd28c5", "value": "72F3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241767, "uuid": "025abb62-354b-4219-83b1-782651e78a87", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241767, "uuid": "e0ba0fef-9fbf-428e-80b1-7b6284b04b09", "value": "3072:Zx45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:34KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241767, "uuid": "4867aa4a-e657-423b-be4f-4acaf796fc4d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241767, "uuid": "5cc35307-7315-4136-8c8e-8a0786bcaf48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241767, "uuid": "046a9fde-cc55-4d3f-bbcf-2f45a66876c9", "value": "4cb8082a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed161079-adaa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620223519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223519, "uuid": "095d4b91-5903-4e76-81ce-51f26543c7b3", "comment": "Malware payload (Quakbot)", "value": "dc0263bb2752a6becf9060e71693a21c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223519, "uuid": "9e8620a1-521e-420b-ac19-44e5ae20c5c0", "comment": "Malware payload (Quakbot)", "value": "0d918c45f7c22d9871a8192ffa4ef1065f21df6e54fc70871675ce6c25db04dd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223519, "uuid": "044c1925-de4b-440c-ac7a-1ff5f8d524e9", "comment": "Malware payload (Quakbot)", "value": "57a21a227266d8d456e05c44c238a5fd13e272ad", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223519, "uuid": "1aab05b2-e889-4311-baf2-5bf25dd892e9", "comment": "Malware payload (Quakbot)", "value": "37907bfe55fa3e391f9478a024c28674eff2bd0c87b38fa810c0ad8e93a2ea9a0ebd4004b3df0daaf5da2d37dbd18690", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223519, "uuid": "7d032779-b56d-4fe9-9898-a79e1fc2a8d6", "value": "ED2423C0A91B3C278C64438216FFB52630A0D57BE628D7C5D7DA6D2AD622DADF3011E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223519, "uuid": "b4918146-21a2-4268-9fc6-0cdb7201b10f", "value": "6144:8G+XozWyAmZtL7GugMSSbAY2M+d6rI2NEhFuEvqmu4Z:J+YvZZfgTSvN+MuybrE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620223519, "uuid": "e5573f96-3766-4012-a342-6c1261c57e91", "value": 225251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620223519, "uuid": "b55befc6-e0c3-4fc7-96c5-9b92f256b4a2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223519, "uuid": "932e3fef-1965-4ea5-b514-c7346565f560", "value": "dc0263bb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac153343-adc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234148, "uuid": "e23ce43a-116d-4364-b5fd-0bf8a251bc79", "comment": "Malware payload (Dridex)", "value": "44688b91bf191a23aa065f2b243fc984", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234148, "uuid": "12b97942-4f22-4087-82d7-1c335ff8ee97", "comment": "Malware payload (Dridex)", "value": "0da602cf1965e8968d6e30b6346813c7b1208e57daefd4c545b418fd50880fb5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234148, "uuid": "6b27986b-9d8b-4d69-ab71-8b0234a05653", "comment": "Malware payload (Dridex)", "value": "db47029833c98bc2b71193f0dbf6da8f22c00802", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234148, "uuid": "1e68e13a-9ebd-434d-8c32-244e95d95802", "comment": "Malware payload (Dridex)", "value": "7cc7b73843cb7ebf52e849739ea8612162af6e2f04c0345a3e418c0004acedc9fcd458a9aaacdf35af5e080141ea5964", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234148, "uuid": "9e5f4ada-5eb5-4a12-8380-0fd8f19909b8", "value": "5EF3C085DBABE8BFC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234148, "uuid": "601c8709-5d7e-48b8-af32-062577bf4aa6", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234148, "uuid": "36150944-7544-4f2d-b60d-0a5418871c51", "value": "3072:cE45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:H4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234148, "uuid": "de5a2980-9a46-4750-b530-1bcb3d97e728", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234148, "uuid": "d964554e-32c6-4b08-b3ee-bb029a199fb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234148, "uuid": "dde9b69e-d6c5-4d65-aa7f-54521ec0a202", "value": "44688b91_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d5f07df-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252108, "uuid": "8ebd8f05-7fc4-477e-998d-cd3e03cff26c", "comment": "Malware payload", "value": "bfb4c0a2d13d64482fd01d56a23bb2c8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252108, "uuid": "68c6e52d-b8b1-4a57-8ec4-cd2ba9b426a7", "comment": "Malware payload", "value": "0dcba46d538b9e9228a28c357ffdef3255daf3d4face897c9ae8dd286245e3d2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252108, "uuid": "061003bc-df03-4af4-9dc7-ee70057be261", "comment": "Malware payload", "value": "9a20e80c7390d0dac99e99d633a6e62d5ec91a3e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252108, "uuid": "f4bcef6e-357b-4034-a880-e2dac0cd63cb", "comment": "Malware payload", "value": "d91c7a2b2286a69081f654d63b1ccd8f1381e1b1bd6b191d6cb1d3a99ee3991142a443661fd04d5b871ff4ef2ba04906", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252108, "uuid": "32ea63e6-625c-4079-9cd0-974aaa516ba9", "value": "F8F3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252108, "uuid": "0abc64dc-c1f4-4d4b-b4f0-00c4bb35312c", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252108, "uuid": "4a87830d-d650-4fb3-a94d-997ed205226b", "value": "3072:Mf4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:jDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252108, "uuid": "745552f4-b9bd-43f5-8b79-e3a780241981", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252108, "uuid": "b4c5bd81-f2ca-4d66-9c85-53ae0aef86aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252108, "uuid": "f62f476f-bcce-4bde-961a-c963ea6f85ff", "value": "bfb4c0a2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d4159d-ada6-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620221474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221474, "uuid": "b48966c7-d101-44e7-a4ec-8ffad330e37e", "comment": "Malware payload (IcedID)", "value": "c5ba1ce043a78fa1c8850a2f471480ef", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221474, "uuid": "b31c7237-e14f-4ca0-8f20-153a96e37890", "comment": "Malware payload (IcedID)", "value": "0df39d0e12024c1a464ca5eb3e1b0614721c7f4e28421dceebfc9dee7d12b421", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221474, "uuid": "905f38e4-057c-4178-a285-b87a5a43df01", "comment": "Malware payload (IcedID)", "value": "463d4139c167ea7b6d8ca143e7a323f95315d86e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221474, "uuid": "1b45f3a6-dcdb-4f0c-959c-16f638180bc4", "comment": "Malware payload (IcedID)", "value": "0b7e0a61fed02704a5b2226e382695ed8fb71ac5b028d369320f8ba91859c5c51f5cc1e1be818dc04cf19c4ebab2ed68", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221474, "uuid": "25f4bcb0-6e5f-4b7e-b9b4-c3dd8f054d60", "value": "890462BD06946674F092A2FE5F5BC2DC80F976F511FC239BA3309AF404489A54FE7289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221474, "uuid": "e40cd032-b3b5-467a-ba7d-dc7c5b45dd4a", "value": "418bb7afa91ee2677e9770deeeb77473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221474, "uuid": "7e7cebd2-358c-4f36-aff4-8dbd9fc66d1d", "value": "1536:O65/LQ2n3qA3PSD1AWc15xX418gzMPA3MxGQk2x44XaN9QqGYwOo9:D/LQ26GPS5g1Xm1MY3+lx7oQqGnOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620221474, "uuid": "aa640db8-04ee-4693-8edb-81f8f636ceb9", "value": 187096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620221474, "uuid": "04effa35-c111-4a40-a8a3-558abe33a9ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221474, "uuid": "5c8bc4bd-e388-4bd8-83a5-894604c7e4b3", "value": "c5ba1ce043a78fa1c8850a2f471480ef.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6708019e-ad9c-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620217282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217282, "uuid": "4e4e9dc7-bbf4-48ef-b164-9539e6f2f219", "comment": "Malware payload (NanoCore)", "value": "7cef0587c3a904ca005df0ea9e9c88e0", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217282, "uuid": "b5c75e15-c3eb-443a-bd77-5c80b7efa2a1", "comment": "Malware payload (NanoCore)", "value": "0df50fffae1f82940ba8ac5af3ea2d3f1a2d79b830ebf7e441ff5e25cc254189", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217282, "uuid": "91c0f348-9a93-4213-b4bf-a07935033a07", "comment": "Malware payload (NanoCore)", "value": "f3c52cab142f03552f9468d912f328e7a1775660", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217282, "uuid": "4dd42e2a-484c-4ec7-871b-7bfef40f0d7a", "comment": "Malware payload (NanoCore)", "value": "7d35a5bd53ada390d3210ad7a23c61f9775e3b6090ebe9af6a77a8eee34a6c4aa89cc30dda652c6c85db3c6474adf68c", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217282, "uuid": "b41f1030-7053-4e95-a59a-eccb29960a12", "value": "42B5499D44DC5EDB76630A562FECC8C94DEB15F53476E212A8829BD002A2DCF0EC6379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217282, "uuid": "f4ee95c5-cc9d-4c52-b0ce-945b4ddb30dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217282, "uuid": "b4623e02-ab95-4e9c-894d-c236f6cbb085", "value": "3072:zFUmLW0eER2jeqy49jnQ9DRHI/35KSYNHTMYvdcDd9O7eCakOla14yItbcdfQgUW:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620217282, "uuid": "81451a1d-37ee-4c97-adc0-3e97391f1aba", "value": 2329600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620217282, "uuid": "9ebeec9b-5cd2-4a50-abe9-ae60649f1147", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217282, "uuid": "c9aba9cc-7a12-4527-8df1-9974730e8f72", "value": "SecuriteInfo.com.Trojan.PackedNET.703.16914.15818", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c491db5-ad81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205560, "uuid": "3b9d0da5-9b03-4333-a40f-274d22fe7845", "comment": "Malware payload", "value": "71de31ccbf84fd414594aff885dc2f51", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205560, "uuid": "b3992609-6cb6-417f-9aaf-2b51164573d1", "comment": "Malware payload", "value": "0e60a9b6f169eff1dc011e496320bebab213ffcb88500f60e350ed9956ae29ca", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205560, "uuid": "3398d6f3-eb4d-426c-9235-8444d8aa1d49", "comment": "Malware payload", "value": "223e59799222cddac2e742f78b0a151c2ac75d34", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205560, "uuid": "8bf80535-73d7-4ac8-bc3f-bf2f1ed6406e", "comment": "Malware payload", "value": "4672685de48f1230197417236285f3563ab85f0e65d89944bbec477f620a315987462292d9bf55277bfaabaa488f3a7b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205560, "uuid": "2b4a6f0a-0e42-4243-a787-9a018fd23c93", "value": "83D4AE840417C863F571B0B94B57E3530505A41ADFBF2E09C71A8F6CC92A26BEFBE919", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205560, "uuid": "07f5bdb9-bc15-41b8-8a34-dad5f8ea16ea", "value": "a0c3f372531adf671d85e327dddda657", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205560, "uuid": "a11ee7ee-7e2b-43b4-b4db-fee93bd86d35", "value": "12288:ridlMiu/UMnqajPYdmYhY2G8CLmUdRizYvtUBUSeHv9UgcW2KF8qIoTm:rqHu/U3MPHkY2G8CLkkvtUBUSeH2RoLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205560, "uuid": "2f84d3dc-bd0a-46a1-ab7e-68cda1d78c52", "value": 640512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205560, "uuid": "116fd89f-da0e-4f9d-b2d0-0830beb389d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205560, "uuid": "a37e4179-ce24-49c2-ae60-6272878c6b94", "value": "71de31cc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcaeffcc-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241907, "uuid": "e33eb592-8661-4156-9459-32284da89205", "comment": "Malware payload", "value": "5b0b23f8c930b10960b02371a700b949", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241907, "uuid": "e54e6abb-0263-44b7-b6e0-57b3f8e42294", "comment": "Malware payload", "value": "0e6f99ac3c9885d43814f1ef25406ae6bcd1f47addcedfd8a7137f4e1e93e9dc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241907, "uuid": "60b6ca79-3a9a-4077-9f47-5e102fdf5247", "comment": "Malware payload", "value": "4b297f40aaceea7c69076fbdf5cb6de7fdfc529e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241907, "uuid": "d9fed92a-49e4-42bf-a3f1-6d452abc6ca9", "comment": "Malware payload", "value": "296736526b1a5a0c11401afcff5a1e7396ab7525b7b5d25d1f4e783235e192d6806bff3e34da6d1bb2cfff8b845289ea", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241907, "uuid": "1222c86c-5a73-4136-8a28-ae611f3565a6", "value": "0CF3C085DBABE87FC45A35399071DFFB5B388B145250C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241907, "uuid": "546443e6-0df7-45d2-9a0a-7731a7a6ca8b", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241907, "uuid": "9ae3b8e5-10c2-433f-91ff-259cbfc9acfa", "value": "3072:wy45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:B4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241907, "uuid": "c37e867f-04eb-49ce-b49c-38f99be721ba", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241907, "uuid": "d4021cdc-0850-48c7-b94e-a4919dc2dee4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241907, "uuid": "ccd8e30c-50ed-4785-b686-a2689d367744", "value": "5b0b23f8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa7518cd-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201933, "uuid": "a8ea265c-7250-414e-baf8-a2ebee5c726c", "comment": "Malware payload", "value": "2f8f8012ebb28563cc02c5fd13331a77", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201933, "uuid": "8b2a0181-e5ea-4ca6-b4d6-e67c57a20a52", "comment": "Malware payload", "value": "0ea327b5a6eb09b51bd1337c2b29e9fd4cbfa11a083736b47188884ffca7e2bf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201933, "uuid": "3cacb982-7e60-46bd-bcf9-a74ec4bae8a8", "comment": "Malware payload", "value": "1a2fbf934df02869dc7a563501835e1feb5f6b5c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201933, "uuid": "afe91533-cd81-4b52-ac50-212e67d38034", "comment": "Malware payload", "value": "25cfed63c980ee97d729d142747a623348a32b5808f0250b4ba29eb729e1db3944e6ef61a1bd21914117f1b6a9ad9ec7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201933, "uuid": "1bf189cb-65c9-456c-9c19-0fa2f8956eb2", "value": "67C34B1AF50295F7EF2908B002C7F2BE4A20AE24D4244E86E784DD69EC73DE57A5D353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201933, "uuid": "060e584d-519d-4810-b7e9-cf2f0b25a6b5", "value": "1ab4a64725d1bc79627f25a38a864ecb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201933, "uuid": "ad145916-8d4c-4153-9dc0-65acc26b8784", "value": "3072:rOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPb:rIs9OKofHfHTXQLzgvnzHPowYbvrjD/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201933, "uuid": "9a4f8f4c-9586-4cbe-84f8-8c47f298a06c", "value": 121344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201933, "uuid": "21535b4a-98f1-4048-a046-567cd9e1222d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201933, "uuid": "42d3a59d-2bb3-4e7f-9b6d-8828ee22616a", "value": "2f8f8012_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f054c163-ad94-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620214076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214076, "uuid": "28adbcc7-8199-4891-9f77-98494a6fc534", "comment": "Malware payload (AgentTesla)", "value": "da3e9524094ad0d53ffa7b89e361e4d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214076, "uuid": "fdf82703-4bb4-4d97-9b52-fa7449b2850e", "comment": "Malware payload (AgentTesla)", "value": "0f330652345ef8518b898bf3f58e2fc1145e5cb4f4801bdeb77f6bc802b8e99d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214076, "uuid": "df1be6cf-66c9-4cb9-be1b-401836e531d8", "comment": "Malware payload (AgentTesla)", "value": "3631127763d75f76927c7abec30d27b31f9ef7b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214076, "uuid": "71f4f1b6-127b-4636-be43-7376aa1031e6", "comment": "Malware payload (AgentTesla)", "value": "eae460b37feb85ba08d8fdf592542cd6f65a857cd1531cf6b5f2e65d33f736e9315363cd170221239f7e6ba12841cb1a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214076, "uuid": "c0d8921a-01f0-4dcf-b5b6-d78fe4bfb0e7", "value": "06E4BF6123585F6CF17EA3389874510463F0BA1BE322DA8EBDAD90CD4566F84C7E391A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214076, "uuid": "273b248c-323f-4c35-98ca-83c06840dc0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214076, "uuid": "469d9708-0944-4d50-be87-d8baf11c0160", "value": "12288:UOIwfnfGMIP/jmRe99WIEYJKB2KNooHUkHJY29t7Zk9tx3cMW:RIwvfhU/iA99WVYJi2KNoszpYo7ZkBM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620214076, "uuid": "fc2c2f21-e8a4-40e1-a647-745c67712e26", "value": 670212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620214076, "uuid": "5baebf0c-5b36-4431-9910-63877c4bd204", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214076, "uuid": "3a451a50-29cc-49cc-a04c-f63d3ec00f1e", "value": "5d1X4n8GxtypZaujyQTC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0e2a379-ad99-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620216117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216117, "uuid": "35725e40-4980-40af-a1bd-d7357bf2e31b", "comment": "Malware payload", "value": "652a6e69205df15fae935c63048e6001", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216117, "uuid": "4cc398d7-7337-4135-8f4a-d90d0e5e117b", "comment": "Malware payload", "value": "0fbdb66d81f97c74640af563b58b4d93872ed48a0397754b5c51a5c76d32900c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216117, "uuid": "d518c58b-e116-4cb1-9466-a8584ad07d31", "comment": "Malware payload", "value": "91e9ec0354e2befa362054a85298009e7d7985ca", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216117, "uuid": "4013227c-6d21-4f68-afdc-c067d0f9c9a2", "comment": "Malware payload", "value": "5a9c7c32f55f869cff286a511146c122aeddce3be3b2e54636b00ecad93e8842442eb2b245459ba13b252a2d141c5385", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216117, "uuid": "5b61c8ec-23dd-4e59-9487-5d12a5a32d5f", "value": "F1954A26759242B3C23615324FDEF770E735E9D00E38A76727D2DD3899B78C3AA22152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216117, "uuid": "55b5f243-f7cb-4e34-a6b0-cb4b15dd2917", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216117, "uuid": "e3531674-b547-4426-a321-2f57bcca66ae", "value": "49152:hnsHyjtk2MYC5GDUGME/wKIp5gRN/vhTB9g:hnsmtk2aGIp5Ong", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620216117, "uuid": "e886450c-80fd-4a4d-9626-fde337bd858c", "value": 1889792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620216117, "uuid": "8dd0a141-201c-4aa2-9d55-941db6a7fb15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216117, "uuid": "aa2d4376-c589-4dc2-8ba6-fe5f9c2de96e", "value": "652a6e69_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f774dd2e-ad80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205498, "uuid": "0fd58c9a-e10a-462e-9cd6-8d118c083ffc", "comment": "Malware payload", "value": "f7171f7c4931d475a6f3dcfe46c1fe01", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205498, "uuid": "9658d4f8-6fbb-4145-a16e-2991c96fad0f", "comment": "Malware payload", "value": "0fcdfe9838d1a7bacd923e91c934ede515727545df3b985aa0f6fb741bdfd5a4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205498, "uuid": "7568a460-140d-41f0-86be-814ca96f8ed7", "comment": "Malware payload", "value": "01a9bdcbe3372052c53cd7a3735c003180910f35", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205498, "uuid": "20a7dd73-2b4e-4b8e-8b8e-f16ff34d6db5", "comment": "Malware payload", "value": "5716a9bf26b6e69d4b5ce4a886b0493d1aefc010f54b635252e5cd91d1e0ca09506a16eea1b51659d6d4e23ea9115b6c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205498, "uuid": "5faea53d-650f-4862-be83-d52e1f210345", "value": "40F49CC648609E7AE53C37792264298C139F079BF8352DFB08FDCB54126167EC69DB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205498, "uuid": "5e33c650-a688-4570-8545-7ba24f76bb41", "value": "f576435e3d8eb3df640b8f17919537ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205498, "uuid": "32ee3993-5d29-426a-ab43-721c9e75facb", "value": "12288:fm5Nb/Q0slZ5DcUiswg5V2SbXvxtWyD4wjIf3FXsRhfZO8bbTm:uzborgJ9gfVzv2szZO83Tm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205498, "uuid": "fb58afa8-20a0-4445-bdb3-eb697dd6db90", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205498, "uuid": "4af90513-8f87-48cf-aac6-310729e283f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205498, "uuid": "30dfb1fb-452d-4484-bd11-afe29f1a1dd2", "value": "f7171f7c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e36f6311-ad80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205464, "uuid": "4a5af916-fe6a-4dd2-bca1-4e55ca3bec8b", "comment": "Malware payload", "value": "ed8c66bde2982acf093954409161d461", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205464, "uuid": "3aa04fd1-ac19-4412-be5d-94c277139ee4", "comment": "Malware payload", "value": "0fdbe9d827930dcc2fa71ac6db6a187d1c7803cc6945ed577aa28af55ef0e9a2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205464, "uuid": "e06e8a9c-6c0b-467e-9643-ad7883044b6c", "comment": "Malware payload", "value": "e6230962c1b0c20cbacd35b7e076605338d69491", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205464, "uuid": "cb7de3d5-2ba8-48b0-a3b1-ab96cb4f329f", "comment": "Malware payload", "value": "b49071279377746125c930f676aa7a0fc86f2a888bf8139a22df51d48163c379030cb3b2995eb62897e8b76462535f69", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205464, "uuid": "af53efdb-f764-43ee-84a0-e14c1d76e0d9", "value": "DCD4ACECD8ACA435E35147B807CD7D3BBD61AF6AABFD410B8D944421DAEC5820D0A4E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205464, "uuid": "49992c21-4ae3-47b4-958c-1fb61f352d9d", "value": "19a1b8879ffb3428147c68fa3bfae2d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205464, "uuid": "17ed08d3-5f9c-4574-b03a-ca536755323b", "value": "12288:Iwu9cu2kKj2XtNCC2A6/dNQjffezEeVk8pRzfIdxvTm:lu9cUMdEe2lTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205464, "uuid": "670f4798-5676-424e-b63f-9b3736c6da90", "value": 641536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205464, "uuid": "cfee93b9-fa67-49b0-91d8-aa71e0ccfc68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205464, "uuid": "72a3e6ca-1695-4eae-9fa3-f2d3aae188fa", "value": "ed8c66bd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b64fb7-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209280, "uuid": "34474fbf-0556-493e-b090-63b72ad819cd", "comment": "Malware payload", "value": "30a48a46679c090579cc58d1dbe9dfb2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209280, "uuid": "d9e7b6f6-06b8-44d7-b0d7-6d5e71ec8a20", "comment": "Malware payload", "value": "0ffd15c33be0f386be69cdbc145686de982528d158a624bc0db943de0df976cb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209280, "uuid": "83f6d541-8b07-4a93-8e36-e191ff541800", "comment": "Malware payload", "value": "e6a6d5588b47eb06ab6a71eb93ee72e8ec648225", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209280, "uuid": "312c3be5-808f-4ccd-97c7-8498f4dab03f", "comment": "Malware payload", "value": "3c284a06ec482c970034fa100743ac15f723ccd5291efb35af9a19b18fdb28b0dfe4927dac7ede4fd02a6d5cc9e2af7a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209280, "uuid": "7e19aaf3-22b6-4191-bf0c-44e92addafe4", "value": "1DD401288DF2A1F9FB2877F530148563B4C18BD634A95AC21B31EFE262B354D149E9F4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209280, "uuid": "4fd19f03-e41f-4134-b2a2-69a4872d734a", "value": "2da145730bb531e4efb3d7026ef1e088", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209280, "uuid": "33c03ca1-f644-48a7-aea6-0e2ad73cb9cc", "value": "12288:rjTossJCsVRHwsBwCjOR79nWuhEJFm3AJ28WGcTlc42sIX:TxsJCsVRQ0JORxW6EJ83AE8gTlyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209280, "uuid": "cdd4f8f9-9431-4b18-91a8-b4335dc69c01", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209280, "uuid": "f29d4cb9-d435-4ecc-bd76-b669b41e7a7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209280, "uuid": "cdd37630-9e37-4f3f-aba3-744ebd0ae566", "value": "30a48a46_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ed96306-ade5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620248514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248514, "uuid": "34e05bf4-b36e-4c89-8c16-164838645323", "comment": "Malware payload (Dridex)", "value": "dcd8fd6e1c3e29f56ad10fb88d135232", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248514, "uuid": "eef2ac84-2cf8-4abb-9de3-bd8e1acf5bd8", "comment": "Malware payload (Dridex)", "value": "1024499f79c4adbf14587a72c5b2d9b9f3f4ecf8d8a2963291f3ac447ed08f55", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248514, "uuid": "342fe8e5-7906-408b-a7bf-5a37fd939116", "comment": "Malware payload (Dridex)", "value": "8fcb3666b5075ab0a15b8f0905981a0778100602", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248514, "uuid": "81b73d95-8b00-4139-8c52-55f203408b22", "comment": "Malware payload (Dridex)", "value": "7d5ee3137262b2606a4b621e3f9790f3a22749c559540eb56ac5d624fd3fc67755993289350eea0ff6ca6d1d4679a260", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248514, "uuid": "d6564239-284f-4f97-904e-0014e70d858d", "value": "D0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248514, "uuid": "80741cf0-2940-4a5b-b086-020282c450b5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248514, "uuid": "c4755e09-9ffd-4213-93d1-be84f74aa83c", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620248514, "uuid": "93d7fb9a-ecee-47e0-88d7-223784936b4e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620248514, "uuid": "97dbc5c3-cfc0-41af-964c-4c5f0c955bec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248514, "uuid": "23599477-005d-4f56-9c9b-1653eac2a7c5", "value": "dcd8fd6e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06008f4a-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208529, "uuid": "e7ebeebd-8667-4ddb-9de7-aa3134d4fcdb", "comment": "Malware payload", "value": "5fd072caf2756515ab538007d2ca8139", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208529, "uuid": "a8d8800e-f48b-42de-a958-012a31c38bdc", "comment": "Malware payload", "value": "1063a4ee528660a836a543d73c4cf8b440a7e05e96c196f8849d759f164e057e", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208529, "uuid": "9c636146-2242-44af-ac4a-a7dc7848bb88", "comment": "Malware payload", "value": "b5e207d0923ece13a05c2c2503a307279945df1e", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208529, "uuid": "a065d77f-0e51-467b-b8d0-ee6cad986bb0", "comment": "Malware payload", "value": "3ea6c2413ff22e6fa6e2223089032f5c2a82455765effb25a83c15cfcc96a6041be3abcb7b72735b761b8ad4796d7c65", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208529, "uuid": "f8202bae-4482-4a91-8a3d-9b86266532f0", "value": "32F5330C62AEF8FDE89949383B6385E1C5E512F1888225F2D77814580C3F57E5BDFA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208529, "uuid": "f0a5727f-c965-4b40-bab0-41529706573b", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM6:0XSxVJG2fLAqFOfT9sMYNM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208529, "uuid": "b5f24df4-97bd-48d8-9a53-79bbc8a06f1a", "value": 3616768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208529, "uuid": "806e9baa-c633-45b4-86ee-bbbc0c966d0e", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208529, "uuid": "86f58032-7b94-49dc-971b-e5473504e99d", "value": "1063a4ee528660a836a543d73c4cf8b440a7e05e96c196f8849d759f164e057e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a5e079-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201972, "uuid": "7c334b2d-0f01-4925-849b-2f620914a0b2", "comment": "Malware payload", "value": "bdcb9946c685f08561ea45b37068e0b5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201972, "uuid": "a3091a62-a869-4d7f-88a9-6b999fcc9b3b", "comment": "Malware payload", "value": "10648e7ab3e5623de3a63300fad53d594430e7ce37e51f626ef4edcec8de89ba", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201972, "uuid": "fbecc8ca-0642-4ebd-8cc1-5a29ceffa1a6", "comment": "Malware payload", "value": "890b777154849e26a527b2eb502b6f3ccb4129bb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201972, "uuid": "bd1853d1-d1f6-4e6b-a1cb-dd862a3dda68", "comment": "Malware payload", "value": "c531f2462a38b4affd46a409a669e842776921584e274506c6ccb4d9aedadfc405305a41536fef8ba3a40a38bac99012", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201972, "uuid": "0aae4915-fcaf-4681-95fa-8acc6cd98462", "value": "D7758D23F3D14837D1731A748C1BD2B9A826BF512D28758A7BE82D0D9F396913C392D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201972, "uuid": "1c72d41b-e8f1-4350-94d9-ac841fef2a93", "value": "3c8577ca4bab2f95cc6fc73ef1895288", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201972, "uuid": "9d757399-5075-4e24-b17a-2cf5747c2a2f", "value": "24576:hxY3NtGUmJr+4Obxd+tPZSZyiE6EhE9xY3NtGUmJr+4Obxd+tPZSZAiE6EhE7:LY3buzMt0IY3buzMz0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201972, "uuid": "3d332458-db38-4402-ad1b-e9d24c2bc1eb", "value": 1663125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201972, "uuid": "d777089c-6c1c-45fc-b7e9-a7d830a1a867", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201972, "uuid": "5455a802-aa07-4274-a899-f3a073bcc0de", "value": "bdcb9946_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9208e8ec-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241835, "uuid": "c5dd1986-6095-408d-94ae-63f3d9e7b70d", "comment": "Malware payload (Dridex)", "value": "3fab5c8f228b23976e76f410a1ff7d52", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241835, "uuid": "4f2305ac-1de8-48bc-b01d-ba3509689a28", "comment": "Malware payload (Dridex)", "value": "1070eac606e2dad16a277c0c9727ebe9381e2b36b9bc25bc9e02aff5e3ce4f9c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241835, "uuid": "3d4c945d-d572-4bf2-be3e-17afea5732e8", "comment": "Malware payload (Dridex)", "value": "e46785c9bed62a3c1ab03b2078e461206a1be460", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241835, "uuid": "cc06f5dc-9d5f-42b5-9740-fe33f91951c0", "comment": "Malware payload (Dridex)", "value": "c1503b60baf734643d25648485a7a12996ed3b8cb7d2f2f81b5e87313bae2a122c62ddd8d05dc1a968be241f9ba5957b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241835, "uuid": "00d2867b-4d42-4e06-940f-521924bcc68f", "value": "88F3C085DBABE8BFC44A35399071DFFB5B388B145650C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241835, "uuid": "ec050669-4def-41f1-b58b-2eb7acbc249d", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241835, "uuid": "4e04e430-48cc-4f16-927b-96c920024a7b", "value": "3072:jM45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:g4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241835, "uuid": "0ff84d9e-3235-4b8e-8a97-91a0efaa715a", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241835, "uuid": "5595956a-3b05-40bc-ba39-dfdc0c84a477", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241835, "uuid": "5ac44369-aad2-4b2f-8dc9-155f37d933e5", "value": "3fab5c8f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d58805-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208530, "uuid": "fa097a46-c7b6-42af-8ae4-9fea9d63aa57", "comment": "Malware payload", "value": "387db026bd537f5bbbc21195e725f3c2", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208530, "uuid": "caa0698d-f47c-461c-a0ec-ca44e0d5e1f8", "comment": "Malware payload", "value": "1076e493423884ef43e5b39bdc7d2bf7975126e611cb7b3a2a854c5537a44b82", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208530, "uuid": "e613bcc6-c3db-4ff8-86d1-35f97c7decc8", "comment": "Malware payload", "value": "8162fe1da15d7fc52449a73f7062aacf3bedf826", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208530, "uuid": "9616b678-0d8b-491f-bc56-bc1f779b8c44", "comment": "Malware payload", "value": "dfa73f54cf1d48eccf3cba2d5ca8b23b4db9df88c521e3274bb173285e620404c3beed18031ff3158cad951b3ed9dffe", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208530, "uuid": "3d633a9d-5bc8-458a-99c8-4be89bb84257", "value": "6FA1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208530, "uuid": "f0b19f78-2f63-4b74-9424-b91888c01f9d", "value": "96:/RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:/RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208530, "uuid": "a5423170-f2a7-441f-ba20-0ac5e7332f36", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208530, "uuid": "162b6c88-65ac-4889-b1d6-a2b3856511ed", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208530, "uuid": "84a5980a-a07a-4a16-b56f-ff384e8134a7", "value": "1076e493423884ef43e5b39bdc7d2bf7975126e611cb7b3a2a854c5537a44b82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5861a40-adc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234190, "uuid": "f6161609-e630-4b30-a054-7a8a83f68b92", "comment": "Malware payload (Dridex)", "value": "9e928939f3e3c1f7b84ec6dc094f187d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234190, "uuid": "f3d6fddc-5201-4df6-8a3d-4b66e4f33d0c", "comment": "Malware payload (Dridex)", "value": "109e9a13b08d267fa0bc6a4a297377ef9c6e65d93a5521faae89e205da0be40b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234190, "uuid": "fa929820-3f03-48e1-afda-bea952cbb936", "comment": "Malware payload (Dridex)", "value": "77a1c761e615cd3d4f270ead88f35db8b37eb993", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234190, "uuid": "f2440ffd-3f75-4f2e-aba1-dfce42bc986d", "comment": "Malware payload (Dridex)", "value": "e77f8f2f76459397ff91f3100a44ccff01743b3ee5a1b11783ab075534c9f6d74f6ffa2cb13c0d9e1f973c526bd0a23e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234190, "uuid": "1d3284cc-4da8-4723-9404-0b835127fb95", "value": "0BF3C085DBABE8BFC45A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234190, "uuid": "dc075805-4c71-4abd-bca2-43cec7674ad0", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234190, "uuid": "4f298108-85e8-4744-9f56-b746e4d5b1eb", "value": "3072:lE45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:q4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234190, "uuid": "fb1f656b-5375-4f70-b132-6a3ec64b3adf", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234190, "uuid": "bafd2a2d-df83-432d-bccd-e9417f52d30e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234190, "uuid": "ade8cc60-ec8d-464b-af81-9edf97cab252", "value": "9e928939_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fcfd19e-ad81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205673, "uuid": "c6d562da-0783-42fd-91af-5657141b035d", "comment": "Malware payload", "value": "08b2870134e3ed23e5a9415307006885", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205673, "uuid": "2f4538a2-ed25-442b-a7ac-ee1f21ce4e5c", "comment": "Malware payload", "value": "10af65f100aa24aeb7c8de2ddd865398da6ebcde671f9d61874023bafec67280", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205673, "uuid": "3cd291f7-5427-45d0-b575-c0ca0fe01d68", "comment": "Malware payload", "value": "468b8934dc03f12b46924b3734d3dd4d8ca0c550", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205673, "uuid": "394c1f88-6e5f-4939-840e-95fc932308ad", "comment": "Malware payload", "value": "cbea623f530151c4350f04716e548264dcb9771f07b0bd31e8167e27805067de21a1030b6bdafdee32d8e01d4a647b3a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205673, "uuid": "5e727e69-e7ac-41c8-b1d1-ca0b500e1607", "value": "9335BF4DCF7E40E0E4D05EF81838F1479BF4B932AC8D69BF799EB4865B06C15246EA18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205673, "uuid": "85e66fb6-da90-410f-9b7c-8f9960b40d56", "value": "2fa4b9a23b9f87699dd4a4a048d634b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205673, "uuid": "253c6715-5fcf-4086-ab26-633d1b3eaee9", "value": "24576:H7LLz0MFdgKv76e6wyj0e7l/7W3YhVmI8oOQ:H73OKv76n9j63YhVmI89Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205673, "uuid": "5dddd941-bb04-4d4d-b5a3-5174b38235d8", "value": 1089024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205673, "uuid": "4f7b3c26-714a-417e-b0a4-57bdcbd951af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205673, "uuid": "903b832f-b30c-4304-ac1f-2e8e90a786b3", "value": "08b28701_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7effb203-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209161, "uuid": "81c1c201-ad7a-4224-b36c-2d888643c30d", "comment": "Malware payload", "value": "e7ad7627323c7b164b1b447ea342f3bf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209161, "uuid": "7ae30b5e-7746-43be-9bdb-dc593ba2253f", "comment": "Malware payload", "value": "10c298cc3fa702bba0b6797414c210160d534ff1b01fd8c1155c4545dca9589d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209161, "uuid": "eceedefb-4e09-44c5-9f9b-aca99c2e051a", "comment": "Malware payload", "value": "dc6cd893662826ffe78ee26df5dcebbd21bac8ee", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209161, "uuid": "8ec22724-7fb5-4c69-9b43-81d62f6f6c6b", "comment": "Malware payload", "value": "3cb558deef34a6896b9140173216bb03f5006b190294a27fb2930cf84515f96b589f493a065bd9d187cdd95efba8b147", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209161, "uuid": "e0170f4c-0c3b-48ec-b40c-71400644faeb", "value": "F155C0A45E195B71EFAAFCE33DDB525B124F0528EB419B0A00958C7131CCA9311AF7FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209161, "uuid": "122e48f5-942b-487b-865c-cf119d1a0544", "value": "97f620a4b793d3f982759cc200a50dd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209161, "uuid": "a6d8b87d-237c-4635-b919-8ef9a87bdfa4", "value": "24576:hfRmp9piqAe/QNsgBBtactYStbzwjrQxKYZDdPZcqXCIfuDDNEivVc:hfA9picQNrayb0jIZcuCz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209161, "uuid": "c9218a7f-2e02-446c-999a-c2696f57999b", "value": 1346048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209161, "uuid": "f54f46ec-ca04-44aa-9e8d-254e68b2b512", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209161, "uuid": "9fd5460b-1dcf-49df-9741-af9183111762", "value": "e7ad7627_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e1cc1e7-adcf-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620239037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620239037, "uuid": "7150c639-21b5-45cd-b003-ba066f1b80e6", "comment": "Malware payload (SnakeKeylogger)", "value": "9eb73b9d60aa4f66f668ca167bd21d8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620239037, "uuid": "87bcf165-0f6e-4094-98bc-70157076085a", "comment": "Malware payload (SnakeKeylogger)", "value": "10c372b50feba360d7504889d56dab8626774fd0ec9630c644eee254992c1570", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620239037, "uuid": "88503a72-0c50-43ef-8dd1-c5167daf5b9a", "comment": "Malware payload (SnakeKeylogger)", "value": "b63cdb3afbfd04db2f1d3fd51b6139c138fdfc88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620239037, "uuid": "86877149-313a-42ed-b4e7-00f82c1298b8", "comment": "Malware payload (SnakeKeylogger)", "value": "49ee08c3c123c032becd02340e36d493498e20950e796b24a81d50519e29f15ef7f3c3a47b6428f672d4830f6cd26fd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620239037, "uuid": "a618dcd5-45da-43dc-9b05-6043b002f07c", "value": "31F4013D26454216D47F4B7C34B8D04017F4FA2AD663E75EAFC025B72F73B919620AA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620239037, "uuid": "c9a7dfe2-af10-41fd-9f29-b7439936b382", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620239037, "uuid": "4d1e72aa-9691-4a88-82ad-179d2d832431", "value": "12288:5mtkfO3S77yf0HqkZtOMFFoz1vpEh5v+a0II9/M2Dp8K/wgLQ28AB7rGM:pvVZQ2ChsV+6a/P/wgLQDk7rG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620239037, "uuid": "49544a0f-3174-4129-828f-3a89c6f83b47", "value": 751104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620239037, "uuid": "98fe298c-e99f-488a-a88f-39e37c8a28db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620239037, "uuid": "0c514794-e995-49f4-afda-25ebcdb5307f", "value": "39305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc315e55-adc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234228, "uuid": "0f9c8d25-c273-4383-93fa-1c8b06da5c77", "comment": "Malware payload (Dridex)", "value": "2f09e952c5031406d56e09b330d3b3cf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234228, "uuid": "dc1da410-8676-41ad-ba02-236eb793c16d", "comment": "Malware payload (Dridex)", "value": "10dd0ea3423482fdf129605faf7e6821d9e7c887d16e8c59b4c21ea6a6fbcdc1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234228, "uuid": "62f3dc50-32ac-430a-b2c2-adf3c89289c7", "comment": "Malware payload (Dridex)", "value": "7246acedc62589875c699315b9fb23b708e250bc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234228, "uuid": "38ea1f9b-e960-437b-a19a-da6c42a994a2", "comment": "Malware payload (Dridex)", "value": "eac69cb8cf95c3ee3caa1de88b03e87692fa0d3827dc2b920c7f092bc9bdeda463175ce9867c37f81b23bdd23361e704", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234228, "uuid": "2d0add8c-31ce-47cc-89b5-d1959eb4a0b3", "value": "5DF3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234228, "uuid": "6d7151d8-0a6d-4857-8781-d613b16a73fb", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234228, "uuid": "1f85e2e8-c465-45c6-8d7e-92b90491d708", "value": "3072:lP45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:J4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234228, "uuid": "1b298150-d8d4-456e-ad5d-0cb4ee7f048a", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234228, "uuid": "4c9eb043-17d4-48c3-98cb-43bedb9e8203", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234228, "uuid": "625c78e5-d010-49c5-95e0-b7db63d52f31", "value": "2f09e952_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f21e903-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209188, "uuid": "89f4442a-2323-47b2-a86b-5a0db0c047b8", "comment": "Malware payload", "value": "fed1a45c41fa250e09b696586d0377a9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209188, "uuid": "50dbefd0-9371-43ff-9f56-a0ac83ac1f51", "comment": "Malware payload", "value": "110670d78880f947c4d684baf03fa0b91dea633948664df6d27135b0fe838b48", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209188, "uuid": "738ee8b8-c3a5-4bfb-a25d-965f8cc66440", "comment": "Malware payload", "value": "cb35b5c90d46e9b81b5b1814268900bb9097ba68", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209188, "uuid": "c9883a09-79a8-49ba-b9f1-720ca9b9587c", "comment": "Malware payload", "value": "0009b692707c11c5f90e1cb1e46ef0f2e34da8fe038576ca082d2b70a0a095cb2395383fd0b301936aa78fda397ae631", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209188, "uuid": "9c63cc67-7b94-4221-817e-c27b2dcc0110", "value": "24D49D473E91FB9DFD8CC63A60B0AE710171F9A18A70E7AEE92557E1123C36380D855E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209188, "uuid": "d7727d20-6c75-4d0f-9901-db1e396c3f52", "value": "276986483ad378a4bac9b13395faa4a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209188, "uuid": "c465a316-4cae-4428-adc3-e115cc1f66ab", "value": "12288:+o0mjb5G9dZivNrqUvoJQgnx9z0yKWWx7KNePP6E0Zx5F7ad1VOPTm:+ejbzvLoJQgnbz0ZWyKNePP6E0xF7smq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209188, "uuid": "43231240-9b9a-4b8b-99e0-555e35a146c0", "value": 643072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209188, "uuid": "aad64c58-659c-47fc-b8fa-0f222a18daec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209188, "uuid": "3ea7b178-2b4d-43ca-a44c-85a7dee6b349", "value": "fed1a45c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "260c33aa-ad81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205576, "uuid": "6f6ae5a9-f256-4938-a1ea-000185a7c88c", "comment": "Malware payload", "value": "51e28185f953ef83d70aee6d0cba196e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205576, "uuid": "e01a17bc-7c4a-41be-af14-9417211c82aa", "comment": "Malware payload", "value": "118991882f6d033a129f492f03cd6dc42db1b0a5b571f2bd26154aa18486b1da", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205576, "uuid": "65c084a9-1bc9-45a2-a182-6bd41acfaec4", "comment": "Malware payload", "value": "562ddaa4f48bcd488753175960258e97ee167a42", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205576, "uuid": "6a3fc16a-7e6e-4d84-b6f3-75b715aef1ab", "comment": "Malware payload", "value": "fd2008fd0b3c0ce5c31d27e01254716a43e422dca7fc94315f0045ff858e3a116f2f59691a44e5f4860d1cf04e5fbf55", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205576, "uuid": "f46f2dd8-70df-4008-9913-f0263a1ce9fc", "value": "1415C07456B869BFC36FB7F18285BE78BD6B4D630D1028E1CC00A865A649F50D1FD82E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205576, "uuid": "a5e7c78c-40a1-49a0-ada7-71f02adfe5c7", "value": "4c65b9f008277f731aafd33b21245997", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205576, "uuid": "09fc89c0-918b-4317-83fb-a37ea0eeebee", "value": "24576:m4dB2FWuMWCqTJzKxTFfL5RsXhFhai4+q69P0Akqouc3CPI:LB2Mc1zKBRsXbkLUZoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205576, "uuid": "49f4b33e-f8ac-4637-b50f-a9bc71551905", "value": 959488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205576, "uuid": "5018813e-5e63-44ac-9ede-37b701ad5a2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205576, "uuid": "b5134a2d-5416-4b52-a861-f57557405418", "value": "51e28185_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f2e3c5-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208535, "uuid": "f90462b4-899e-4fb3-9bab-1858fe42b90a", "comment": "Malware payload", "value": "9fecab42ce60a5f0cc69446a561a8490", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208535, "uuid": "77278dc2-1a78-4e62-b6da-f3bb3c3f1072", "comment": "Malware payload", "value": "11be8a99912ac8584722f7b910b06b1faff4a4e0a19b012ec5174198270fb49f", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208535, "uuid": "05f9aa71-2bea-4f48-9012-d0115b0a94b4", "comment": "Malware payload", "value": "c0128d3ada302eb0f169e0ac9c169d0e1ec92ffa", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208535, "uuid": "188a3c04-ea35-4835-8262-b17dd14546df", "comment": "Malware payload", "value": "46c74d3a8db30b24d42297f14ecfa0d4ddf0939bdf3a0a960b9d79187e1594f0ba73299e9bf90d3a8668acba228033e7", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208535, "uuid": "113d0e1d-9b3a-4ece-8ae1-2e35561ea1df", "value": "0CC53351B74B649AAE941AE0CF4CF6B99E008FF5B5D1C730F9B10E5B2278A4C2F5D821", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208535, "uuid": "38ba3a1d-816b-4f4f-bb46-36707125862b", "value": "49152:l1UdkOgGKlJkHZrZ39xWgpsc9Ersdu9LxhM/uZd3cKLN0x2doXoL4a6OG:l1akFnQrZ33WKCguRM/u75xLUoUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208535, "uuid": "87732428-eeb0-43bc-840f-19fd3b892b01", "value": 2617344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208535, "uuid": "0c1331b7-c3a2-4234-8977-011dfd673473", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208535, "uuid": "49b36399-9085-4752-988f-a4a9496d49e7", "value": "11be8a99912ac8584722f7b910b06b1faff4a4e0a19b012ec5174198270fb49f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae8e886-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208537, "uuid": "883fac1e-cd42-43ad-987d-f20c0d84845f", "comment": "Malware payload", "value": "5466bf6ed58d9d5df377296519dad175", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208537, "uuid": "95c7565a-525b-4a9e-8bad-3ae0ecb592f1", "comment": "Malware payload", "value": "11e2de830bcbc6b7459252d5a1c273c6e67afb7c80ed3c17d6441b0ba257078f", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208537, "uuid": "6008ffe5-bdb3-4791-ac32-fc54c23fa9e8", "comment": "Malware payload", "value": "cfb358878d3e0a3e2284c13e3d0f2eb52f3ae662", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208537, "uuid": "3b75941a-5765-4038-a550-88cad859d2ac", "comment": "Malware payload", "value": "19aaeffcc0007b5062414d31e40ac656a0863917cb369a4f112be248594a054edda787078fe0f80ef2fa6f016d6e1051", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208537, "uuid": "d76b371e-3d46-4e13-ba8a-89352c8f2455", "value": "330384028EE7DE147376B0B4E5CDA84C7A9A40C65F8B5E243C4DA3AEEF5277051F4688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208537, "uuid": "79f7b66e-f8a4-4f85-9c05-f6cf2a30d28b", "value": "384:v4NqqVC/XmfIywe4Xz2Ye6/NBfuRLa4zBfty1jX1Gujt1lifvzM5re2Mb:EzfIywe4Xz2YeGNBfuRLfcjROgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208537, "uuid": "974183e9-6334-4ba9-bc68-fcaf9b345565", "value": 39428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208537, "uuid": "da438f92-568f-4286-8b62-263a101cb4a9", "value": "text/x-perl", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208537, "uuid": "bb4368df-3680-4fa7-abe8-933a9b1d88e4", "value": "11e2de830bcbc6b7459252d5a1c273c6e67afb7c80ed3c17d6441b0ba257078f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a5c094-ad9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Matiex)", "timestamp": 1620218113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620218113, "uuid": "ccf92de8-e24e-4026-97e1-778d6a5f668c", "comment": "Malware payload (Matiex)", "value": "a4851c92bb55a712a5ac8cf168a021f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620218113, "uuid": "d340a6fd-29e3-4e53-960d-37a3aea08c63", "comment": "Malware payload (Matiex)", "value": "1202a5b17de16220f1b5555ccb26de761ad10cc4fef529ff8524b1fa30852382", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620218113, "uuid": "733eaf50-acf0-4d39-8ad6-3ea7deb0f20f", "comment": "Malware payload (Matiex)", "value": "8535fbcc6d42b71db056fd0b6b93cdc35810c541", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620218113, "uuid": "72fc0e97-34be-4e50-970e-18878742b96c", "comment": "Malware payload (Matiex)", "value": "4c3fca15b74ae2f4f197caf73ad99a2b968f636474b56638437a060c7361ed0223294e9d1c2b3453b443baf7d510cbce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620218113, "uuid": "e000c428-8071-405a-8382-bc7462e7e5c1", "value": "095592AC325031EED567DAA69BE92C24E6203476572F4207962303FD9A0EF53DF245E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620218113, "uuid": "765a495e-f980-4449-a525-24177c311298", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620218113, "uuid": "41dcb676-ccd3-40c5-8484-73c9f29f8a1e", "value": "24576:we9eme2emeX5Y0omoLATl0RqtP7VdnSAQhHr:rE5p55ORq9pdzQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620218113, "uuid": "057f3922-261d-4313-a941-78c1ab61189c", "value": 1298432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620218113, "uuid": "9fd92c78-4fd8-487d-a71d-3eeec92a6f0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620218113, "uuid": "60b9da60-9383-4eb4-a7eb-a22ae716ea30", "value": "PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a194f477-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209219, "uuid": "bcc8aeae-a6c1-4f43-9cac-13fbe5d803e9", "comment": "Malware payload", "value": "15e96867c9ceaf83df6bf84c5cb2ad4e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209219, "uuid": "d9343f0f-51fc-48fc-8aa1-3889b89648b4", "comment": "Malware payload", "value": "125dabd4810262b9c261bc5682ca9a86aa7ad2359fe7a770c440eb4d9c3505ff", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209219, "uuid": "094eabb4-f9db-47b5-b66a-8f8f40b5dad6", "comment": "Malware payload", "value": "035fdeafcc61b4844473db6c43ae249024a09fef", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209219, "uuid": "d778bf1f-b356-4474-8f26-49176e0ba2ab", "comment": "Malware payload", "value": "44aba6d6f6db8e4bd1631205ee809d2e00e9f0263bed134bea8044623213f36654ad67b7868912e3bf938ea89d0cff30", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209219, "uuid": "c3cff6f0-fb8b-4051-b866-16ff33a46120", "value": "012417445BE90622F1F32B7195F645666E76BC93B972CF0E0A81425E0D76F40ACA0B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209219, "uuid": "07418762-d7a3-4dd9-8154-2cb487613132", "value": "406c785a6e2c6970c1e8ed62877e197b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209219, "uuid": "f8004ac6-ddff-4e62-b509-c329614d49e7", "value": "3072:ChOmTsF93UYfwC6GIoutAep8KnTMPg3YtjQ1HpQNYNzWq+qCq+qXunk1V4Ei6Kx:Ccm4FmowdHoSRt5BC64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209219, "uuid": "4093f633-a935-4895-8552-9a8bc2425edb", "value": 211952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209219, "uuid": "5d6d8abd-873f-45e7-aaeb-4e1cc7a009a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209219, "uuid": "885aec91-9085-46cc-8297-a3940122c425", "value": "15e96867_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c53c42a-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252160, "uuid": "b7ba2e74-809f-493e-ba97-0d828910e05b", "comment": "Malware payload", "value": "057126d1908bec937de0ba5ac97dfcbe", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252160, "uuid": "e83755f7-776a-4c90-9ef9-df84746a733a", "comment": "Malware payload", "value": "12d1cc07c6651c89a5dde8700462956510e5d13552888d0322abd16d9762f4c2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252160, "uuid": "6ed94fd1-7164-4642-b900-18649cbc766a", "comment": "Malware payload", "value": "6d16864b77d8661ee1db2ecbd4b8a3eff0ed04a4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252160, "uuid": "20add89c-caaf-4271-8ce7-2589c4d69da7", "comment": "Malware payload", "value": "776488bb1ce449c73fc22d198871349aef7edf78c37706d2d7b754c71a3ccec9c96371d29c452126a43fee39b485c439", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252160, "uuid": "708c361d-5636-4efb-8c55-911817ba9d46", "value": "E4F3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252160, "uuid": "0faf3837-9b73-4c32-a2f0-ca5917d0deff", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252160, "uuid": "136474f6-1dd5-4424-ba6e-ef8913ef5d85", "value": "3072:Kd4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:rDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252160, "uuid": "79decc9b-bed1-495c-8e78-79585fe3bc03", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252160, "uuid": "d170e7c1-2cdb-4dca-b110-392b06437811", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252160, "uuid": "e678ec5d-15fe-4518-adc0-03c396af2708", "value": "057126d1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a37132-adce-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620238969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238969, "uuid": "a47c1f3e-8903-44a9-b97d-a605b2251cad", "comment": "Malware payload", "value": "c91a226d7e87dd297ef9b55b1cf88dcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238969, "uuid": "5f0a2590-6fd5-4a80-ac18-408cb9abb91e", "comment": "Malware payload", "value": "12f249adf9e96719d8999e5ff16ca67fb252cb38edf05851577a564b3044f987", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238969, "uuid": "1d3b03c7-1870-4bf5-8d72-afd19ef4360f", "comment": "Malware payload", "value": "c8c66465d65c40f2946c4e0ade42a3a8f3b98ca7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238969, "uuid": "a4b440fc-f24f-4fe8-a2de-130c53b74816", "comment": "Malware payload", "value": "6bd7418d0e2776735575b21505f65c0b6f5e879d273609c405b157553294bcbb299a197364bb9c1b4a3063ff7df9dab9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238969, "uuid": "248ab990-72a1-4d90-b95d-91d5ecb3f416", "value": "5475010B9DEF5177FC512B70D42549B310FBF9F60E464722B6E0EA0E2A70FA165384A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238969, "uuid": "7f02308a-3db5-4303-b114-57ad6108d0b9", "value": "2f095340e94ca508e3b83fb009ebf4cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238969, "uuid": "3a295c6b-f72d-4602-8597-763c79fc2a98", "value": "24576:NcCT67wHqWis4l+jIACFr5hqjiLDpSJDN93pqb6W8cU4gLQGA:+Cpn8t74iA3qb6W8cU4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620238969, "uuid": "77fc28e6-d8b5-4130-ba47-171587e748ab", "value": 1576960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620238969, "uuid": "65a355a6-7859-4c00-8378-772c0f958d9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238969, "uuid": "4091d1d2-431e-420d-a4b9-a84ea115995f", "value": "QUATION SCAN-COPY- PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ffb0d03-adb6-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620228410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228410, "uuid": "90efa558-876a-4a50-bfff-0d607b07650e", "comment": "Malware payload (NanoCore)", "value": "1cbbdc6d8b6995cb8520112ed4613446", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228410, "uuid": "e6246365-66d8-4ab1-9114-38f16c28e979", "comment": "Malware payload (NanoCore)", "value": "130a875f36a8c9c6b7f9cf7ef2d863837af130538770c76d92b6016b8a00a6c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228410, "uuid": "b8c784be-a719-493d-9f3a-adb92aba1c76", "comment": "Malware payload (NanoCore)", "value": "9f998f18bf2e3d92bd815d4d90f0e496e616f07a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228410, "uuid": "44453564-18eb-493d-9761-825c9d64a438", "comment": "Malware payload (NanoCore)", "value": "397fc7d22054269f4c2b27b00a0955b569dd059d203859682eab918dd9965a4db1d6251e6749a582fb444376eb0b8d61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228410, "uuid": "72e645be-5711-4508-bab8-dd18ffcc9043", "value": "0C1507B871D0E5F4D616493227DA3C3143F50D70E836A90A9FACE7F98532E632B3594A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228410, "uuid": "57f57792-9f6e-474c-9877-847161bd361c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228410, "uuid": "d0307290-6a45-4e08-982e-20eac95429e2", "value": "12288:ucxOYqoLLoS60/K7yh04ZfKv7XAsV4WPEJP2tBSQoP1Zs04NNVXMznjTE:9xOYqoLAR7EeEJjl1Zj4Nfanf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620228410, "uuid": "36d44d2a-7edd-4f6e-a2de-fbf81419a762", "value": 941568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620228410, "uuid": "a7223986-97d0-456c-a100-da9b96c89fc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228410, "uuid": "cb111964-fc54-473c-a7cd-4c1535b9863f", "value": "Doc_U40-5-70154.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1c9aa3d-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209273, "uuid": "23aa7c4e-5bdd-4caa-ac1f-9656f4c5ca37", "comment": "Malware payload", "value": "52112cbce9cf1c43d0c342641b6737c0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209273, "uuid": "63a2995a-b6ea-4aba-8c79-052abd303b4f", "comment": "Malware payload", "value": "131fb3bc3d981fbd808d1088cd1932fa8fa0096d077621224d45d2072e573c37", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209273, "uuid": "71b88d7e-9a12-46c5-802a-f8948eca6e20", "comment": "Malware payload", "value": "2ed43e57667a4cb032e828afac4b25114f28dab0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209273, "uuid": "b0fb2d41-8251-4bb9-9962-4c8c31282989", "comment": "Malware payload", "value": "950791e293c8b468f5e5759b8906da071911b17fea288d7af89e58b2266e736016c647c618a028369079d9b1169d872b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209273, "uuid": "d6b2207f-e1f5-465c-b146-d88271121609", "value": "1BF49D68F3672C71EAB24FF235CA74495668251174BF28891B7709CF7C28892C7079EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209273, "uuid": "b5737215-60bd-4add-8e39-840244bea5b4", "value": "ed230385d43509033e5ec1c36d50cdf2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209273, "uuid": "6142a785-f8bb-41b6-8531-890424be3e0e", "value": "12288:EgweYg7lZasNavEdxBoqQmhgb15/GnixhvKR2WKN6lYKs+5Vl93C02kkx4u1RDBz:FwCBgvgvgR50GhvKUWKN6lYKs+Hl93mh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209273, "uuid": "4d78088f-d126-4589-9989-cf08257ee757", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209273, "uuid": "41cc39e8-4305-4c03-a98a-05504351a229", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209273, "uuid": "9d43228a-58b0-40c9-955f-59df4bdc8e3a", "value": "52112cbc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b84bb18-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201747, "uuid": "b6e66790-4170-477c-8705-cc74d601d4c7", "comment": "Malware payload", "value": "f6527b71c1c9644fd0a8649c5387c529", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201747, "uuid": "ee9bb9c4-5f07-4505-96df-1385ae23445c", "comment": "Malware payload", "value": "1326c4b5f16b37e3474154b0497d09583257a88c050637749e5ee9e91f705b74", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201747, "uuid": "4a86b347-9d0c-4da9-9d55-d3c3a6b8bdcd", "comment": "Malware payload", "value": "7f321078ac516a70b57f230bc3707cd6fef6ec04", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201747, "uuid": "e8d31eeb-1335-469e-8898-0b3fe8c57e6a", "comment": "Malware payload", "value": "50ff54e78e724fc6b46e79824bba30a3fa98729fe34f24c34ac05ff1610c47250406284283d72988abc74685279210e5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201747, "uuid": "80c965ea-6c9c-4aa7-a08c-e436335a29e2", "value": "99A569E4696DFFECB003D2295B2B87BD497E17190ADD40E75EC3E21E5C92A1A2738314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201747, "uuid": "28d5b594-b290-46a0-b4c0-e0a874ca117f", "value": "b03fc98833cfa46fb1839ddeb916a11e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201747, "uuid": "0ae787e9-a948-465c-8af7-eb4f23be6e88", "value": "24576:A3MfY2n8s/7fmnnILaxuIPa5l0XuWnJolVZ03WmCpomeb+eWhAHdhxfis+3GDtJt:A8g2nn/7Taxupl0Xx1iPG/Tqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201747, "uuid": "a9f089de-14cd-44eb-baa6-3d7161c543aa", "value": 2245120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201747, "uuid": "4647497f-8663-405e-b13c-d88ae5c406b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201747, "uuid": "28f6c33d-40cc-454f-b77a-bfddb3d6d13f", "value": "f6527b71_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c72350-ad99-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620216132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216132, "uuid": "a4da9bc5-5385-49f9-83b8-f9ce16ce08ec", "comment": "Malware payload (Dridex)", "value": "87b3c5fb1936da1c197a7753944621a8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216132, "uuid": "822da964-ac48-4c87-9565-4bf6ab83b74d", "comment": "Malware payload (Dridex)", "value": "13a0407ed0fba9485a388b6260640c47037c832673598c5a44802b6948671a7d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216132, "uuid": "6bd28f38-b5ac-4967-8516-81caf3b03dc7", "comment": "Malware payload (Dridex)", "value": "39455145bac5ae5eef3f8dcb8442fc5580cd00e2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216132, "uuid": "30af44ac-ebba-4e3a-963b-edad0b743f7f", "comment": "Malware payload (Dridex)", "value": "3bfe5d5885b1559f6b28350087ecb21ef13ef026d66f3b652840d56f974982bd15a2b03a3f9aa43287db278bb1aa535e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216132, "uuid": "98a9cf21-c463-42d5-9388-4a5023af64e0", "value": "19F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216132, "uuid": "12578b33-f6eb-4a9c-86a6-b766be142aea", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216132, "uuid": "ac5a382d-95d1-4e9f-acb9-2e3e92924bae", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620216132, "uuid": "96c0985d-8189-4aff-9e9a-1ce5cf94b047", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620216132, "uuid": "5afbb344-384e-4983-bdc7-10954ddc7a40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216132, "uuid": "e0dd9561-6d18-492a-8ae0-810c042adefc", "value": "87b3c5fb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c013ef-adc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234273, "uuid": "10719b8a-670f-4eb8-b4c4-0044c2f32d27", "comment": "Malware payload (Dridex)", "value": "8b753b9c60ed0cb848f018cc45cb712e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234273, "uuid": "5209a1c1-7943-47d5-aaf9-adb6601f0b87", "comment": "Malware payload (Dridex)", "value": "13b6a5094b5ac292a2c6f28e0ecb4749b1463e55325d16445aefe35d8199ec2b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234273, "uuid": "233be9c2-7681-44cf-87b5-342ecebdb7fe", "comment": "Malware payload (Dridex)", "value": "2a7e13fd168bfd393161a31531f60bcc8ee7a6b0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234273, "uuid": "b4fb04a2-a0d5-43a4-b594-5a97c3c7c2be", "comment": "Malware payload (Dridex)", "value": "30465c3fc4d2ab58533af791c33e3807f213b54acdf76875ae89c7d3879417773f9ac8f65e1da9ca7009a02ce1ebf3d3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234273, "uuid": "0f907d73-4ddd-41a5-9365-3a9a788c2bc9", "value": "82F3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234273, "uuid": "95396dbc-e93e-4ea3-a80f-73a67cca3471", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234273, "uuid": "3a368787-9410-401a-8914-f3ba39b35c6d", "value": "3072:qP45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:64KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234273, "uuid": "93715ba5-f1ef-49ba-be38-f44536f51618", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234273, "uuid": "0648a7fa-0407-41c9-8f6c-51e423d80419", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234273, "uuid": "ac759520-835b-4345-8d1d-1418f6f40498", "value": "8b753b9c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "476f128c-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241710, "uuid": "155898f5-7115-4953-b4ed-2bb3413a641f", "comment": "Malware payload", "value": "4b1efce6e8e5b36f2ac362851f2cc774", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241710, "uuid": "bc8e7689-88c6-4fb5-8abe-1961416272b3", "comment": "Malware payload", "value": "13c271c02fb2a94e1b2e83df0415fe778255a8429121ea7f9bf8e5ec8dadcfd6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241710, "uuid": "d49ac07e-66ae-4de3-9126-9a77cae24d22", "comment": "Malware payload", "value": "d1ed71f7487e1fd72022394c5e064732a5532444", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241710, "uuid": "5c8165ab-5349-40f5-84a7-202137911142", "comment": "Malware payload", "value": "033f40b317031cf943e453baf3d283bc7769dfe89c116c4aa9635ee8cf451b594f3a0147edf5ac495406df4652534e02", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241710, "uuid": "7ae8a9f5-48a0-46f9-a211-44e80a638518", "value": "FAF3C085DBABE87FC45A35399071DFFB5B388B149640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241710, "uuid": "fd5b45c4-cfaa-49a5-9737-751d6029b5ff", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241710, "uuid": "e1c0df23-903d-426f-8898-0d652dfb9566", "value": "3072:3945bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:N4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241710, "uuid": "be7e4602-7094-4340-b993-a8f25bfe90d8", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241710, "uuid": "795f87c6-5602-4b15-ae94-642bb50d5666", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241710, "uuid": "b829eba1-0f9b-4a05-988e-250a22d6f625", "value": "4b1efce6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee5b2fa-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212597, "uuid": "403fee84-d4d3-41b5-9b05-ec49cc007157", "comment": "Malware payload", "value": "4b85bcb861af6b54969e78b14d6290b3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212597, "uuid": "0b7447ac-34be-4632-b33b-96da0300733c", "comment": "Malware payload", "value": "13ecec13a36c10498b8dbb863be7b499efb55d5fc4a8315e2264a81ccffa3e9f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212597, "uuid": "434f3e49-e6ae-4dae-8177-69f233f5dcbf", "comment": "Malware payload", "value": "8184e07b8c9ba10507291db8d7330954a327d5a7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212597, "uuid": "5959dd97-a212-452e-9884-aae428b58750", "comment": "Malware payload", "value": "c40388e3c804cca62eeee1d59f471c359fc565a48ba985a7a689cffcf02c26dff053cc4bd51e2d0ec47cbbab6835cb2e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212597, "uuid": "cf80c221-9682-4dca-970e-66f8b6381cf6", "value": "CCF4AE71B6134F73E195E77C8595CEB8234BCBECEA209B986C1A71161BA01C7E83171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212597, "uuid": "06e69ee0-c6c5-4c7b-8e15-3116ed034dcf", "value": "f44b0abb83ed40f29f0aae8f6eb28bf2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212597, "uuid": "c03c9c2f-bcf0-46ab-a3a0-6ed9d44a9430", "value": "12288:935MhDDt0llZTYHGWUuU2AA5KY1S6A6n6PiSclfgIGvADengHjx5tUPti1Tm:YDe/Z8FUuU2HsYs6Cwi7ngD5Ug1Tm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212597, "uuid": "9e3fefd8-9e16-4d43-a894-0605aa3aa0e3", "value": 764416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212597, "uuid": "b8cfb944-d012-4d84-81fe-ad5ba01339e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212597, "uuid": "42dc49c5-ca56-4272-af59-df16d342cf5c", "value": "4b85bcb8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b46ab48-add4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241340, "uuid": "ff97010f-4734-47d7-9549-4d9fe2d728fe", "comment": "Malware payload (Dridex)", "value": "5fe95ec9363b07bab61482c05fc51df3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241340, "uuid": "8b95f2f6-0075-48dd-9eb6-8168c96ff7a9", "comment": "Malware payload (Dridex)", "value": "13f04576ba052cd8883b87b00848183e82dc0f06429c9f11c0559392bf00a460", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241340, "uuid": "ef3a5f82-83df-4f39-8da0-234e79afac04", "comment": "Malware payload (Dridex)", "value": "7b38982fe24c53ed45b615f3ffab587bfae83de0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241340, "uuid": "e0ff731a-7be8-4c40-b4fe-d6b3c687d7dd", "comment": "Malware payload (Dridex)", "value": "39c3da8f6d13f873c01e799d71dc00cca49129bef523e07a4a997389aefb9d66d7b7219c7a11ab7caa03ca17b3594a57", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241340, "uuid": "f0214c49-994c-46c9-bff3-882a1a196221", "value": "B9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241340, "uuid": "a65b9b54-a6be-4864-9a1d-2ae5e3825578", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241340, "uuid": "718d2a9d-3c4e-49ad-b179-f83087a12df0", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241340, "uuid": "22884494-3efd-4e1e-854a-75c04049840a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241340, "uuid": "f8b14fae-7caf-4841-895d-2746d784aecb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241340, "uuid": "b306066a-fc94-4f55-aff9-0828d79a5e1c", "value": "5fe95ec9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0958a389-ad92-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212829, "uuid": "061ce2d6-d6af-4e46-bad5-1351085d0b2d", "comment": "Malware payload", "value": "dd5ea9e96c9c000379ff5ce132dcc754", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212829, "uuid": "71018e2d-bc6e-4284-98ce-aedc183124bd", "comment": "Malware payload", "value": "147587e77bfd38e2818c96628981744e716aa058dfe6a1ace8e1a1c5cee421be", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212829, "uuid": "e9f524f5-d2c9-4941-91ce-3fe3b24e27a4", "comment": "Malware payload", "value": "22fc09ab3506dd5e2ec0688c80763c0bb81ff3ab", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212829, "uuid": "4371c191-d459-4801-bc62-2c01ead1c95a", "comment": "Malware payload", "value": "3c3ab245acbd236bc6cb8f05b90fe74892fae0d3402f5a352e246343a3c4b8bb7dca9014a7b9062211e043d9c585da5d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212829, "uuid": "cc5454a2-5bc0-4987-b9f9-3837faf2a4e1", "value": "71E4DF95802ECFE9FD53503A547A5B309DF4F736A8E63532E7A3394B162898E11423EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212829, "uuid": "30c8313f-93c3-4873-9d55-ba1186447e34", "value": "31fbf8ce10cd99621678cbdde800a77f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212829, "uuid": "af08f2f2-64fa-4119-9742-22de98cce0a4", "value": "12288:o+RxIqH3M4WWTuC6Hfmgpk9i5C650OF3RXxm3e/taKjXacXdgdjqQWeFr1rniL6W:o+RWqXoWdgpkWk39cdgdjqQWeFrxiL6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212829, "uuid": "861e4076-708b-4dc3-9f58-3beb68bb0ac2", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212829, "uuid": "79e49121-b963-4fba-a51a-e33c09e68d77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212829, "uuid": "25447f80-909b-461e-aadd-68bc2ac164f6", "value": "dd5ea9e9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de6132d8-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241963, "uuid": "e62e4c9d-54e8-4219-a269-8df965f4e22b", "comment": "Malware payload", "value": "593bd40f20983284d605f53b67410527", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241963, "uuid": "974c6bfc-f0f7-492e-9491-af684e489b05", "comment": "Malware payload", "value": "1506f33bfd460cc59d2f9ab0442fc4c9d62b01cd00017d4294c349748d777e3d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241963, "uuid": "04df1be5-1064-48c5-9a45-bd4b89a9eeab", "comment": "Malware payload", "value": "8b68bdbd6d742da1bf72dfb57bc9c03bf9ecd3fe", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241963, "uuid": "f61585ca-a4f1-4956-8c7b-02563d5216e3", "comment": "Malware payload", "value": "e6c6760ffac1265717a41b438cbce24ed43a41f6e4b9faa371d056f917bd4ddc5f695f2ac125c22abd1c5793746affaf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241963, "uuid": "cb70d7e1-a427-4543-b978-cbc3ffbf47ad", "value": "A4F3C085DBABE8BFC44A35399071DFFB5B388B145650C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241963, "uuid": "bc4f9959-6e39-4214-b9ea-177e69c8f863", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241963, "uuid": "ce9f9147-edc0-4331-8bc5-81731532a859", "value": "3072:aM45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:14KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241963, "uuid": "cc4c7527-2093-4f29-87f0-c230e4e94f37", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241963, "uuid": "d8afb2da-94b2-486c-961f-ae256e279a32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241963, "uuid": "c8d405bd-eeef-4b36-a87a-c918835a2219", "value": "593bd40f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81a5a076-adc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234077, "uuid": "e86f636e-93ab-4977-aabe-759c7e9e8549", "comment": "Malware payload (Dridex)", "value": "b7c7c6ab417c39c65623ae76315aabf5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234077, "uuid": "f07ab2eb-f538-4fbe-9cc1-9992b016bead", "comment": "Malware payload (Dridex)", "value": "1523b17a030eeaf04bae20f0392f300520cb84b32622bb8fb9ad7ec96dfd26c2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234077, "uuid": "eda9ae1b-8486-469b-bca2-0b0032ffd3e9", "comment": "Malware payload (Dridex)", "value": "2bddc2ff3ade24986688a96ccc6957c96fe97949", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234077, "uuid": "0c5b2257-16c3-459d-999a-b219c835697d", "comment": "Malware payload (Dridex)", "value": "da80ff2cc411600eb49665fcef7ac1624db48cd332f3e98a0806f0c252029e14124126a49266561cb5cf9375e0ba85f7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234077, "uuid": "b3decf22-1d4f-491d-b5de-44749c0ba84f", "value": "30F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234077, "uuid": "c082c318-5f2f-4d5a-8f03-d03f2a9f0379", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234077, "uuid": "7a36d7a3-a9b5-4c48-a7f3-7300ea20a0a1", "value": "3072:piFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:aeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234077, "uuid": "1b8637c0-ff12-46ad-9861-73a4af972e20", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234077, "uuid": "3dd23172-9691-4b38-8c97-a58b03302099", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234077, "uuid": "d38f65a4-798f-42b3-8831-20f02891fc79", "value": "b7c7c6ab_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "657ef2a0-ada6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620221574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221574, "uuid": "9beac752-9657-4cd4-bf63-9d0de6860cb8", "comment": "Malware payload (Quakbot)", "value": "70fea7d5e2aee066022e34afd14fe251", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221574, "uuid": "8d48c17b-a95f-4085-b0c9-b132971c81a1", "comment": "Malware payload (Quakbot)", "value": "154bb70ce4102c04094ec6076d61fcdbb53bdb01e8e401fbeeab42e667cc7778", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221574, "uuid": "d8015fd1-ab97-4e2b-a3a3-e9b4deb2293f", "comment": "Malware payload (Quakbot)", "value": "f129ba34313f97f973d1ed7df6df69e383428d5c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221574, "uuid": "92cfcb93-21ff-4ca0-8d3c-0fd054724ff1", "comment": "Malware payload (Quakbot)", "value": "1631cdb52544c1cd1d2adf5d2b46d6e13eaeb31424c931d7e6792a4b17ae2dbcfaadfccb094b40477bedf591f04cce8f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221574, "uuid": "f23be0f7-3d46-410b-afc7-f9add89ec260", "value": "64657C31B1D2C437D473267C9D6BA29D982A7D111E28985B7AE40F4CDF3A6803E2D2D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221574, "uuid": "20bd85d2-878c-497d-a95d-b6cb3bedc893", "value": "413398ffac649594b2b53c025e6614ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221574, "uuid": "d8c0d923-ce96-414b-8502-34b2163e5826", "value": "24576:LAboz/I6budWhdq9EROsB3OPh1tWVJFgQbpXLGmw5h:sbeeGRuPPu7Uh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620221574, "uuid": "2a38c366-e235-4b57-aa0c-31ff82ecfa95", "value": 1472260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620221574, "uuid": "8abf47e3-236e-4f17-b12b-52955f53971b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221574, "uuid": "5cf3aa8f-1e07-47d4-a2f1-a16039e32d69", "value": "70fea7d5e2aee066022e34afd14fe251.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb9a2b8-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208538, "uuid": "ad96731c-b124-470f-8b76-b42384401782", "comment": "Malware payload", "value": "e8f509b0771e08b5afd319977afbff62", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208538, "uuid": "23bf933a-fffc-459a-ad4b-e269936dac25", "comment": "Malware payload", "value": "157b8ae0ac696e1f0bb58827ef3e6e978586a16b6750419f463c04701ee32d41", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208538, "uuid": "f8a4f5b8-b36e-4fd8-a81c-6fe9d4cb3d67", "comment": "Malware payload", "value": "64047f325b6cd76ebd94e928946305e868f41422", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208538, "uuid": "a6d9884a-073b-4d16-9a79-9a6712482ad7", "comment": "Malware payload", "value": "eca1ab42a41171c01c49d61b1fd6bb6ef4a1c38d3c54862e5652dac267fc2db8423b07929a55b8abe0ecebfeb979c3cc", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208538, "uuid": "9f082a8a-9417-47ff-8264-f4389e47ae5c", "value": "12A1F850112C1AB07246597AD26FFA52B40EC81B09777B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208538, "uuid": "35c56f14-1c90-48ca-a1f3-61a84d6ada6a", "value": "96:wRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:wRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208538, "uuid": "399a62fa-250e-4f51-bb5d-d9d06a3a0041", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208538, "uuid": "348df63f-ff0a-4316-8312-2b9d958e43bb", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208538, "uuid": "2ddc1e75-8eaf-4941-a8a2-d1465eee9423", "value": "157b8ae0ac696e1f0bb58827ef3e6e978586a16b6750419f463c04701ee32d41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa6675f-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252238, "uuid": "7622f72d-2d5e-40ab-8442-ee61d4b2dc34", "comment": "Malware payload", "value": "c7c81f9e01c7c3cbb9646f2996de2ee7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252238, "uuid": "f847dae1-c65b-494d-b673-61fe3e84ef1e", "comment": "Malware payload", "value": "15809c6dd478b1f9bdad56fac12b89813643dbcc4e3f08d42da0eadb601e70da", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252238, "uuid": "5d03ae68-2d90-4593-8579-52e497b7c554", "comment": "Malware payload", "value": "e90fcea919c73b4b4f743afadb42bbc8af2cbc27", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252238, "uuid": "26eb9052-28b5-4fd4-9dbd-b02ae2bbfdba", "comment": "Malware payload", "value": "de23c7c327e7e8c6981d00e8ff22399cb7d5a7ca9f1cb10c016418f12ad1dbcb037b7140e5a71472b96a553d1b4fe001", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252238, "uuid": "62aa3867-1bae-442d-83b9-5be1389e0f0a", "value": "EEF3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252238, "uuid": "52040a95-3f9c-4921-ba86-02001225a3cd", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252238, "uuid": "2e89a7ff-8d0a-46c5-9467-680aab2dcb91", "value": "3072:NK4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:fDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252238, "uuid": "9f893bd9-8a51-4e97-8b00-abb2e36c5e88", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252238, "uuid": "d04a7391-87cd-48c6-aa6a-8fc66a1a48c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252238, "uuid": "441fa1b2-0ce4-4ad7-8bdf-a54a2f3b69d6", "value": "c7c81f9e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8576b8-ad80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205483, "uuid": "6cc9d823-344b-4af0-8224-373472932933", "comment": "Malware payload", "value": "bac49cace1f4cb42199dfc38d03806c0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205483, "uuid": "30228991-8372-43ba-bc88-188f79e2f6c9", "comment": "Malware payload", "value": "159ac48300931c1c01d8a52d050c96f8c888d774101860fb51889cb4755ddcef", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205483, "uuid": "6b030cf5-0d56-4cf2-89ea-03f472ea8546", "comment": "Malware payload", "value": "3a27b71229600297b457ca9ca6d4da00bed2eab2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205483, "uuid": "70bb9001-6915-4d76-bf62-b42a744f6560", "comment": "Malware payload", "value": "a96744273ca14c5694fc71d314fa2d2d36c3e34370ff7b338fca19a84217fe618afbb95496d9d2b724c1a1785100ce3e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205483, "uuid": "76449224-900e-4ca0-9d99-69adf0c59a23", "value": "95F4BE6FCFF460C0D599D6791B4101D90C52EBAAA8AF5AEFEDAC47B32185FA547B0030", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205483, "uuid": "469f652e-fa3c-4593-bbfd-7e9074359d86", "value": "ed39786d62b4f0f662e967d062556c7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205483, "uuid": "b232f03d-cb75-436c-8a04-4db3d39dae51", "value": "12288:SN3qx4ZQ6Uboqy1o+Dc1FB0ipS3SMiaaTZ5KeyxhlPt9QZTQzmOImcGcXUTB9Tm:Uqy2Fsiz0EAaTOPt9QZTQzphcjwTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205483, "uuid": "47457f18-3408-4ec5-84d6-37a9853613ad", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205483, "uuid": "f008d19c-8e43-43ac-9720-a0bdb29de5e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205483, "uuid": "d1244d2f-b749-4d72-8749-96880e220de5", "value": "bac49cac_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25430b46-ad92-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212876, "uuid": "16af88d9-c49a-4519-b47d-0382ca16c3b6", "comment": "Malware payload", "value": "00ace5ae8a028c7d9e914167891925df", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212876, "uuid": "18e864f3-9716-416d-b320-4f90248f3bc0", "comment": "Malware payload", "value": "159c9103e2e1f69343c9e1f1012918f0a44888e72721320a0a84e70d169751a4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212876, "uuid": "af29b17c-4e89-4c00-b142-a8da19d6b23f", "comment": "Malware payload", "value": "d382434a917c6591a9f6f17fa2293d0da420c129", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212876, "uuid": "8a8cc284-643a-4323-9406-dc23c468cf9f", "comment": "Malware payload", "value": "1fd75960b15a7897bf466ea6d830837826f792227fa79fe68be08e5507f8048b0ecce5d88d69d8ad45faebf81a0b3f5d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212876, "uuid": "31aa32b4-64b9-402e-a5bf-c22544a21e4a", "value": "A5D4E19D5880707FE1CFAE313830F8E976C424ADD05DA293C59C3AD947BB28E58B64D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212876, "uuid": "829f4337-2d23-4ca5-9cdf-150088e43270", "value": "45e94c92606df61185359080a853eb32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212876, "uuid": "a54ab774-f776-4fa2-a855-5c841d714455", "value": "12288:xfZmvxbaTs9bnZ9AdYIVBmy+Qhd32/VJ1WJkXm6fF0ee3fbJBiqp+Bf:xfZxQRnfAdx+gd32/VJ1WJkXm6fF0XPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212876, "uuid": "8b546b6a-d7ce-4ae2-99e0-56b4ee8204ec", "value": 634368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212876, "uuid": "6858fa90-141a-48ca-a5b9-d7f261ad6582", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212876, "uuid": "d909845c-86a4-432d-bdd9-df2385b710c8", "value": "00ace5ae_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c9722b-add6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620242101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242101, "uuid": "496882b6-0bc3-42a4-8848-a67058e9c0ce", "comment": "Malware payload (Dridex)", "value": "9ae887c5d07aed7edeb57fa5a731bef0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242101, "uuid": "27f8cafb-3e26-4249-ab06-5166a95145b8", "comment": "Malware payload (Dridex)", "value": "15b25893f063fcaccb2c4d777d6a25a0014c3375fe8f13c5b2e80752b274f7c2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242101, "uuid": "3477d759-c7ae-410d-8cf7-e1eb982dd1e8", "comment": "Malware payload (Dridex)", "value": "66752d5a8e49f23939faa658876df0beea22d1df", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242101, "uuid": "b053bf51-c628-4ef8-9b5e-415a6201e974", "comment": "Malware payload (Dridex)", "value": "f7fb031d81af8f07159e9c6db24451a387865699fdf733b052b407629294af174c5f9be05280d532532c6fa30562f3fb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242101, "uuid": "d51a5d9b-7a4a-47f5-ae58-fa0254a55db1", "value": "C0F3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242101, "uuid": "d89dbc35-cf7c-457a-995d-58145372236f", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242101, "uuid": "51f8a225-11e0-4383-bfd5-69350ee384dc", "value": "3072:Y/45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:04KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242101, "uuid": "8a2e93b0-12c1-4b41-bbb8-98e321f5c6c5", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242101, "uuid": "721a0d7a-a9b6-4fef-984c-287cdad48322", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242101, "uuid": "937488d2-21d8-413d-9634-da600bc502c1", "value": "9ae887c5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e13b397-add6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620242177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242177, "uuid": "5fbeaa1b-3b35-46da-8cc2-00871b15d4e3", "comment": "Malware payload (Dridex)", "value": "b58f5a0d326ec4fd501192ccf6a511fb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242177, "uuid": "c7cb8aa6-4db7-415d-afe8-2b211552c362", "comment": "Malware payload (Dridex)", "value": "15d29220e8ffcf58c96aed0a24677822d7976edbe4dd2e2cd63f31ae3a813d16", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242177, "uuid": "da88f561-326e-48a1-8a9c-3f2ddc4347f8", "comment": "Malware payload (Dridex)", "value": "649139bfaf10b2e5b4aa39306b94eae53f116599", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242177, "uuid": "376353e3-e6a2-4a1f-9f9b-5f9c1e5a1d72", "comment": "Malware payload (Dridex)", "value": "8211c0aeb95f865b4e8734b15e7508dbe222b1fa518cb224aa32f9654df858e12be0feeb70b7aaf623b6c9f1101e908e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242177, "uuid": "a8214910-09a6-4e6e-9aef-20c6feb4f1d5", "value": "9AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242177, "uuid": "98897a0a-6169-4401-87c6-714ebb513d93", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242177, "uuid": "f9973b02-6efa-49c6-8270-ef34e25f1261", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242177, "uuid": "a01dc37c-4a9e-4974-914a-5b21cf17e741", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242177, "uuid": "bd8ef1fc-f87c-42e4-a6c2-76a691fb99ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242177, "uuid": "9b269033-d403-4368-81be-47650cae2459", "value": "b58f5a0d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eec9c934-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252298, "uuid": "459f4f1c-1faa-4ac5-937f-a24b9d04c86b", "comment": "Malware payload", "value": "c52cc101637ed97034a3d9e9f514438e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252298, "uuid": "f7514b62-44d3-4d22-b2cd-68eca82782ae", "comment": "Malware payload", "value": "15d6f3dd02655eb67f7a8d520b66a0d91f087b6868b91884de6143241c2793d7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252298, "uuid": "249db161-64d2-44e9-af2d-f9d4d6210219", "comment": "Malware payload", "value": "157caf8e831b4c1ff3fc4389e7c27089275d8028", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252298, "uuid": "7c5deae4-ec5f-463c-9ee6-d17bc223c995", "comment": "Malware payload", "value": "f85172f9849b7dadf3738464ee2d4ec654a4357ba990f5ff7b9406112af61401530e62303f9a46f2fe9d5abe7165672e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252298, "uuid": "709bbec1-168d-4735-8083-d40fc78a0402", "value": "53F3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252298, "uuid": "1f5e9bcf-b7bf-4cb2-b93e-f1ff605c21e2", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252298, "uuid": "ed21484d-d136-45fd-927d-4b5a05864bc0", "value": "3072:L54Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:GDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252298, "uuid": "63072ab3-b8af-4a81-aa8a-e4e14e00f055", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252298, "uuid": "a36af279-960d-4993-b296-d434bfefbaae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252298, "uuid": "863717f1-ee7c-4ab1-ab06-3ee97873abff", "value": "c52cc101_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9af5809-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620209260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209260, "uuid": "78f35161-210c-40dd-8d03-b3141a733a05", "comment": "Malware payload (Dridex)", "value": "f8b396bcaf4d3f18c9162a753058a9fa", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209260, "uuid": "b190b4c6-2396-4f97-908d-48b084312371", "comment": "Malware payload (Dridex)", "value": "1613ce0da0565c333011bae8d14fa369abea912ef5ac43e8fdcdd5e2dd2f8475", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209260, "uuid": "dfeddb47-a30e-40e1-846f-ac8addb45d91", "comment": "Malware payload (Dridex)", "value": "2c2993b71dbace4905d854386a4e41779dba35c2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209260, "uuid": "22e6b031-21c1-4656-910a-34f1df2d310c", "comment": "Malware payload (Dridex)", "value": "dc6036fc4210dae653cbe5443797a65f7f8734235f7be192b8d28166da0a813dddf19285f2c9b9098d1370b3934c9f7b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209260, "uuid": "1801a885-2c9e-4c50-ae9f-ddc71ccc4f74", "value": "96F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209260, "uuid": "61221c95-e923-4765-b2e5-ad37e0277f8d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209260, "uuid": "e974db54-253a-4026-aacd-b8ae80bafbaa", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209260, "uuid": "4870d7b2-111c-4d78-8455-acf71dae0fee", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209260, "uuid": "ed3b157b-3628-476e-91d9-01bd75b22a51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209260, "uuid": "5f64a072-b82d-40ec-b7d7-6f8cee0f5c87", "value": "f8b396bc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ecd71b9-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208544, "uuid": "56a79625-3d4a-470b-8e67-f8f7205ce949", "comment": "Malware payload", "value": "57c248dd22c14eca2873ac0a610a544b", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208544, "uuid": "d26070f5-0186-42b6-9be5-eef3c05cbc66", "comment": "Malware payload", "value": "1620a616807ec3b9d3b59f1cdff281943ced5dadbc9b0016a4a6de0b6cbe654d", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208544, "uuid": "3c1ec7c3-8d91-4533-a14d-bb21591bca90", "comment": "Malware payload", "value": "441cee61cdb10f67ddb6b6ba6c6b71aac557abcc", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208544, "uuid": "01e7cd7c-cd88-440b-8dbc-b04c367f4c5e", "comment": "Malware payload", "value": "584c7a21653ee851c2fb7e0435e8fe5e3d8ccabe0432a47beeaf605b5f03312ea9b22482de925474be66a396bfa6eb74", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208544, "uuid": "0e1d9109-bfb3-4752-9c27-a74d2c80bda8", "value": "92D5330C03BAB8FCF89E0A2937638DD1C5E911F1A58255B3D6781998083F97E17DFA61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208544, "uuid": "53d30c11-e2b2-4a6d-aa10-f80de1534875", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprcM58YdL4q:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208544, "uuid": "ce5627b3-0b86-4b25-b783-c9465d547e28", "value": 3018752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208544, "uuid": "16d4b06c-daaf-436b-8208-ecebfae355a1", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208544, "uuid": "b1319eb6-c2ce-4d46-ae38-2d093065e54f", "value": "1620a616807ec3b9d3b59f1cdff281943ced5dadbc9b0016a4a6de0b6cbe654d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ea5126-adf6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255881, "uuid": "c3e9da5a-2e38-4bce-a81c-a6ced3716108", "comment": "Malware payload", "value": "b515fa2b99f6b6a99c6717138a928b2b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255881, "uuid": "92a20f7a-1205-4455-934b-f4bf2c082e29", "comment": "Malware payload", "value": "1623ab9e3ea69f6f2913d98e0dd7fe31b86cefcd57170a05ce9585527a00ea81", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255881, "uuid": "f1c37173-5676-4b4e-afb6-a3a712f93fc5", "comment": "Malware payload", "value": "df22d24db7faf40d2f56f15723798cbc0a4aae43", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255881, "uuid": "29ff4fe0-a3b7-42d6-90a9-d2207be69fa5", "comment": "Malware payload", "value": "1bc6365a545166b242e1951aeba1c85708fe03263bab1c47d33c4288417ab39662a80e312f1e30855345e415ace0fc6b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255881, "uuid": "832b51d6-24d1-4f45-b318-9858a4cd6172", "value": "3DF3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255881, "uuid": "1042e089-4808-4267-8387-152cf064b364", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255881, "uuid": "e641e804-b132-4fa7-a635-666aff0441ad", "value": "3072:+84Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:KDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255881, "uuid": "b2d3197f-d6cd-4b56-8831-925fa52b2e5b", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255881, "uuid": "221bf3a8-4a63-4377-ab59-53956a4d181c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255881, "uuid": "c2242cf1-9113-41ba-9a66-0a82ffce3be2", "value": "b515fa2b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d3bef11-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209212, "uuid": "30934e8a-608c-4c58-9565-275c570df7ea", "comment": "Malware payload", "value": "88c4647a9a0d2aff0bf58da47a44de9b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209212, "uuid": "2bd5d883-b6f1-4a4e-95f7-ec0e77ddb8f7", "comment": "Malware payload", "value": "1632f84b93786c89f5f2be914c0a4b95c8a58a0f771a3d8d87d06c40b07551ef", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209212, "uuid": "d09c59dd-e2a7-49a7-aeb7-e5fc208771ec", "comment": "Malware payload", "value": "1fb5fa9864ffd76ebbb154da8e0f7226996476df", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209212, "uuid": "602ce804-a905-40f3-8bef-c63f66b773b6", "comment": "Malware payload", "value": "44ca2ea8c2bb8e20ee2407df15ad737576f38c8b3845989a6e395dc3904d0d1f7baf31da3123345d1f5e9871230f8355", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209212, "uuid": "3355546c-f939-48f7-a5d4-71d66abc1805", "value": "FAF4ADCB7286BA07E0619E73D64F58838B754BFF71C42B96479864198C2CF3F9938909", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209212, "uuid": "8d44d73c-2f6c-4232-867d-d89efd31dd41", "value": "4edb27ddfe2e284b8403d5cc4127f4f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209212, "uuid": "f095bcfa-87c1-4d1e-8ac4-3d702b59ee4c", "value": "12288:H32D0grT1m7PEPXeYSW9D/XEDDj05/McET1cgX0UZOaLdYmTIXpcLyOTm:ukPiZSsMqsT1cgX0/aLKmUXpMpTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209212, "uuid": "3bc68768-a12b-4a5c-b80f-6e01f5aafbf7", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209212, "uuid": "c1475aca-b775-4883-8b56-e6567d44913b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209212, "uuid": "44b73cdf-441c-469a-9f54-03c551252a95", "value": "88c4647a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d7bfb1-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209114, "uuid": "af41db6b-ded5-4f85-b33b-d9cd6a2bcd44", "comment": "Malware payload", "value": "26829e68e5d35b6e5e62fd4ade4d98e7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209114, "uuid": "f38b709a-febf-457c-a3f4-138724648bf9", "comment": "Malware payload", "value": "163b3a3c0475f52153b48a6867d24307be16ab2894280849ccf77c7f3550f559", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209114, "uuid": "b1b6b9a1-cf4f-449b-9b9a-5ec35a319295", "comment": "Malware payload", "value": "036f8c6f25404919dd646cc3a05ee924ba3c4dc9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209114, "uuid": "16586e13-3931-4367-8531-f229d5c2a051", "comment": "Malware payload", "value": "d07ebe36bbb6f5743cae5de7934df920d6be90568f24ff8ea424b57a84da73cc9c67d3ee57c847c0ee45147761a6c82b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209114, "uuid": "9f6a3a58-2092-41ee-b2c0-30391b56506c", "value": "8985F050B9D5F866C5A0B4F0CBA7F7FA75BAB03DA870A61815222F33DE11DF2A0154E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209114, "uuid": "17863ce9-f688-4ddd-a1c9-f7cb2f39c676", "value": "243f35d248b897c30265b7935fa547c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209114, "uuid": "52b2b45b-ed4d-451f-8bba-a670241dcc4e", "value": "24576:XVjel9kjOG6DRnu0B+Y+iIi5Q/58d5g6YWt6yHjDPQff/:XV49kjOGSgdzi5Eag6tt6yHHYfn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209114, "uuid": "7126fd45-c4d7-4e0d-b648-e221dd40e4a6", "value": 1719296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209114, "uuid": "449d2015-e53c-481b-9504-caa1c03000bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209114, "uuid": "9ef88220-02d8-4ee9-af39-248f01fe853e", "value": "26829e68_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "590d39a8-adb6-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620228425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228425, "uuid": "1ea0a2c3-9359-4204-9cac-17e35565b6d1", "comment": "Malware payload (AgentTesla)", "value": "a99ff6ecaeaa14428ac1a0cc3fb375af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228425, "uuid": "d3f8acb1-ba86-4755-bcde-f30b990654bf", "comment": "Malware payload (AgentTesla)", "value": "166702605a44a92ba3455897f14c5f2708158d5e5d32370c35c56372ac8b5422", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228425, "uuid": "20f6f088-0e5b-4d70-b952-6435e3872fe1", "comment": "Malware payload (AgentTesla)", "value": "ab1d83894d1fe5ef9347621dfe1f1f7dc88f4ebc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228425, "uuid": "351d48a5-d30c-4ce7-b990-09e7bddeae69", "comment": "Malware payload (AgentTesla)", "value": "6fb46127923e5cba034285398753e9de79f0123cba33461ea8a3d0175d631db70013a0c9dea3d1fb4b7fd4d49b9afbeb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228425, "uuid": "b55da0d7-fd8f-439d-94c0-eb7625541014", "value": "A405027C678C4646D96F4B7C6864C04027F4BA2AA7A3E70EBFC025FB6F77B418521261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228425, "uuid": "9c41c0f4-0c59-4547-b495-038af1438740", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228425, "uuid": "0ea02d19-e17c-4583-be7c-eca6ca32d577", "value": "12288:gmtkfS3iywlHML2YBo1nJfxQcUQ+dNMBYoNV8u6ydq+3JttSyoLJKAztiO6B:0ywB1R1nJ2JdNL28u6nKJvSyoNKS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620228425, "uuid": "d75f0301-14a8-4821-b8e9-42474ed6833c", "value": 839168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620228425, "uuid": "45a533ab-8e7b-4aba-8ca4-c555d3f4ad86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228425, "uuid": "299f5537-0901-49dd-b3c2-5984a333d3e8", "value": "0020210505-201927_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88159a68-add4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241389, "uuid": "2051ad82-41e3-41f3-b555-b2f7ed999df3", "comment": "Malware payload (Dridex)", "value": "7aa68f7151780d20d3f3c9c7b66809d0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241389, "uuid": "89a4b116-d9a1-4ab3-8890-e066ca913379", "comment": "Malware payload (Dridex)", "value": "167f914260d00e70753f421d39cdd0db2951931b664f5e03c84f822d6a8cbcf4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241389, "uuid": "afc2565a-7b09-4878-bc33-591bcc3db0ec", "comment": "Malware payload (Dridex)", "value": "ed0ed50c3ea6312ffca3e0216455c7712b302bdc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241389, "uuid": "b2ed9bc3-8389-4a3a-8ee1-6f4663b293d9", "comment": "Malware payload (Dridex)", "value": "9ece3333dc37ab0ab1a68e7a33740f8a180b16582f5263eecddaa4f1c1e7ce390ee28d5ee2743cb091b0411806ce695b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241389, "uuid": "8e6ede28-b294-4768-a48d-6f4f0a4b65dc", "value": "75F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241389, "uuid": "915f1ba8-4153-4e9f-a106-b76dc846cfc1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241389, "uuid": "a858032e-6a0a-4b7b-a5d7-f6f6f397829f", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241389, "uuid": "0e4911ef-1cf7-4699-a306-6cc6306597c5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241389, "uuid": "2c85e772-fb55-4465-874f-2b377b8cd246", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241389, "uuid": "590490c3-f086-49b2-b045-6fbf1977eb51", "value": "7aa68f71_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48e11e82-adf6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255886, "uuid": "f4c4d267-4421-460b-b784-20062add2921", "comment": "Malware payload", "value": "1f0aa370f9b681546d0d40b81c9a5c1f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255886, "uuid": "a7be5288-a8f5-4817-acd1-38c2211828b9", "comment": "Malware payload", "value": "16b2c2524a86f5364b1e752f5e26b5015384dcf268d5ff8064a71de65bc9178b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255886, "uuid": "c9a50619-2cbc-43af-aa91-94297532977f", "comment": "Malware payload", "value": "6f99492f42f28c6109e50cf919d6dafca7677eb7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255886, "uuid": "f7454e62-646f-43e5-a3a3-e86db864b7e7", "comment": "Malware payload", "value": "3082ac031588774ab4f34dae6cb3c667b6597bfdb475fd5bc0bfeb0f0a4d7f667e5fe691438ba090488dc113ea15b4ca", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255886, "uuid": "1aeddcb5-c328-479f-85c1-34ccd14cc3cd", "value": "96F3C085DBABE87FC44A35399472DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255886, "uuid": "f714b56a-0106-4da7-b1ed-6684640dc2bf", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255886, "uuid": "ef581eb2-9734-4aaf-8f10-3defd5de0099", "value": "3072:yx45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:w4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255886, "uuid": "78b6548b-035f-4d9c-aef3-6d0f38356604", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255886, "uuid": "b4cd9a03-6f63-4dd5-ba28-39feb08285eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255886, "uuid": "41caf364-ad2c-4931-9057-3d13c9a34336", "value": "1f0aa370_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c6ee21-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252198, "uuid": "5c179b60-1296-451f-885e-7751b9deaf5e", "comment": "Malware payload", "value": "80356d728825895548af385b73681e5d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252198, "uuid": "8d7b68dd-e8e5-4fb8-a591-c73c058fe1f2", "comment": "Malware payload", "value": "16b4fe51c3f1af8bcc3257e3b1e81433fdcac08e61bdefc95b5b10fb7a7bd74e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252198, "uuid": "27a45727-9c9e-4adc-ab95-23013a668033", "comment": "Malware payload", "value": "e8ec223b28b4c2bc0f7e0f2a8c2b617b70cc27ee", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252198, "uuid": "96bab6ee-eee4-4bd9-95a2-c6296591f86a", "comment": "Malware payload", "value": "6e91519489e675563e0694f7f39b59cce6dd0c97fd3c7e6421305d9ed3fef0c0aae02e4bfccfe6ee51b225968d11124a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252198, "uuid": "8c0c8cff-1389-47f9-8748-5bb79c977db2", "value": "B4F3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252198, "uuid": "0e3370c7-f396-4866-8cce-b61967c5389b", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252198, "uuid": "f598b91b-4ad8-480f-9bcb-e599e1a526b5", "value": "3072:zd4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:6DBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252198, "uuid": "c42f124c-6573-47ab-b6fd-b2594288c5cd", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252198, "uuid": "643e44e9-e920-4e0c-9274-b4fdddd072ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252198, "uuid": "bee50ee4-b1b5-4f7e-8c57-c32f3761a428", "value": "80356d72_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b30b869-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201880, "uuid": "c799e519-2e26-4b09-9b2e-5385769e1d96", "comment": "Malware payload", "value": "ed2effc5ed7d43cfab3763d29dd7bf20", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201880, "uuid": "98fc5a7f-8ee1-4c82-8ccf-cd99e0128c22", "comment": "Malware payload", "value": "16c1877bd237853acc533d8c6916a9469befbb621bc2d6a463b3779e4cb259bb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201880, "uuid": "d59cd54b-c590-4775-9780-af1da443f332", "comment": "Malware payload", "value": "f4bdb4d88d864cd9d1ab71591a69d7b6e25f05ba", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201880, "uuid": "075337ed-51af-44c6-9653-c8ce8fef9d5e", "comment": "Malware payload", "value": "487eb7916a8f88a45d4e0bba58bb29a826bb5086e0a221d0a90772a41d39763e2d3aa8befb03c00de8ee88cec881f30a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201880, "uuid": "10613813-b384-4a03-8e4b-6780deff3174", "value": "9E4318A6F6918493E4174138CC82F7F6A8A2BC36C54E9642FF80BF8F5C75A51F92450B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201880, "uuid": "bfc4c6a6-7d7e-4f00-89a5-21201ec27363", "value": "44d09e288cc76827b62dde98d4028728", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201880, "uuid": "df60c0b5-e2e8-428e-be50-279a54da757c", "value": "768:MDcpEBMLfQcub5Ep1PnGz96XyX9TdtldE90:MDcfLfIb5Ep1uzgyXVdtnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201880, "uuid": "05f3b3f6-3851-4db5-862f-ef288d6c4d10", "value": 60394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201880, "uuid": "c6194441-dc13-46b8-a4b2-bfc00cf20869", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201880, "uuid": "36cca823-e872-44de-ac1c-21736bc3825f", "value": "ed2effc5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad3f54ab-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209239, "uuid": "3b8964ef-c837-4dfc-bc73-8976e70155d5", "comment": "Malware payload", "value": "3d29a558a3249a482c8818cf0ad4326b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209239, "uuid": "d443a55c-ee14-406f-96eb-e65001e4c5f0", "comment": "Malware payload", "value": "16e8339be28676286827eefd9454a2269fa512be76c540c3e6acc9cb7f3a3cc1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209239, "uuid": "b0659890-6837-4473-92a2-a04bb8cfc9e8", "comment": "Malware payload", "value": "da65e6f8b39902c6306437759000478ab82202c0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209239, "uuid": "a180b1b3-b0de-4cf6-af4b-958c92cc0cef", "comment": "Malware payload", "value": "8cdc62ae269003220ea9b9f42d9801f618a4e6e1dc5eb022cfbaad9162ca8528028c5884e92ba0db3fb2471fb9eb9215", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209239, "uuid": "5da3e446-428b-49c3-9a82-db0e4e530f9f", "value": "54F48D247717054BF5F6EC7642F4358BEB904FFBBA9DF9A06B16845843AC881A4B02F4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209239, "uuid": "3f4a9ec3-fa5e-43df-820c-32cfd3da9edc", "value": "e3a1f0bd1dc90e3c20636dc7c24c7f1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209239, "uuid": "63d07b12-e7a6-4d1c-bf7b-1f47bcc66d00", "value": "12288:kVS+1PZ/AlfsEIxScQC97ELes9h9zv6bM0t5aGDyQJianStr7EUrxpTm:AAlkx379YLes9hsbM0XavQs97BXTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209239, "uuid": "27988dbe-e76c-4c0c-8749-fcb85e20e81d", "value": 771584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209239, "uuid": "aef17fa0-1f61-42d6-b97c-7066be110487", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209239, "uuid": "517c7087-1456-48ea-8355-a087693fdadc", "value": "3d29a558_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd0582a4-adb2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620226902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226902, "uuid": "8e4b9aa7-a57c-4595-813c-c933213dda9a", "comment": "Malware payload (Dridex)", "value": "a5443dba97444d33051881348db91b48", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226902, "uuid": "ad7214fe-8b29-40ac-8d8f-0579ecdb10cb", "comment": "Malware payload (Dridex)", "value": "16f31fa6900587409708b4499f1b1f6fdd2180c6fffac94c2e6a5c22108631a6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226902, "uuid": "76fc7a0f-5924-4140-92c8-d9ebeab6cc98", "comment": "Malware payload (Dridex)", "value": "5c3f92a76bffd3bb1e1b8dc29fac978da8cdacf6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226902, "uuid": "2c810659-aae2-4d36-8d7b-9a1684d7b439", "comment": "Malware payload (Dridex)", "value": "eb57d3a9296bfdf2fbbb0444612e86368236b66d9e763d3b9d005fa7420cd5e9bf260655f6682dba3b3acd2cb57ffbee", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226902, "uuid": "accc31e4-7fbe-4e6e-b9db-ea3d0c51f35d", "value": "56F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226902, "uuid": "9f49e86b-b19f-4a7f-a594-4fbd42ac3b63", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226902, "uuid": "fabe8fcd-4ef9-4cde-aea5-35507cb68b13", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620226902, "uuid": "42bdbadd-c8ff-4dc2-add4-6a37142cc686", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620226902, "uuid": "0790ce66-26ad-4436-bf2e-b7092284840d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226902, "uuid": "dd8c0ea0-9894-46c3-9c98-631ad1ecb4aa", "value": "a5443dba_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb37b2fb-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload (LegionLocker)", "timestamp": 1620209370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209370, "uuid": "ff99e335-0d26-46ef-b9cd-20fd61d74877", "comment": "Malware payload (LegionLocker)", "value": "d02f08a52705ed110c99235edf66cb30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LegionLocker", "colour": "#A2D246", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209370, "uuid": "b047c6c1-1ca8-429b-836a-ddf18cf78dc6", "comment": "Malware payload (LegionLocker)", "value": "172dbb4029b78c3fdbc7840ac539c78cfef0c25f95228ca58bcae053df2da2da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LegionLocker", "colour": "#A2D246", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209370, "uuid": "ce03a014-9a08-4b32-94e8-31a1098848bd", "comment": "Malware payload (LegionLocker)", "value": "c9d7cb2745ae911687c57b0c5b0f7f92a11dd7b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LegionLocker", "colour": "#A2D246", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209370, "uuid": "3578b738-7851-4727-b372-3b85f79f62e9", "comment": "Malware payload (LegionLocker)", "value": "90321393d94b5a753340a032bb4e13cdb426d7ee95944b6d997c4e40f0ce6be83b1d24192f22cbcb4a2418f2da82ed13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LegionLocker", "colour": "#A2D246", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209370, "uuid": "192081e4-59e9-4f62-95cb-cb036242afda", "value": "01E5339C1355B659ED6016B2F228FF2FE750B44046DC89A8C33787EC8864B5E9D13ECA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209370, "uuid": "9a5349fc-2389-4974-a24c-70820529baf2", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209370, "uuid": "3706827f-0a38-46fe-88af-45ef58f7f702", "value": "49152:zcacCfL/hArIyucCfshXnsSYYIgcf42o8vk3WgJPnpJPL3YsAkHuxp12svVEhkfy:zrj98Nuc+eXnsSYPJQ2pkGgJhJDY3p1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209370, "uuid": "7dc00aa5-51b7-4308-bf9c-85e15aec542a", "value": 3068735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209370, "uuid": "9f7e8902-c4a6-4ce4-9491-b13f83d21b4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209370, "uuid": "cf9d287e-4121-4f9c-b421-636033f8b71b", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe7d78b5-adce-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620239010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620239010, "uuid": "79cd8ceb-5e58-4b16-909a-ba752b6060a5", "comment": "Malware payload (SnakeKeylogger)", "value": "1ef6713a7f219a43ebf037a2420281f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620239010, "uuid": "f264085b-4fcc-42d3-b9d1-eb0d4607c520", "comment": "Malware payload (SnakeKeylogger)", "value": "17470831ec6974e6deeb88f21aaf144227d0e351eb1c2bb378bcc517eab07971", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620239010, "uuid": "a4532f1f-fc0b-41ca-baf7-805a115237f7", "comment": "Malware payload (SnakeKeylogger)", "value": "d741b58719d3119004cb99abad1f8fdc51f7f6b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620239010, "uuid": "7dd8452b-fa75-4482-83ff-38c7d7f92c1c", "comment": "Malware payload (SnakeKeylogger)", "value": "a155e42e2082a197d4eb46149a4b5aad4e632b20d6ec3c7ae63504478b62e1cdd82207b71a456ed90521c02bcdf02d70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620239010, "uuid": "bbed8a5c-e6b5-465f-bfb7-96d9321bc0d2", "value": "9FF4127822895286D92E4779A878C1501BB1BE2B9673F70FBFD074372BB3B214721671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620239010, "uuid": "41818a3d-3370-40e8-acaa-beabda8edb75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620239010, "uuid": "d3c9ba62-dac2-4191-8398-4c1c9d110bca", "value": "12288:1mtkfs3BW49M6nj33n7Qxu2rKPxok7aTMan3UWP5LruRq4wshW/BkFQ1k3VJsU/M:KWC/nTur0xPOMan3lRoq4wsoBqQSJHU6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620239010, "uuid": "f7b941c1-15fe-4aba-b868-01b6db090606", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620239010, "uuid": "26a933bd-2247-43ac-8f02-eee1a5e2e7a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620239010, "uuid": "34684029-546e-4e96-b22e-14e2f1436f37", "value": "Nuevo Bestellung_WJO-001,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d2d1b7-ad85-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1620207342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620207342, "uuid": "c75cb2e2-39e2-4369-a275-fb99d3421ac8", "comment": "Malware payload (BitRAT)", "value": "3fcbc07fc73317e5dc5ea20b22edbc59", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620207342, "uuid": "8951c7e3-ac0c-40a6-9128-7f69a16841a8", "comment": "Malware payload (BitRAT)", "value": "1759dd8f52a3e1e13c8b23adff5c8f2d0db25d9fe60abf25acb607103924e7a3", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620207342, "uuid": "581ba2df-acf8-4732-84cf-9fb7307dfdf4", "comment": "Malware payload (BitRAT)", "value": "820a1c1fcf8811a7d162b876122f8265378696fc", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620207342, "uuid": "10a20307-933d-4c9c-ae42-d6e18d063d29", "comment": "Malware payload (BitRAT)", "value": "1d9dc662eb2c02cae987bcf92df8e29dfb78b663025a8cb464fb0a77860fa14b197ff87b28f5addaf159dc1ce0d34cc2", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620207342, "uuid": "58c36c15-2a07-4438-b62a-30dc8d812960", "value": "F6753361EFB4D137C2673936182C193C26D5A82442A637139788F5FEB879BC7486E393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620207342, "uuid": "ee31a532-96e6-4eb0-8664-8e121b871e68", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620207342, "uuid": "94db84ee-b5c0-43c7-8eea-8460507ce086", "value": "49152:qfhEwWSKlcQ3vzUOr31l0voO1jbn5A9q0OuQ:ohgSAnzjr31GvP1Yq0PQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620207342, "uuid": "c7ea7a90-24df-4539-89c2-b98235b6dfdf", "value": 1578900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620207342, "uuid": "552d91d8-61a3-42cb-ac33-13be065ef094", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620207342, "uuid": "550624a9-1554-428c-9eeb-f0cc38eb7eca", "value": "3FCBC07FC73317E5DC5EA20B22EDBC59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d80afa69-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252690, "uuid": "1db1b3a2-8ee7-4e3e-8908-d9ae9d71bbc4", "comment": "Malware payload", "value": "8e16f170f934a9e731b310c3fc7dd3aa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252690, "uuid": "33b84970-ce9e-44cb-9aae-7c748c5de814", "comment": "Malware payload", "value": "1760bec57960add290201a22ee0b3daf8866a676a47f22447578c3f4f098d161", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252690, "uuid": "edc3c8fc-7d6b-4c22-b217-cebd63b91438", "comment": "Malware payload", "value": "1f30b165afe083a24297da1a1c36336cb438d9b1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252690, "uuid": "ff1e3a7a-2b71-4d2a-9d52-6dc1efb41aed", "comment": "Malware payload", "value": "f1f62171bdd32ac137aef13c73a4b6152cc5aa70939626aaa09c130ee5cdc6c084d347172deff48ad0a317b809383adf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252690, "uuid": "562d0ddb-b373-4d12-932e-377f1e071edb", "value": "FBF3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252690, "uuid": "fa222dbe-cbc6-4fa0-86a9-8ae2727d0fa7", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252690, "uuid": "a1d5d8c0-8940-4daf-a3c4-ec224673bd75", "value": "3072:qL45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:O4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252690, "uuid": "3a194596-0854-48d7-a535-1a11fa0f40d1", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252690, "uuid": "1ad78935-a8ae-468a-95e3-9f95bcf33f6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252690, "uuid": "fb4747a8-620e-478d-a199-822df23b1149", "value": "8e16f170_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d48e32-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252262, "uuid": "20a67f61-6343-43e0-af7a-c05529a72aaa", "comment": "Malware payload", "value": "42b27ab57bc8fc44b15cb9f58a86c21e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252262, "uuid": "d94e0831-a43a-4727-b4f8-df9d1be80cf6", "comment": "Malware payload", "value": "17aeb7372b57d7559a6f507074fe1da973a104a2de8b0d8e229bfc4515c6d015", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252262, "uuid": "298de28c-84e7-46e4-8089-c2a154c0572d", "comment": "Malware payload", "value": "3315743d1ba1e224a0c050e3d35e5bc520e72a77", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252262, "uuid": "d4e59fe1-4653-4f49-ab15-99728edf44e2", "comment": "Malware payload", "value": "0198ba70f346184f7b2b0ed266cc84d3a0a44c4ac108b2ec0cc8c0253931660e5ad22eea0231468489f3e6eca5cda4d1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252262, "uuid": "29f56c9b-c7cd-4825-8e11-ac89693ac90d", "value": "35F3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252262, "uuid": "df76a0f5-da45-4194-b294-8045152bba98", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252262, "uuid": "9d580bd2-74c2-4839-b108-f35b5c2bf038", "value": "3072:b54Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:2DBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252262, "uuid": "6744f541-9265-4280-b03f-ecb65f25914d", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252262, "uuid": "5f6a28d9-de41-45fa-96c9-05e2c10826ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252262, "uuid": "74f3621a-fa1e-49d4-aa4e-4f6efa07f6f0", "value": "42b27ab5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50d1c460-adf6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255899, "uuid": "3e5f8ce8-c025-498d-a27a-46627316e964", "comment": "Malware payload", "value": "fcf8afa99b3e2407677fb333df79fa58", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255899, "uuid": "54a4b1a7-e8a2-40f5-b336-7c7e591e1b80", "comment": "Malware payload", "value": "17cfee9244f0f6b3160bb9081a4ffdfd65b34cf2ca1489be87de6bf3f102ec53", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255899, "uuid": "07bf04d7-dfd1-406a-a881-bda198d52934", "comment": "Malware payload", "value": "e907d3b38ef658eb585f1244da4e407240543bc5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255899, "uuid": "0c9529e9-b237-4e67-bd2e-03657f083a55", "comment": "Malware payload", "value": "19d95daadab8141bb194d176a2e4f887a9559bef5cac0698566b2da9302f1a04ca02d918fb83ab34475a55cbdbed27fa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255899, "uuid": "fd4aaec2-1a44-4fc8-bfa2-17cb27ee40bc", "value": "7DF3C085DBABE87FC44A35399472DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255899, "uuid": "17e767d1-ccea-4211-8992-32567fc5106d", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255899, "uuid": "d6bed311-a31c-41c3-8651-456cedac1d64", "value": "3072:px45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:r4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255899, "uuid": "23582900-0f58-48f1-98aa-e708f75aaeda", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255899, "uuid": "1cae019b-7bb8-44e2-8f7a-e4dd85d24df8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255899, "uuid": "4d7e89a5-22e1-4832-80f3-6a842930a294", "value": "fcf8afa9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6263c3e-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241976, "uuid": "a3876046-c7a1-474c-b96f-4e421261ad5c", "comment": "Malware payload", "value": "f36f36e81fa6be2dbd1e4c44dcd986e2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241976, "uuid": "29729df6-48b8-4c15-9a6e-37f09b682abc", "comment": "Malware payload", "value": "17e5befbccfb6741bad1041e4980b3e0a711217320109f8f8d420fad5019f23a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241976, "uuid": "4775ed59-066f-4424-b342-80395c4cc3be", "comment": "Malware payload", "value": "e9d7c562558610bdfba6973dfd7e72b6c1ef3224", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241976, "uuid": "ac98f5f2-d681-4929-b848-443b33955c51", "comment": "Malware payload", "value": "8bf6fa644a980b98a6d011c2e6910c8372b9a89475bc7f6190e7bcae63a374761548ebd4af5836138d39007ca55f7dc2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241976, "uuid": "5f2c27a0-6cc5-41e9-bf26-1e2f2ceb0ded", "value": "DDF3C085DBABE8BFC44A35399071DFFB5B388B145650C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241976, "uuid": "765226e6-5178-467e-813a-603c1669ccfa", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241976, "uuid": "475d1753-099f-4908-8768-1b6f6e127428", "value": "3072:3M45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:c4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241976, "uuid": "739783a6-2dcd-4d23-a364-db5bc05949b0", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241976, "uuid": "d19811c1-146a-4d0f-a3a7-68f382815ddb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241976, "uuid": "992e00a8-1d58-4fcc-a6fc-4ad02921a119", "value": "f36f36e8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1597df44-add6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620242056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242056, "uuid": "4e8e9714-aa9e-4ba1-ab4f-adb1a5f0f9b3", "comment": "Malware payload", "value": "22da2596f4021aaea79508a8a41a8c9b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242056, "uuid": "e5b44378-2ada-429b-82ee-70e92140270b", "comment": "Malware payload", "value": "181d98ac0994d620fef2c5f67052d35736aa63e283a663ab3042fda2ba30ce3b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242056, "uuid": "f4bf089d-3470-4e36-8a4f-f3ea3fd54737", "comment": "Malware payload", "value": "a7f07d4f84a956bdc7898b6a05853eb9d21c596d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242056, "uuid": "f25cc6f1-a46f-4b93-966b-a301a1b04613", "comment": "Malware payload", "value": "51b2467ea22140a799557eb3ae4d3ddc6e8f5bd8beccc70878b78083ac38562d543a86e21359b558138d1b2384737bc0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242056, "uuid": "78515427-bc82-4a68-bfa7-b70d70e5bb92", "value": "3CF3C085DBABE87FC45A35399071DFFB5B388B145250C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242056, "uuid": "71c21655-5b54-41dd-80c2-7b542b3440c4", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242056, "uuid": "cacbf027-b437-47fc-be08-603778df5c27", "value": "3072:Wy45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:r4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242056, "uuid": "21972392-4ae8-48e9-8b32-5f8ea79ee94a", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242056, "uuid": "807157e1-13d8-4da5-8040-412fe7aaae40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242056, "uuid": "e4d676df-e83f-463b-855c-44934467174c", "value": "22da2596_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f4c3f0b-adf6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255923, "uuid": "894bc3bf-c9f4-4a0f-90c6-4f720d8b2316", "comment": "Malware payload", "value": "921cbb31fde881f5e7b7b20a29f3bb6d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255923, "uuid": "f23c00d3-802a-41be-a99c-4b44ed6a255f", "comment": "Malware payload", "value": "182b18578ec7b72e829a17d7535272c5b0af79eba7d752ca73c599a2b0f7a459", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255923, "uuid": "d96c461e-3ebd-4e81-8804-ca31dfc97c47", "comment": "Malware payload", "value": "b44b3513463bbaa141d098c460bd21eb87b26ea6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255923, "uuid": "d4fd615e-d68c-434f-83d5-f14281aacf2b", "comment": "Malware payload", "value": "ab7bf3a0af9be0f08e0d05dbd9abe05b1fd552e381c7cc45b53051ae65e9542fc347ff53fac89a3506029deffecfc953", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255923, "uuid": "c413183c-aa07-4eab-bed1-fded52271200", "value": "78F3C085DBABE87FC44A35399072DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255923, "uuid": "43b7fbb9-600f-4595-95fe-0372b7cd01ba", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255923, "uuid": "4ad3b3c4-e428-4002-8613-5efd4ffae3e0", "value": "3072:nF45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:F4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255923, "uuid": "8d6b170c-5ce6-4b81-ba1f-089b56cf55d8", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255923, "uuid": "31816cc9-b6c7-45a9-950b-a89ad8885202", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255923, "uuid": "a38298e0-6385-42ce-a410-70a163e96588", "value": "921cbb31_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4862f7a-ada4-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620220901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620220901, "uuid": "05444ea6-367d-45dd-979e-cb89767db9df", "comment": "Malware payload (IcedID)", "value": "1a4adb9bac04ec9fc94c9dd4ba90a0f9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620220901, "uuid": "cff9aafe-35d5-454c-8937-0c117bee9527", "comment": "Malware payload (IcedID)", "value": "183b4ef83bf1c9447d2af1fd30b675c398c8c84e1e4e7ac14f5b89798b74363d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620220901, "uuid": "46c34cce-75be-4275-bfc8-450a1bd6b0de", "comment": "Malware payload (IcedID)", "value": "9a08757db0e98aee9be9ced2c238e5acc284f9c1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620220901, "uuid": "e14eb4f9-d665-48d6-a535-a12b1cd65243", "comment": "Malware payload (IcedID)", "value": "8de46a27a3c2c5bdb7b97c6f2332666e968cf4d00fcb95c0270ebc6f4bf28ce513c8978b0131b7db7a534aba1d208c7a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620220901, "uuid": "09b08270-afac-49d4-9f3e-bdb4ead11f80", "value": "8344C5C6A5BE12B7D81F4272609206385B217FD14ADB8FDFCE685E4D56137E0A827323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620220901, "uuid": "5da711ed-a05d-4e85-b2a3-0acc158a3874", "value": "3eb5471c5370e4bcb3be6637e4995a6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620220901, "uuid": "3ac51eb9-c3a7-4b82-84d9-2e4e5029a918", "value": "3072:OCHCrCVCVC/CtCczk8PkyGtzjU0c28vPr:Wk8PpIzw0c2sP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620220901, "uuid": "c1d371f9-8b86-41ba-98fb-482b96284f20", "value": 277745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620220901, "uuid": "1816a881-162c-4e6e-99b8-f1959da443c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620220901, "uuid": "37b03617-079a-48e7-9019-6212a5f7c3a6", "value": "1a4adb9bac04ec9fc94c9dd4ba90a0f9.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6f4803-ad99-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620216163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216163, "uuid": "b7deda07-e090-4ec3-b959-7c746104c36b", "comment": "Malware payload (Dridex)", "value": "4b476bfd1bc376a7c07bb740708bfa0d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216163, "uuid": "f502fdd7-08fc-42f3-9349-e1581aff59cd", "comment": "Malware payload (Dridex)", "value": "184c05d5f5b8eba6a46f262377c5dbbd22e2acbdc2ccc31920684d11b4d0a79c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216163, "uuid": "bc1b989c-01f6-423e-abb2-2e216256a2a5", "comment": "Malware payload (Dridex)", "value": "f9f631c94e382e8120bf9f8c6b091db887b205f2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216163, "uuid": "846ecdc9-1afe-4bf6-b4c5-ca67130d3178", "comment": "Malware payload (Dridex)", "value": "15d12cfb2ad48848a8396b3d88e20fd4c3a8e4a24db3b3f22c70f5ac10fe456a48f170083a7bcb891e4238df9d4fc5bd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216163, "uuid": "c9444fb1-9a9a-41c9-a391-2ffa4248fa57", "value": "B9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216163, "uuid": "36704bee-f605-482e-a0af-829864995fb0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216163, "uuid": "c2710daf-b50f-406b-abbd-27cf88dab46e", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620216163, "uuid": "45594f8d-241d-4807-ba52-a26ac39fe875", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620216163, "uuid": "050f0707-f874-4045-83c2-27153a9f0073", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216163, "uuid": "98c3dc14-a9ce-4652-8add-b3bca789004e", "value": "4b476bfd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c18e042-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252401, "uuid": "1307fd30-3631-4cc4-9168-929ac863c811", "comment": "Malware payload", "value": "9dfe639fec0998d19e9e7ad9653904f5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252401, "uuid": "2e1629a9-93e5-46da-a413-799a0bb5d94b", "comment": "Malware payload", "value": "1862f4891e1eed447710206878bbf06b08a7d15f576935315a261b8c0d652cc1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252401, "uuid": "3b054020-36c6-4f21-8adc-9ea7bdadf24d", "comment": "Malware payload", "value": "2a158a15a6299138e77ec0554e774ba3c7ecde01", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252401, "uuid": "2718010d-2880-4b44-aa5a-b43971544475", "comment": "Malware payload", "value": "be65da9d40bb782f3b83180e34e21d62844424d46b5b813bd2f7fcebe927252dd0554d2669e74cbe7e7de83df0a42e85", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252401, "uuid": "29267670-70fb-4b20-9ff1-dc257c74b628", "value": "FAF3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252401, "uuid": "de106ab1-8f9b-4cfc-93e9-f2be34fdbcb5", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252401, "uuid": "010b5919-b6ca-45f2-b6eb-d074be15f4f1", "value": "3072:Ec4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:sDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252401, "uuid": "6267ae21-2607-41f2-a2c3-90ee275c5ff3", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252401, "uuid": "1fdecaf4-6bc0-48ef-83db-ef157b3adcd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252401, "uuid": "01225d7b-f5ac-496b-9c60-63b86d0bb62f", "value": "9dfe639f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ffca19-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252504, "uuid": "7b36a262-81ea-4ec3-a112-1f0cfc06f8a1", "comment": "Malware payload", "value": "74280e1922c8853e0edad394256da1f0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252504, "uuid": "7f0a857c-f4cd-4b00-aadf-684f055e878f", "comment": "Malware payload", "value": "187909e482fc66aa9d983667d107fda4886c67fbfdbd71f4dcabf61788fc378a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252504, "uuid": "fdc35603-f818-4849-86f2-1ea59f7eda69", "comment": "Malware payload", "value": "1e8bf5c758e80dc4d139a3944566ddcae3cdfbf0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252504, "uuid": "c0131db7-7bba-4c6d-b700-e4359e530d94", "comment": "Malware payload", "value": "a7a72956156cb1d86ef664c85c8151886acec6de57a29219289b960bac77ddf4f0071a35f8d8205894245b3265941a73", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252504, "uuid": "ee8aac5e-6acf-48cd-b551-c2c5a515d83c", "value": "D9F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252504, "uuid": "0a4f9108-0ba0-46f1-8346-5828886e392b", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252504, "uuid": "28d9c6af-f53a-48d1-b68e-9b6c514dbe1c", "value": "3072:9lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:9lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252504, "uuid": "b55765c5-d677-4403-83ee-3f92cd1b661a", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252504, "uuid": "a4497347-d1dc-428c-baf1-6f96c447c202", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252504, "uuid": "a10d716e-1fe5-43ae-b2d5-6f40e747261f", "value": "74280e19_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "784b0dcb-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209150, "uuid": "db699b1b-0233-4d04-b81f-42f58e04b18c", "comment": "Malware payload", "value": "d1590d303cc8b835ce7acc5bad5c556e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209150, "uuid": "1b1035bf-b800-4272-93de-3bca9b87473f", "comment": "Malware payload", "value": "18a9280726df1e9236c1d4d6062b925d9f58ec21c38406a41a3d245b9e175a9d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209150, "uuid": "bc0fef6a-dd31-4996-92f4-f4ebc7dbbbd9", "comment": "Malware payload", "value": "768640a312e29b3d5bcca2004c7b24c0afc23117", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209150, "uuid": "788074b5-3b56-4a70-bf3f-51c1e84beae7", "comment": "Malware payload", "value": "fd8ef4d64d4d8934f8bc32cbdc63ca2ef35699fc00dd91257ce3aea4afa88ff8880997820b93a280eb544c313d473b9a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209150, "uuid": "1a3bb844-b6eb-4089-a854-d9e0754aa757", "value": "62767CFAABC1DB39E345EABE6A133550437B4FD483B875B8C5292404CAB04531FA4F99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209150, "uuid": "1060bb09-6627-4edb-b79b-fda4c67d3f28", "value": "f3e2034764d31533475d8061dcd10db2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209150, "uuid": "677a0fb8-ee7b-4eaa-997d-0271ea7f0b07", "value": "196608:vzfWGu/uz14Djr7PfG7+JmvYqgZxggtggBggyq/g1ggrgBgPdO/uN8Ohfg2X4BBd:bfWXuz14r7PfM+GYqgZxggtggBggyq/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209150, "uuid": "bc106da7-440f-4921-b8ed-2ae63e7b0d93", "value": 7373824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209150, "uuid": "2558b5c8-93fb-454e-89a6-3222d9ac70e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209150, "uuid": "7074d55d-efe3-4b04-8b6f-babafd4c538c", "value": "d1590d30_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab294ac-adf6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255808, "uuid": "5f9b9a81-91c4-40c4-9a4f-e93b4fc53f1a", "comment": "Malware payload", "value": "8501555d094f0d8a0e980350d55f06ba", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255808, "uuid": "a8f93d47-aeef-4f93-94f5-b7b05a7712e1", "comment": "Malware payload", "value": "18c339416da6459b812c7b22d061a40fd3efd357a5f5dd65c2974018614d3513", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255808, "uuid": "4ce1d556-7b1a-4cd6-965b-b7251d6a88e6", "comment": "Malware payload", "value": "d9085d237973b94c0d25e1c50f480fd98f65310d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255808, "uuid": "abef59d9-2b1a-4f03-b3bb-d96b2d0ed753", "comment": "Malware payload", "value": "272d1dbe3d49d8e25c00205a594c8f98d0afe703495b129c833c310f118a0be76d03651d6fc08ee306e22766d5a3691e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255808, "uuid": "377ff6a8-e725-43c7-9cab-dd6d6ae10f70", "value": "FFF3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255808, "uuid": "dcf362c3-0b93-4d17-b153-57f938437735", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255808, "uuid": "a23ec364-b35d-43eb-b971-ed8f81714643", "value": "3072:nK4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:JDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255808, "uuid": "5c85243c-817c-463d-9279-cba8d7a7605f", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255808, "uuid": "b1bc8c90-1fde-46da-80d4-1bf6358c2efa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255808, "uuid": "832b3ac9-67cb-438e-a84f-5d53d460f73b", "value": "8501555d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da2aed42-ad80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205449, "uuid": "a3542e23-3344-46a1-a91e-02e2c0ec9088", "comment": "Malware payload", "value": "40880b10b9e26f843a68cfca83b8d239", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205449, "uuid": "19860a49-1903-4a39-9aa5-c771b3d97abf", "comment": "Malware payload", "value": "18cef98bfa5c71189d0fb110697f38af705b568038f080c8af778d7a074dd2bb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205449, "uuid": "7f9dab38-0279-4ef4-a3e9-596b0200b7d8", "comment": "Malware payload", "value": "ac80239ff6eb82e064b1617a83e5367e4289deec", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205449, "uuid": "f1780258-5d3c-4299-ba4b-c76158981e47", "comment": "Malware payload", "value": "fcc2caaa7e399624fe1bb02aeef9f8450e606a0304dc7117a7b554e40493e490c041e750b52ccc81ef61d257e17ab558", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205449, "uuid": "846b1341-49fd-4cdc-8f5d-cf21cc25b006", "value": "F3F4AD1ACC5F9450B61B6ABAB5C8E3CCFB4F4CA2491255D138F64EA37B53D4F6EA8100", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205449, "uuid": "800b4018-3cee-4ffa-b2ec-f1d0b743f03f", "value": "5883a02a554ddc89e102d5efe2cc4fcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205449, "uuid": "13f3eaa7-f06b-445d-9287-9f32049bedae", "value": "12288:7svnI8+Je5BDSGzCmFvRjm/ssqr5Y3apizgIR1F2vjNfyXYFaTm:7Of+o5RSzwJjmKr56vgm2vjNKjTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205449, "uuid": "64d856ce-601c-40d7-9bc8-085d6f38df66", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205449, "uuid": "c1a36326-f4d3-4fc9-82a9-3458b5c3d68c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205449, "uuid": "2878ffa0-7118-43b0-ae34-1d2aae6df9ef", "value": "40880b10_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "399b459e-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201743, "uuid": "35f0f33d-a5c7-4fd5-97a4-bf08ea50f0e8", "comment": "Malware payload", "value": "c04deb1424ea85f775170c554a10bae4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201743, "uuid": "46e91461-cb86-4bd5-aede-9555b7264c94", "comment": "Malware payload", "value": "18f98b3e546cd029c9c0a7d3538ee81051feb61ed869b9f9bfc7f2804848c13d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201743, "uuid": "347e5dbc-8524-4e4f-bfd2-9fb9a410b981", "comment": "Malware payload", "value": "7afce5d1fe69fe9e58d87ba0c7217bb971231aab", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201743, "uuid": "cbf35203-60f4-4b21-9c38-4c9eb01f2dd2", "comment": "Malware payload", "value": "223f60094b1c5e584349aad78e1cfceb4e108846438bcca86ab0e89ac1cd1a7e1d05999c8316646f8928f3c0ffd76042", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201743, "uuid": "1eaf37b4-f455-413e-9083-b47f73921a6a", "value": "D8F4AD55FCC7D950C7F3C13BC20AC379A4EA4D198F8B157865BAB808D6D05B8E3816EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201743, "uuid": "ff0db776-5938-497f-a2db-0804933bb79f", "value": "f2d732673d768693dda44bdc4943b257", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201743, "uuid": "30beeaae-ee6a-41bb-b1a1-74493f5e2997", "value": "12288:7so4OdA4guPq9OAe6RMGL+Wm7e7zOCjr1Z3ukFZTNVlFE5MMkTm:7sAdA0Pqn1MGAxCNFuah3lrTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201743, "uuid": "a1bddd82-3469-4767-b271-837903c06931", "value": 772096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201743, "uuid": "52c8bd4e-7ff7-41c2-817e-b39ba1765c55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201743, "uuid": "ab01f129-82d0-4714-a09e-6743fafab2ef", "value": "c04deb14_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7893d888-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252530, "uuid": "13d9d9f2-fe9a-4315-a9d2-513fb425f28a", "comment": "Malware payload", "value": "cfe3aa743a7bdf926fac0a94a8db4a4d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252530, "uuid": "f698f4eb-276f-4abb-8208-b5cc76aabd48", "comment": "Malware payload", "value": "1962a5f2ed0ca60c93d9bc0a7e1bd5c11c9ef627cfbd484d730706eb7a1486e0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252530, "uuid": "da33c7ed-4b3a-4af3-bfdf-754233641ce3", "comment": "Malware payload", "value": "0cdbbe2083123c8e5af8d3095c24de1c0e0b1c25", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252530, "uuid": "059f8ba2-3a71-4a01-b1e8-c99fcd8521b0", "comment": "Malware payload", "value": "d0c1376117439775a775a0f6f37dc7ae4311954d65ef3a2dd0dd6a9b85b9aa9cf1a18a37a29ef2552bc37ee5f0a7a201", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252530, "uuid": "3bf9c401-0ecb-40a0-8309-d3fc35846dde", "value": "4EF3C085DBABE87FC44A35399471DFFB5B388B149640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252530, "uuid": "9ee6001e-0173-4f36-b049-4712b3e0ea96", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252530, "uuid": "e2136ab5-33c0-46a9-a254-57267269bc13", "value": "3072:PQ45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:Y4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252530, "uuid": "1f461ded-3827-4ed8-957f-777924543af7", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252530, "uuid": "e5a9183d-ea60-4d9e-ae7d-46959e0f63da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252530, "uuid": "bd71c40b-3631-4c92-b14b-0d06ca4a3d28", "value": "cfe3aa74_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f52540e6-adcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620237706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237706, "uuid": "6ada079e-45a8-46a5-8244-5dcab31276c5", "comment": "Malware payload (Dridex)", "value": "5d1ef61437590f922dd589b363aee06a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237706, "uuid": "b1c15bb9-6c6d-4abd-abb5-9ed655e0c1ce", "comment": "Malware payload (Dridex)", "value": "196ee65dda724e18fcb789514c5b176714ca59ce4cc67a58c680275e0adbce8b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237706, "uuid": "c6d205f2-ff0d-4fa7-9f5d-d4be2cd0d123", "comment": "Malware payload (Dridex)", "value": "6609136f11c19b1e6d3ff4b582a322b9b00f6ea3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237706, "uuid": "c48e1405-a80b-451a-ac3b-0d1d2e58b958", "comment": "Malware payload (Dridex)", "value": "8e882b662d724a3afaff8ab3b6733de002fdf99136db673dcd01f23ef0183e2c7c70d81a15e872945a10ad2e5fe80b2d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237706, "uuid": "d102f155-bef9-45eb-9e7a-aa7bd074353d", "value": "1EF3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FB4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237706, "uuid": "501ec085-2bd9-42cf-bb8c-bd85a849e37c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237706, "uuid": "b82e9049-d1bf-4aa5-9e53-b6364bda08e8", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620237706, "uuid": "3dfef45d-cb1b-45c1-aa42-1caf8fc529c1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620237706, "uuid": "eaa51693-17a8-4786-970b-e61caaa08ee6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237706, "uuid": "da98832d-778a-4ea1-8096-88ce3c19871d", "value": "5d1ef614_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b388552-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201800, "uuid": "6a2032f2-43d2-4285-97e3-709b67995ed9", "comment": "Malware payload", "value": "129d0cd030ecb4574dc7e55e58999c06", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201800, "uuid": "a958fb68-bc23-4b25-98e5-bd89f404ec24", "comment": "Malware payload", "value": "19c8d8a63ec85a1f77ae4a28bdc4cb149c84d7101883ee8db4a0769f93e2d288", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201800, "uuid": "ac56dd8c-fe11-47d0-a561-8bee5b17da24", "comment": "Malware payload", "value": "d4ed6e763514ba48af462fce0390d735aaf04548", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201800, "uuid": "a8a5b0b6-c94a-4174-91b6-506339f4b5c8", "comment": "Malware payload", "value": "1a43b03caa92ef04ba79a1dc3b6ee3eea5d3328d98282e02b809801610ed50339529179eeb54ce76a4dcde5b08c44075", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201800, "uuid": "2e0e5026-8e12-432c-85e1-c67175051271", "value": "2C15AF7F0C397A26D39815722587B7A3689A0FCFF4A1D2A7D53562C7DBA1B220CC5270", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201800, "uuid": "65b09aa4-4c24-4ae7-b15f-8133013d9a41", "value": "8ed625e9ed4bf0306ae522b4fb312a20", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201800, "uuid": "b43b6197-2942-4ed1-8773-6de441acb6ee", "value": "24576:6BOxMQ77KruSaUEJKQkDUIK7pvTdAtyoB9xw0KrIpO:6BOCENGQk/K9vityoDBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201800, "uuid": "6ce96266-03b8-464d-9362-8bbdbca10c5e", "value": 918528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201800, "uuid": "7dbd2f89-38aa-46af-95a8-84154385464a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201800, "uuid": "2cfca955-ae2b-453b-9413-b30c160395e2", "value": "129d0cd0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa0f27c3-ade4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620248452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248452, "uuid": "d8d9b875-4bdc-468e-9816-a911559f1471", "comment": "Malware payload (Dridex)", "value": "f80c074023039a3aac8beeab41d3e575", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248452, "uuid": "7d2bfa08-d427-4ea5-baa5-7400ca6bdb8f", "comment": "Malware payload (Dridex)", "value": "19dc3705bb9fdea6ce325c01bbbfc55ffeaf3858f884b77937caa23b36f3f6da", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248452, "uuid": "27fc45f9-e50f-415c-9d16-935fa6894cfc", "comment": "Malware payload (Dridex)", "value": "d0e9d5bc2d62be65e1b810804ed4a003252ae1c5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248452, "uuid": "0885dc3d-4f69-4d54-ae29-5cff00a58bde", "comment": "Malware payload (Dridex)", "value": "e68349bdfb5fdaf56b9c112c1af7fac3a4b2f3a139f0982a49b1c6aefc997847757879e9ba99e3386c9a8530b5989edd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248452, "uuid": "6e4ef530-c21c-46da-ba88-a7ebdf2b1ce4", "value": "2FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248452, "uuid": "ad59ce8a-b874-48c8-acff-7c6f723da7a5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248452, "uuid": "753cc372-40fa-4e81-a757-997db71a5900", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620248452, "uuid": "9722d549-27f2-42d4-875b-026232d43207", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620248452, "uuid": "4bb90165-4e6b-48f6-bd73-f0003c55b696", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248452, "uuid": "d3ce7be0-6f15-4bd4-889b-6d197cdc61de", "value": "f80c0740_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f2fae84-ad80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205323, "uuid": "b1b8560c-00a0-49d7-9033-0fb802c512ea", "comment": "Malware payload", "value": "d06c6483aeb2cb0df99e2d5c97ae0c76", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205323, "uuid": "fb35b39c-471b-4789-b7e9-b2b796b893e6", "comment": "Malware payload", "value": "19de7a2a49ff7ddd3dd4d6381df1f4a9ba04fbd6e74b1a663e45e3d657fd959b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205323, "uuid": "0c39dc57-c7c9-4f2a-b5ad-89cf8c481749", "comment": "Malware payload", "value": "42ad688b365abaffac4d1b26ab037efd775c338e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205323, "uuid": "4db6e6bd-58e3-4b0e-8dd4-fd166c2086df", "comment": "Malware payload", "value": "b3dabab06becb1a886dce3b7e7e035918caf9803cb9614d227ca6bfbd12b50e62711c2b1681f30e88cb972cff048319b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205323, "uuid": "fca58617-4894-450d-829f-dfe6188add59", "value": "8075F1EC653E8005D5E28838DD661E443DA25C7E9BE213257DFFEA6C4703A1D28E8CD9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205323, "uuid": "da6cb593-928b-4cc2-a294-c03afd5e96a1", "value": "7c4b37a4e8d078be40e9e6d3f6fa4c1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205323, "uuid": "fa243e20-aca2-4b56-9582-6c34f7ee55b4", "value": "24576:W0EUBfbAXAAyhwOy1xL2TdBAvs5wahtcruxcObR6wsiMtyEqwSjsYV:W0EyfcXAA3LETiAt8yL5svyEqwqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205323, "uuid": "09ace424-b240-4cc4-8bce-4503b1a31968", "value": 1594368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205323, "uuid": "e009aa78-2921-4d29-9c5e-953280fbfad3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205323, "uuid": "4a445784-2fef-4780-ac42-c9f70bd7f5e7", "value": "d06c6483_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "151a71e7-ada5-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620221010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221010, "uuid": "689bf156-d68e-42f3-b3c6-e08ceea27975", "comment": "Malware payload (IcedID)", "value": "97dfb40b46ea9bc51a256bb1b1aa472e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221010, "uuid": "8bcb88bb-a63b-4447-b911-18d42c92350f", "comment": "Malware payload (IcedID)", "value": "19ef0d590ae1ce128b0c96eeb58e95c5d5572f75d8b443648410300a57d4e8d0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221010, "uuid": "601b0563-a824-4d7b-bc21-4048e0487bdc", "comment": "Malware payload (IcedID)", "value": "290e46431cd9fc6cca5308f77fb75f203cc4df6d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221010, "uuid": "c5637fad-5c02-41f1-9c02-0901f4523c99", "comment": "Malware payload (IcedID)", "value": "986bea29310ebb7bc2c30f4e5a6567bd49cfa2162e9305215e113fccc74e13eb1d3d5d13dfc5ff4e4ad81cf9c57f6b4f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221010, "uuid": "4da6d316-6e6a-4277-8364-01df3aa007c0", "value": "961462BD06946674F092A2FE5F5BC2DC80F976F511FC239BA3309AF404489A54FE7289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221010, "uuid": "920a858a-eae9-4955-8aa3-3d587200a8f2", "value": "418bb7afa91ee2677e9770deeeb77473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221010, "uuid": "7b89237a-037a-419f-833e-fa0f2b51333b", "value": "1536:O65/LQ2n3qA3PSD1AWc15xX418gzMPA3MxGQk2x44XaN9QqGYwOo9:D/LQ26GPS5g1Xm1MY3+lx7oQqGnOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620221010, "uuid": "b0d26c01-40dc-4317-be1d-ff557ad7e215", "value": 195700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620221010, "uuid": "e212a718-2803-4bf0-b63d-d7f82ec74097", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221010, "uuid": "51c1e18f-01a6-43e0-9fdf-95c0535f15d5", "value": "97dfb40b46ea9bc51a256bb1b1aa472e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d8d4adf-add6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620242042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242042, "uuid": "f3db7930-bc09-46c8-8628-e124c92cec81", "comment": "Malware payload", "value": "d42c6a5d6e4f304e86038e787bcad5f0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242042, "uuid": "bd8a2e70-1b46-4a22-b1cb-4eae2f3dbe4d", "comment": "Malware payload", "value": "19fbf9fe509c0ebabe0764ab5fde74795bdc821618d2681950f28e5abde4f8df", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242042, "uuid": "a39075e4-8352-4970-827e-dd67a4578ee9", "comment": "Malware payload", "value": "d985d07e790683474f03c33c5507e8067f587f3d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242042, "uuid": "3281e6b5-6be3-4ab8-8648-bcefaa2ac6d1", "comment": "Malware payload", "value": "f71c3186a82daef7cf8726f6d0da2a687ea541b9daba1938ef6df153a7e7384020db394d8400c18613ead56811ae1518", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242042, "uuid": "ef8743fc-08c1-4654-9cd7-9c2a2ffa43d4", "value": "2AF3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242042, "uuid": "5279a17a-87d7-48bc-b674-6941b50de01a", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242042, "uuid": "b932779d-5404-40a0-b503-3a6a660faea1", "value": "3072:+/45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:C4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242042, "uuid": "17fe267d-a962-4064-bd02-334fa66681cb", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242042, "uuid": "8d593014-3455-4902-8025-51baa55d49e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242042, "uuid": "9357ab8d-c1a0-4084-850a-370ed6a933a9", "value": "d42c6a5d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce4dfa65-add4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241507, "uuid": "a6a4695a-ee2a-4963-a9b8-bc32d13ff835", "comment": "Malware payload (Dridex)", "value": "27792c5bedb9dfbcf282ae9079a8dd32", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241507, "uuid": "9ee08c39-3057-4f40-b64f-62511a9adc71", "comment": "Malware payload (Dridex)", "value": "1a0c8847142b7c234775b06de21dc70d852ea3b7827328c7df7f2f0d3ca7dbef", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241507, "uuid": "be4c1ccf-a8cb-4882-8890-5fabf0dc7ca1", "comment": "Malware payload (Dridex)", "value": "1d6b80e6dfe21082faed38192fa40b713505e126", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241507, "uuid": "13026278-b43e-40e8-9b66-9685a6f57e5d", "comment": "Malware payload (Dridex)", "value": "c1d6f2aa08cbafedc7bc7129b5c60484208f090126de2cfb9c29e9d6897fc763e4566cfa3e6ab11bc9cde9feb5eb3685", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241507, "uuid": "56a4c1d6-a8c6-42bb-a54e-5c62f00df767", "value": "13F3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241507, "uuid": "c3059ef1-da3e-4901-b28c-b5e1bb46b205", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241507, "uuid": "a6a1edaa-5898-44b0-a69b-bea5584569c7", "value": "3072:ix45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:84KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241507, "uuid": "b393fcf7-d7de-45d2-a85f-13d13da6f557", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241507, "uuid": "2d0db9cf-5728-4fca-ab20-bbc132214027", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241507, "uuid": "56e0c8eb-ba11-47e2-8d27-e1a5fb9d5326", "value": "27792c5b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c381de0-ad9c-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620217290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217290, "uuid": "345edf41-135a-493e-a231-269eff8d977b", "comment": "Malware payload (NanoCore)", "value": "2c853d07d7708161ce87c0f32fd338d4", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217290, "uuid": "8671f076-c0f0-4800-80e3-b092ba891aea", "comment": "Malware payload (NanoCore)", "value": "1a1641715331329ed3983daded2b15f018debd62069b42fa2087ca921d3a54a0", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217290, "uuid": "33c304ef-e84e-4dcf-81d9-0c0ea8a3f848", "comment": "Malware payload (NanoCore)", "value": "d8e184ebfaabea6b5ca8876ef4fada1d6ac80e96", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217290, "uuid": "054e739b-aeb4-40bd-9c8d-8b5b14930046", "comment": "Malware payload (NanoCore)", "value": "1fb1e527c3dc6fc8baa768439bc7b924190a569efd39c61703f87c3934a01abb06b31ddaa8d38adb58c8a01d064434a9", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217290, "uuid": "2cc1e682-4a5c-42e7-b32a-396ac6ab86df", "value": "E3B54E69BCF370D8A6794F9848D41DF183AE32206D71EA7D1260605D83D7AE2D8B4F78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217290, "uuid": "790dda41-a265-43a0-b2ac-91c812c50174", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217290, "uuid": "517d9c0a-c028-4f97-9763-2e4619764b60", "value": "1536:UwZ0V4quYf/3bxyGeS9LHHzsKnZdCXh+jlAVBgXaZOeFKx+34w7/ZAiQEODtnnAW:w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620217290, "uuid": "0b93fbee-2114-44f0-b4c8-45a7c8bfdea0", "value": 2330624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620217290, "uuid": "570ad55d-86a9-4672-9396-4644acee3a97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217290, "uuid": "ba8c93bb-5a56-4a1f-b248-60fbc5208658", "value": "SecuriteInfo.com.Trojan.PackedNET.703.2850.31846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b0aa330-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209208, "uuid": "fc239625-792e-4ce3-af95-188fbe00aad0", "comment": "Malware payload", "value": "f4c59cdbf69dbb7c6e23fa766cdb54e8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209208, "uuid": "2f8915d6-0db0-45b3-936b-25a890572a2c", "comment": "Malware payload", "value": "1a390f96d3a67017e5827db82ab8371d7a453253037201ee1ec6036e08c55a3b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209208, "uuid": "ce97929f-4b0f-4c31-9a2f-215ef924d49a", "comment": "Malware payload", "value": "751554de6733b63b4afe5c5c9b7fc21f97072d75", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209208, "uuid": "9f01ed4b-6886-46b1-9e51-30778fb46155", "comment": "Malware payload", "value": "48b57b595251f785a5fcc15f4e136969aaf4d45042754f8f93a93404c998ae470ca047e0e0571cb2e92d90b0839667f1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209208, "uuid": "87c5b34c-d295-487a-a4ed-e5e20440f1a6", "value": "78B4E0BCB08BD0B2DEAD89F2417114BDED994B32305DEC7E87B1490E936161CD693E62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209208, "uuid": "4302761c-da87-4b43-abb6-0b014c237536", "value": "88a8818463b3458b11369ffc35c2fb79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209208, "uuid": "43f7649c-e579-4c35-b6ad-56d28d5ff356", "value": "6144:utpnbCrlli7txGKNTHqbp7oxpQG6wk639sMbGtCioy7JYsuBNUHSCdtaDwRPyEyC:uvnbpjG5+bQG7k6jo7JYstHjdgwN0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209208, "uuid": "128b7b2e-acdf-4399-a0d2-ff4b011a62fe", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209208, "uuid": "5770ef7d-1ada-48b0-b4e6-0774891774b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209208, "uuid": "5efd0964-f113-4baf-a3c6-9cae05e88c44", "value": "f4c59cdb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97abb8ac-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209203, "uuid": "b039d696-a535-4dfb-b4f0-4e98af409bff", "comment": "Malware payload", "value": "91e14a6e203ec9c9373b541624bf58ce", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209203, "uuid": "e8ce8e39-0e64-425d-ae80-b744900df97d", "comment": "Malware payload", "value": "1a70e242fccb282f23e73712c315a262eff4d524ebc658d0f72c584b4d23757b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209203, "uuid": "bcc8765e-14f0-4a54-91ee-a3d6f28f45d7", "comment": "Malware payload", "value": "dfeb4959558049c74547ec700f26dc1870705527", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209203, "uuid": "0f97d2b0-0549-436d-8df7-356b7ce0c493", "comment": "Malware payload", "value": "090a08172028ca7d03e5e3ff3f0126ce1ac391d33cad3626c49042215511985ee50b57a2a1a0b390e506762470eae06d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209203, "uuid": "79932ceb-a0dc-48c0-bd76-b7332cbec40e", "value": "D8C4F1D2E9CCA0F1CB279FB1411D42065A139AA3EEE5F0511FF6E4C699EE4E8D207187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209203, "uuid": "75ca897c-5f2a-4c4f-986f-8a71f378c316", "value": "cb7898ecf4fa54291f48243ec73e2584", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209203, "uuid": "b215b49b-68f2-43f4-9668-ab879283d5a8", "value": "12288:HV5DTl+ErQQ9IFAnY9rnNxxAu2lw933o6X1nxinwsQOn937NOxHaU:15DT500YDxxAJT6FQnwxA98taU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209203, "uuid": "a9b71998-25b3-4cf8-a512-3f2e97dd04cc", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209203, "uuid": "5e9803ea-bc0d-4d8e-be4d-a109c18c5035", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209203, "uuid": "f4897021-ba4e-4106-aa62-ff5276f024db", "value": "91e14a6e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49882f4b-add6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620242143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242143, "uuid": "881915bb-7eaf-4811-b424-fea821dc4582", "comment": "Malware payload (Dridex)", "value": "5219aec3fc7426a143879c6a89481d84", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242143, "uuid": "62548121-3b7e-407f-a9c2-c56ef842ce49", "comment": "Malware payload (Dridex)", "value": "1a9d9ba349c5b1e600b22fdb3931c9e11018d8b4ac9117327ceaac079c353bf5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242143, "uuid": "93a89da8-6e73-4012-bafa-297bf02a9f79", "comment": "Malware payload (Dridex)", "value": "a1fcd0f1ef04d9df166e1dc03fbf0c4a28346f7f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242143, "uuid": "d2c082d0-702f-4346-bd58-59147c9c138a", "comment": "Malware payload (Dridex)", "value": "ab901814c206f7fd697c0aab440beed505473a564336d124b988824f6d1705e0827ebee8abbdccdbbb262dd692f919d0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242143, "uuid": "e232e417-4211-4253-95aa-fa278ba1e86f", "value": "97F3C085DBABE87FC45A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242143, "uuid": "195fc53a-0225-423f-9dc4-1c97360c2f22", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242143, "uuid": "397ad3f7-e197-4c69-b2c3-3e7a0b7fac96", "value": "3072:9/45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:d4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242143, "uuid": "20f077a5-2fcf-4ea1-bd3a-270ee6252c40", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242143, "uuid": "46084c42-7155-443c-8e21-ae3836d337f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242143, "uuid": "d81ae0cf-7462-44d2-96f2-3553ae4f5a32", "value": "5219aec3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b4225c7-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252480, "uuid": "15c120f6-300a-40de-98f2-a00b8c1e22c7", "comment": "Malware payload", "value": "d82e7738860ae4b9d07921f84fa24196", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252480, "uuid": "e9eff443-506d-42a5-bed2-04c8385a4bee", "comment": "Malware payload", "value": "1b3a0fa98a00c820022a7df49b710b09686ebbbea5477d7f1bc7ec10dbbcbae2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252480, "uuid": "950e53ea-1221-4992-a1fc-5a2d35db0c2b", "comment": "Malware payload", "value": "86aa821f9a4e9677a7be766e81db09cd4a581655", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252480, "uuid": "50435709-2289-41b6-a165-0f267811fbec", "comment": "Malware payload", "value": "25fc245132b7fa0eac2a4a23d87f0ac859477382ed3fc969ef61d657aa1f014ee67dac6b18420172a4c11b8e3064ed32", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252480, "uuid": "6a93404c-7d33-4040-9158-75379d29e3cf", "value": "80F3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252480, "uuid": "87849730-df73-451c-8f25-7141674d7798", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252480, "uuid": "16c99726-bc71-4935-963d-d1d90fc4826f", "value": "3072:rm4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:BDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252480, "uuid": "2112625b-8983-4f9c-967d-34d2b6f6f222", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252480, "uuid": "e3df2f07-a2d3-4774-a76c-7bb8eb7138e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252480, "uuid": "bf852a31-1ffd-466d-ab57-7d4131a6273c", "value": "d82e7738_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ff9c65-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252129, "uuid": "c02ad192-51c1-474a-aa07-02596a59c177", "comment": "Malware payload", "value": "daca40a7c4a5855284fbc93e94dbeabd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252129, "uuid": "643e29d0-9d55-4964-ad18-12baeef1eca3", "comment": "Malware payload", "value": "1b3db260f69f51fd02533da364f56a4825e5ac0777ffc1fb68d54ce17662191e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252129, "uuid": "b7c39448-8ba9-43f5-aec7-6901db2bc481", "comment": "Malware payload", "value": "5d46ce272d8dcca54a9a57ac96beb700fd8cd9cc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252129, "uuid": "0b452f23-93ab-4046-b0ca-c2b56b4c3147", "comment": "Malware payload", "value": "f74fa6eab3eb8c6dd16a6065039821fc1bba15f850def9c034d0fb16eff3874dd8938984c05e00a7bb59c722e7f2a7e1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252129, "uuid": "ac3d63e3-5d11-4ce3-a01e-f4adc231673c", "value": "67F3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252129, "uuid": "24acfa11-e9e0-40d1-8349-10a7c2896653", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252129, "uuid": "ec610177-e5f4-4958-ba8d-d274611918ab", "value": "3072:ld4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:MDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252129, "uuid": "34291877-d0c4-491c-9fd8-c66d7c473c7e", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252129, "uuid": "bbfe5b70-897d-46a7-a2a8-859a0b06730f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252129, "uuid": "13dcb6d1-733c-487b-8e73-99d0c70e8333", "value": "daca40a7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8865505-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252637, "uuid": "4d1a0fcb-acb7-4b34-8630-4125518f75ee", "comment": "Malware payload", "value": "93d54b89d41971a46ece4ec0eb54059f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252637, "uuid": "ea962842-f8e0-4340-b47d-c7a1c9fdfbd5", "comment": "Malware payload", "value": "1b40c12c91326aa348b48831aa80d9624b377ba6743fa4ec5102534fca5da79b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252637, "uuid": "73710cdc-0ccb-43ce-bdf6-654e2e56ca25", "comment": "Malware payload", "value": "7b82ef02963337686fe9b68829d668616d02524b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252637, "uuid": "9c471e77-1c7b-4a5b-9833-267b15cd1a48", "comment": "Malware payload", "value": "4aa0594fdb8e05bffc065e16eb3624c12fac7f1f8cb44559dce1761ba42c1e5c04caff3ef2bed29535abe18ac6a0b29a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252637, "uuid": "f0e0b8a4-97a4-48ad-8cfd-7f2638ee2794", "value": "14F3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252637, "uuid": "334d11ce-8765-47eb-b7fa-f11ae397701e", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252637, "uuid": "4d6f3e4e-170a-4b8b-9e60-8effc1dd2787", "value": "3072:XW4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:lDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252637, "uuid": "2013a9cb-9746-4f4f-bbac-96e469d6e7ec", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252637, "uuid": "cc5b7757-f63a-4a9e-9cca-250b73d258d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252637, "uuid": "61ffe975-da26-4278-b1bf-6c602440d09a", "value": "93d54b89_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e307485-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252566, "uuid": "06614995-75eb-4250-9e7c-65ae1421a804", "comment": "Malware payload", "value": "a82a02b5749e2d324b42819add29a5f0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252566, "uuid": "73446980-ca1f-4a8a-8ec5-bab498ac0254", "comment": "Malware payload", "value": "1bb781d28246ac234fc2a5d3bc9201893c91c9421f9da6a023c32901086440eb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252566, "uuid": "63fc7d00-5271-4614-9e90-e1c71ab26251", "comment": "Malware payload", "value": "4f46a89b41a26d3e242cc59d27ee7b1d6d7298d2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252566, "uuid": "e2b4ef52-dd5a-401e-bfdd-aae48156223c", "comment": "Malware payload", "value": "fb292a5e8f7caff6e01f5de01ef74bd0a442ab0b89983dc7c781e4120d8a13964c9d2287ef5d282159a23325a63b48d6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252566, "uuid": "1d10ef76-23f2-463d-8ae9-ba13dfd93ca0", "value": "88F3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252566, "uuid": "f30b7db6-dc49-4e0d-9442-380c0348b174", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252566, "uuid": "1ff7aa78-9847-4254-8cd6-ae89f74b1579", "value": "3072:Gc4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:mDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252566, "uuid": "12c0c62b-e9e1-4ee9-a1c7-a7f84e22b911", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252566, "uuid": "75bcee52-1867-410c-8b38-d3ea35bbf7e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252566, "uuid": "811030e4-f471-49a0-9e1b-af0582b7ccf8", "value": "a82a02b5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc5fe13b-ade4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620248456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248456, "uuid": "5900cde0-d2fd-4433-890a-699b7c345c8d", "comment": "Malware payload (Dridex)", "value": "3d16b3dd909984ddcba58936cec629e5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248456, "uuid": "3e53b693-4de3-473f-8150-c998a2e1ad04", "comment": "Malware payload (Dridex)", "value": "1bcf4265945d508ae43ebe7363eaf22683d8b9f831f59af6e565c49fe2fae143", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248456, "uuid": "218b2737-ff22-49d5-8a3c-a94267015277", "comment": "Malware payload (Dridex)", "value": "9e1ccb9af8c6158014288a0c7fd494c0249b4c7e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248456, "uuid": "c3453bf5-9884-4ff6-8fc6-fa43c4724e81", "comment": "Malware payload (Dridex)", "value": "e5a82279e1f1f48f13c575b19bef08de10c0c5af75d30216e2a14e0262cc48676d082f4942325a028461d6a3d9070c07", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248456, "uuid": "d0311af1-625b-4ef8-b4af-ebf06d4ec0c5", "value": "BAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248456, "uuid": "bcc9a1d2-ab8a-4b92-8c1a-54fd6af2728f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248456, "uuid": "aae9690d-7c81-4545-8e11-6d19c16d718d", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620248456, "uuid": "12d8beff-f599-417d-95e4-da51f53955fa", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620248456, "uuid": "ca82aa2c-6230-4bbb-9e87-9725341deab6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248456, "uuid": "ed12e2c6-b056-4e57-8693-f6c3b0702a37", "value": "3d16b3dd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34aac66-adc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234187, "uuid": "0a06d1c4-5b46-4d52-8a6b-51e01bfbd081", "comment": "Malware payload (Dridex)", "value": "5c729246fe1a3d2b451fa8ff85313fd3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234187, "uuid": "c603990c-d179-4bdd-9737-dce4a5aed363", "comment": "Malware payload (Dridex)", "value": "1bd541df4a3c1d72e97301459f404a494ce62abe8137936759b726a255743cd0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234187, "uuid": "6372909a-2307-4bb5-9ba7-cef8411c9946", "comment": "Malware payload (Dridex)", "value": "9eb88efac6db43c1341640c4607c8b41409fa01e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234187, "uuid": "ba406f10-8731-4f11-b6de-df9f0fb19465", "comment": "Malware payload (Dridex)", "value": "1ac7adbca89bb78aa18e4e860a5f42f17cf4c001ee69f9536ef44c2087afbc3be259d8515f04b977b74d15bb23cd2d2b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234187, "uuid": "ed5c50f7-b5dc-41c6-990e-8102fec5c3b2", "value": "C6F3C085DBABE87FC44A35399472DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234187, "uuid": "c791a170-0d8a-4ed0-8b8a-c7951a28941b", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234187, "uuid": "54ead1a6-c72d-4aad-9341-a70214521387", "value": "3072:xz45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:p4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234187, "uuid": "fed22e79-a982-4247-87be-5b7bb4217910", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234187, "uuid": "4b34618e-58a5-48b3-9a16-fd933553bb0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234187, "uuid": "5a4c4d5e-943f-49bd-90c7-e05aaec0027c", "value": "5c729246_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "875ccd6f-adc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234086, "uuid": "67cbcc72-d68f-4153-b8a6-07e4cd278c7a", "comment": "Malware payload (Dridex)", "value": "6afb2926b8d1c49e6f3360f56d1e9cdc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234086, "uuid": "ad63f2d5-9604-4ff5-9401-0949d47b288a", "comment": "Malware payload (Dridex)", "value": "1c1853b9d770da52e4cbcd883c5be4b41b4216bdc28cd2814b3e6b75d02bc286", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234086, "uuid": "49a46734-809c-4568-a914-6de0b5f673ec", "comment": "Malware payload (Dridex)", "value": "3d0b9bfcfa162d295b7f5ad66e010311e818afd9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234086, "uuid": "1fc11038-1a01-4a4f-ba9d-464f5520d076", "comment": "Malware payload (Dridex)", "value": "7999966801bf45bf1771832a0692a3eb6914c6256131a5eca8095b29732cca6b871fbcd21cd90fc02f40bda0e3a80727", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234086, "uuid": "9d87b946-a0e1-4b7e-a50d-39b50bbf4a17", "value": "CAF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234086, "uuid": "122ae607-275f-427d-9a85-7f32e355d8ae", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234086, "uuid": "67321760-c739-402c-bd98-6e68dcb462f2", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234086, "uuid": "488538c6-9e23-4abb-bd47-ee3795addbb6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234086, "uuid": "5e038e23-c651-43d7-b398-e933bee798e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234086, "uuid": "5ddf061a-a66f-4fdf-a589-9391f3b92945", "value": "6afb2926_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0592354-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252596, "uuid": "275e815a-c905-4c33-a322-efcbca75c971", "comment": "Malware payload", "value": "afd897f6b71f80d7acc570023e29269d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252596, "uuid": "5e55b13e-8132-45d7-8ad8-eb028f2cc7d2", "comment": "Malware payload", "value": "1c4bcbdd02c45c3d61fe48e4f93148f4ed3475e0c17c8af821f78b8f60eadae2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252596, "uuid": "84d223f0-2d71-48cc-a2c2-210aaae7f32b", "comment": "Malware payload", "value": "adb8ebe45e45d8f2a25dc2799c3831acae243309", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252596, "uuid": "8de4e1b6-209d-47b4-8e87-3d9ad3f48987", "comment": "Malware payload", "value": "995d7998b3ed03dc94240cfde7e442d83077d897ecc80eb7a9686715cca0547c628e7333b7a4164946b48296643ebe9d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252596, "uuid": "27096642-e0d3-4401-b8b0-c97b980feefc", "value": "F0F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252596, "uuid": "03db8736-39bc-453b-a8e1-198b882e4ab6", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252596, "uuid": "a040f2a5-f4c8-4451-b324-c48aa7b4392a", "value": "3072:4B845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:R4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252596, "uuid": "9c1e1f72-76a9-4751-8080-08c5b27c484b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252596, "uuid": "f5c1ecbc-7b75-4dfa-b44b-da2a7d0a1850", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252596, "uuid": "e0b975a8-d68a-4c87-bed2-7a72edcf21d4", "value": "afd897f6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4f599bd-adb2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620226888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226888, "uuid": "47b7684b-19b9-4111-b970-2a9162aae193", "comment": "Malware payload (Dridex)", "value": "917636cdd719a286d90974ec9ab83d37", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226888, "uuid": "0fa2cee7-07d2-4b9e-a1f8-81766e544c99", "comment": "Malware payload (Dridex)", "value": "1c6d58f291f07c2be04792ec008299adad868fc072c1bbc7979623d679bbae15", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226888, "uuid": "22f42df6-415b-48ac-96f0-bcee6953eff1", "comment": "Malware payload (Dridex)", "value": "151b8875134ef18557ad7575e324198f4e58e8b1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226888, "uuid": "f131b4d5-9a7d-4614-a60b-7c28114347d5", "comment": "Malware payload (Dridex)", "value": "360e9df9af5798aaa6b23b38902883c12bd2cb5b8565f6f720e3ea31c95f62b9e2745f5e758566ca9d9019ca44ea045e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226888, "uuid": "f18d336d-1a24-44db-9679-4dc2c401f602", "value": "B0F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226888, "uuid": "5f502ba2-c5ec-4326-8edc-01b4ec4cd6ef", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226888, "uuid": "287a5225-2e65-4a33-9d3d-3cd34e19d705", "value": "3072:riFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:IeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620226888, "uuid": "bcd155f7-67ae-4e29-aabf-a8020be0d052", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620226888, "uuid": "0acef391-48d7-476c-a0cf-b47a18cac6d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226888, "uuid": "1ff77ef4-8da6-4a85-83e6-68af10e06a02", "value": "917636cd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f37f8e67-adaa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620223530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223530, "uuid": "758c967e-4369-4612-9664-28877bcfb321", "comment": "Malware payload (Dridex)", "value": "5b1691c9827284a2b1273a1b1aeb62e6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223530, "uuid": "8bb32053-12b6-47ea-8da2-e5a1d2f11aa6", "comment": "Malware payload (Dridex)", "value": "1c70bdc424cb7c8f4dccca294c83a50ff37b52962fe754e80337cc620bf64ba9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223530, "uuid": "c88b489a-a772-414c-927a-f05e9480711b", "comment": "Malware payload (Dridex)", "value": "f93599360055b2be2c92ad69e3aef55747128120", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223530, "uuid": "645d8481-f55b-4343-bd43-a4bce1225398", "comment": "Malware payload (Dridex)", "value": "00a8be05291d3b121bc41b9dbb48a010dc66454fd342b416e992e3dc113368a0347ed7f1c8396ec41df1bed3a9052a85", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223530, "uuid": "ff4a6403-6970-441c-a7d9-22fc73d84e78", "value": "F6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223530, "uuid": "d327085c-69fc-4cc0-9d0c-3a67245cc406", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223530, "uuid": "d99b25bf-7668-491a-ae17-1b86ab320c08", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620223530, "uuid": "1e2036fb-8089-4cbc-8a68-bb560fdbfca8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620223530, "uuid": "1ffaa4aa-3b44-4583-adb8-29a6296482a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223530, "uuid": "82db7242-41f0-4f68-a07a-bef4431ea707", "value": "5b1691c9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4999821-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212795, "uuid": "a17f6888-7bb8-412f-acf6-42e373d0ddc7", "comment": "Malware payload", "value": "c9915631dd271219bf51fe0a46a1d8ff", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212795, "uuid": "6d7c0ffc-7ad6-4bff-bcc9-e2c7fead79d3", "comment": "Malware payload", "value": "1c958bc2a268ce3f104a35882f694f8bead71015937bfb99b0986400ab29d703", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212795, "uuid": "836b675d-14b9-4ccc-b8b4-c8b272a65f45", "comment": "Malware payload", "value": "7d6b0dd72dd6dd3261b0f30525c6860f86de012f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212795, "uuid": "2a77f674-f9db-4dd3-9fc2-77517b875068", "comment": "Malware payload", "value": "e48c3dc5eaf2abd779267a92400bbd0541a40be5a1cf47b31b99283aa8b255d41da3ed66ea0c9b9d02f930a8ef10523c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212795, "uuid": "bac84176-434e-418f-861d-57409848f9fa", "value": "9FC31A0F6FC5A3E2E76912F167874CD909272B8C6D5A25E3636846D72D20B1128FB31F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212795, "uuid": "853bedc5-4b61-413e-8a19-49c80964806b", "value": "6bfb12c0ac9e50aa509f27c55c68a1e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212795, "uuid": "eb130766-fb4a-4caf-89b6-1d0296148eb0", "value": "3072:kx6AHjYzaFXg+w17jsgS/jHagQg12xiaV:kxzYzaFXi17j9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212795, "uuid": "267530ad-5aff-4a55-b758-0fcfa5c5d226", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212795, "uuid": "1f1e207f-1ebd-4cb2-8483-23a008618835", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212795, "uuid": "940e3ace-91d6-4fe3-a932-4a29272d2b0b", "value": "c9915631_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b73e85-add6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620242135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242135, "uuid": "10c3c76c-cba6-4afb-b132-9274e2b06e46", "comment": "Malware payload (Dridex)", "value": "d10f42e289efaee0da95bea117f602d7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242135, "uuid": "d847b139-6133-48d6-a328-351e1e9c16ec", "comment": "Malware payload (Dridex)", "value": "1ce3205140140479a9409ac8aafe63354baf545c99d05e915cff049e88b14b3e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242135, "uuid": "e6aa64fc-fc87-4ee5-8dc9-9ef375dbe569", "comment": "Malware payload (Dridex)", "value": "e9394f7bf48d0e756be7ad3ae69ca19d6d7d5788", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242135, "uuid": "d98b2752-5538-436b-a26d-d5c671d386e5", "comment": "Malware payload (Dridex)", "value": "70fd2eb1470cee33dd7a9eb12f255b0ae83e122e2d6ffe02202cfc6e1ac68878635583549418531fdef558ae87ca32df", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242135, "uuid": "406451c3-2961-4d44-86e8-90856bb1e30c", "value": "1EF3C085DBABE8BFC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242135, "uuid": "14fdba72-b4e8-4dfa-b6aa-3f9aae0a31e8", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242135, "uuid": "9ac33550-bae4-49cc-9224-815dde07e0f2", "value": "3072:EM45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:j4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242135, "uuid": "7f591109-ccd4-4344-aa08-c9ff6ba60d80", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242135, "uuid": "060804ed-8227-4307-81c7-77db9f3a2d9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242135, "uuid": "cb10ccba-3a16-46c4-a24d-b3deba368d01", "value": "d10f42e2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf0f438-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252508, "uuid": "c97c6cdd-404d-4c38-b336-52a4af9c8441", "comment": "Malware payload", "value": "acad77f801a2e805afb4deab55cb1e17", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252508, "uuid": "6ad43d6d-55db-46b0-b339-c7f696159c6f", "comment": "Malware payload", "value": "1d04715dcbadc446dd95dd9e103df7fb8608105487e361291a8e24455010a671", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252508, "uuid": "f1221cc4-3f42-4e5c-b675-7d6f2f21bdea", "comment": "Malware payload", "value": "1b61385aef13983445965fc787921cbbdd858a1a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252508, "uuid": "baed5e92-43e1-45af-8567-4657fdf33052", "comment": "Malware payload", "value": "2ded5e36d53c1b0ec811ec656fcb84fd78abc2bba9149e10637ba1b287cee50464042fa08ca49d2da4c73e5ad6f4c793", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252508, "uuid": "c1adf75f-781f-421b-9d73-c4b161a2c50c", "value": "D0F3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252508, "uuid": "b466787e-c083-4bc5-bfd8-bf3400f6788d", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252508, "uuid": "c6d01272-d2fe-41ef-b200-15f49e86c377", "value": "3072:mB845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:/4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252508, "uuid": "096b1b05-077b-40f1-88e9-86a714290668", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252508, "uuid": "275ace5a-92ca-4272-80e5-6e25f807179e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252508, "uuid": "bd2d34b5-a84b-4f27-ac9c-24b7c3986b83", "value": "acad77f8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b44b607-add6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620242173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242173, "uuid": "4a5fd8d2-f3f1-409e-889a-702d56e07398", "comment": "Malware payload (Dridex)", "value": "96834a21a0ba5c46b58ddfd4a3ef7fa7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242173, "uuid": "41a2a31b-c20c-4884-a2b1-3a0339955db0", "comment": "Malware payload (Dridex)", "value": "1d049b04223f81ab6277a59b0165e617cad30a9a24fd015f5ee38d2a531f196e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242173, "uuid": "de43d9eb-6595-4057-b27e-e38b3f2bf345", "comment": "Malware payload (Dridex)", "value": "91143aae6e890ee853874c95f8555f082eabb11a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242173, "uuid": "4341fe6c-1cb8-4e91-af4a-0954fc80a34a", "comment": "Malware payload (Dridex)", "value": "468430da490a58c640f8de2fd288e2b86f0aeda35b760ce8b111bf3facad0cf61299b833d9823125c3090d2b4410ee84", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242173, "uuid": "65541ba5-55cb-4333-8db2-841b9777e844", "value": "65F3C085DBABE87FC45A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242173, "uuid": "c7bec2f1-3fcd-4b7b-a0c7-70ebd099ac85", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242173, "uuid": "26d1ed7c-5d8e-482c-983c-4fca680244ee", "value": "3072:/945bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:V4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242173, "uuid": "6a3abe8f-8e59-42ec-948d-22aeebab8bad", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242173, "uuid": "e885494d-55a1-4131-b05b-2d72123d450c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242173, "uuid": "bdae7011-c47e-4071-8040-420f56ac8709", "value": "96834a21_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff856613-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252327, "uuid": "522636b6-b004-4669-98d7-70ab10026f57", "comment": "Malware payload", "value": "49c41cf570439c2454279f39111409ee", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252327, "uuid": "27380a42-dea5-4876-9488-b7b1495e30ca", "comment": "Malware payload", "value": "1d05ee99221729818fb5ad6aed058e14cf9a50a6347e80b857956e96a1428666", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252327, "uuid": "8273b68c-4030-405b-8349-9959d9d36886", "comment": "Malware payload", "value": "df959a78edb849fe03983cb194823fb55c2bd870", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252327, "uuid": "359dab0c-7395-4577-a560-39212a707998", "comment": "Malware payload", "value": "92f573a3097b6d345dd0c53e5074bb6da927c201fff600331dc27d33ef4390fbbe016df0356503f49a8a9d952d7e0d1d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252327, "uuid": "dbe80c53-83bc-4bab-aac0-63a7e56ac7e2", "value": "55F3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252327, "uuid": "76cee588-c44b-4831-9711-2f86b78d4b79", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252327, "uuid": "e7e73d40-3c05-4d39-934f-d2db610a7c65", "value": "3072:3v4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:wDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252327, "uuid": "f6fb0d36-0ec3-46c2-a2b9-89e8e0c68545", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252327, "uuid": "7c3334fa-9a73-446e-87eb-f7a1e20623b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252327, "uuid": "39f1e158-0ea1-4063-a31e-2e1e43c36bfe", "value": "49c41cf5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11761a9c-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208548, "uuid": "68369418-de4c-4479-aebe-e50ce941089f", "comment": "Malware payload", "value": "7b5ebc8b7b17bf522a168221372d8951", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208548, "uuid": "af4cec0a-c35c-4754-80d1-ddd41050830e", "comment": "Malware payload", "value": "1d2de05b6c9c17e4b3a126c1d4fa7111729f79bb73a01652e88fc4bf01ddb6f1", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208548, "uuid": "691a8938-a4da-476e-b45d-b1c783b7fd60", "comment": "Malware payload", "value": "f4e44bd41ebc7cd4b9f98aa891de8c03fc621a28", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208548, "uuid": "008a5e62-b52c-496a-880f-211e885c48e2", "comment": "Malware payload", "value": "d43cc59bc0eb3c0833c1af65dd4d4b6fbeb324855f8b6e00b975fa24889c3ecfa0d61ed1197464b37577346b8674ae86", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208548, "uuid": "88883f94-5c76-4780-8415-c27b5f21ef8b", "value": "48A1F750112C1AB07246697AD26FFA52B80EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208548, "uuid": "2f3f3530-1f39-41a5-b2f1-42683dfef0d6", "value": "96:MRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:MRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208548, "uuid": "32262799-a6a7-45d6-a6bc-5b10712acbcf", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208548, "uuid": "fe75cb38-fb13-488e-bd67-ff8965979ac2", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208548, "uuid": "679d4caa-831f-4bee-9219-31ddd6bacef7", "value": "1d2de05b6c9c17e4b3a126c1d4fa7111729f79bb73a01652e88fc4bf01ddb6f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a0c324-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241925, "uuid": "fc37f160-0517-4f2e-af63-7c771c818a9e", "comment": "Malware payload", "value": "c3847c6fd91ede65558a8b4cf556e781", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241925, "uuid": "a956f817-efa2-4c7c-a434-b2bc33c5ec87", "comment": "Malware payload", "value": "1d563bdb02f4816cd4485b81f73a7cc59c1da21f43b9692c61e892c0f1a79df1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241925, "uuid": "d3094c17-591d-4e8f-a320-95eb8a87fcc4", "comment": "Malware payload", "value": "4d3636b3bb7c21a1dbc5d26a3771e2fee897a435", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241925, "uuid": "e80eb85a-53a5-4c03-97c3-92e704eb9313", "comment": "Malware payload", "value": "d1a7db737fc5c08c48384b564498a8702edcbe9c9b3a4500f9a5bd0405cd2b37a8ba395e4a286e97f3aa9afdb7135a6f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241925, "uuid": "49206af8-49ee-4acf-ade0-4ab99179bc13", "value": "D4F3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241925, "uuid": "cffa3e5b-37b5-4417-9b88-14a0e451d942", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241925, "uuid": "4db29d1e-2472-47bb-81da-c57e9dbb7afa", "value": "3072:Yi45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:14KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241925, "uuid": "8ba3a3b5-70cd-4f7f-b1f0-f488e5f21d71", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241925, "uuid": "80afd660-9c77-4a8a-8168-e12dc327066b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241925, "uuid": "57d6b9e6-fc04-451c-8378-af0bc512a6d2", "value": "c3847c6f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f10c99d1-adc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234263, "uuid": "89cfb720-6cb9-4a60-89b7-e29c6deef996", "comment": "Malware payload (Dridex)", "value": "9c119b3f0cb5fb7396c7fdd4f65c3a13", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234263, "uuid": "95383d41-daa7-4aaf-8cef-ae5291571bf7", "comment": "Malware payload (Dridex)", "value": "1d78f07b589494b3c37d795387f0a7cd79a5b0e80a4f172c9023a60955bfd562", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234263, "uuid": "4f762dad-b87b-4f6a-aed2-031e0a654d92", "comment": "Malware payload (Dridex)", "value": "e6ca20ad65ea3c31c42480c7d069dbc1d25c8476", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234263, "uuid": "b42fe7a7-5388-4d55-8a98-5259a0fcdbdb", "comment": "Malware payload (Dridex)", "value": "7ff503184c5de75dc63dc386730ab5eb9a251a91960e98f808b8d5245ce8fbb8749a5b8ee000210f0b9fc1313190c41f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234263, "uuid": "75f87477-ad51-404f-b605-e3d086cc251b", "value": "36F3C085DBABE8BFC45A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234263, "uuid": "ce9c80da-2b2e-4750-9742-a236a6f3254d", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234263, "uuid": "ccad1fe8-8ad2-4e9b-95c5-64a37d141800", "value": "3072:Mk45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:/4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234263, "uuid": "973f7421-0217-4ef4-a07e-393593a46751", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234263, "uuid": "81b36d95-5dfe-4e9f-b35c-9df0a74db43c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234263, "uuid": "a517d87b-fd4c-4622-b7b0-e811feb24d88", "value": "9c119b3f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb2927f-addc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620244913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244913, "uuid": "459ebfa6-249d-48cf-8b99-3e90158f3760", "comment": "Malware payload (Dridex)", "value": "59f7511dba4d9e24f2cca82d1b423878", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244913, "uuid": "ccc184c8-355d-4ede-a0de-8800fa740309", "comment": "Malware payload (Dridex)", "value": "1db189fff098bae1cbf1ef4c2e6016c88250901a9e1b8cf7ad803c6aaebb89c2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244913, "uuid": "e5803f4d-a237-45e4-8321-015f46aaab0a", "comment": "Malware payload (Dridex)", "value": "f21491bf0bdcc228177e9dd7fe871f57136e75e1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244913, "uuid": "9174ad56-1841-433f-a0d4-1ac67e746bfc", "comment": "Malware payload (Dridex)", "value": "db575e920e498939f1d69b6669cd2e708a56cd592ad8e5c7cfc58697a08caf01a4c8219c5f41080faa7f5e7f3b4ba09e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244913, "uuid": "850eca31-ebd4-49fd-9914-ed4f2ea8a15b", "value": "3AF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244913, "uuid": "1ba328c1-f8e5-4d2b-9ef5-febf0a0097f4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244913, "uuid": "d24ce77f-9c02-4ee5-a66c-0b11eac255a8", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620244913, "uuid": "a3bcba17-8134-4c48-ad70-f7893855ef42", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620244913, "uuid": "50f16f4b-ec39-4063-8316-11851d5afc9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244913, "uuid": "f94c3b92-cc0a-4975-92e2-af875ed1daa8", "value": "59f7511d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d481f46c-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252684, "uuid": "6a7a9039-2fc5-42e6-b2dd-cb5303474828", "comment": "Malware payload", "value": "63f6644bf9181d5eff45f1198eeb921d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252684, "uuid": "70852ad0-8e78-4b50-8fe5-9809e3b20dca", "comment": "Malware payload", "value": "1ddd8efd078264841ec6cb2740116e9f9ae71516ef72c7a9387e7e59b94b26e7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252684, "uuid": "67b7b62e-0cfe-4370-8625-f81c1dab0f22", "comment": "Malware payload", "value": "393d4d6676f0fa18cedb9c6cb91e572d3cb96ee7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252684, "uuid": "4a04bf9e-8cdc-450f-ab68-7d230456be10", "comment": "Malware payload", "value": "3f9d46880aedd3c7d0e9aed7207ff10613f44ab8d4715cd2124f6591f999dee205ec6d68516d27f4921389497d9e86ce", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252684, "uuid": "631f2fae-d36a-4dcf-96ec-2e04d5f8b1b9", "value": "86F3C085DBABE87FC44A35399471DFFB5B388B149640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252684, "uuid": "4b07be73-976f-498d-8045-8cbf2d09c4e7", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252684, "uuid": "915f9f11-7433-4a06-b034-9eb5eaa6abb5", "value": "3072:lL45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:V4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252684, "uuid": "99b33e92-85d0-441d-81c0-836c8fe08672", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252684, "uuid": "7d4c2e40-e818-41ad-a9db-d5494fe681e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252684, "uuid": "e3175143-fd87-4098-b766-270285038044", "value": "63f6644b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "101a706e-adf6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255790, "uuid": "29661096-37a5-446a-a571-465bd42d1498", "comment": "Malware payload", "value": "361531f24cd5d80a9143e600ecfafc78", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255790, "uuid": "2e99d5fb-159a-4cf9-8a60-26c57daf325f", "comment": "Malware payload", "value": "1ddeeaf689ca80843adeb98b97bb3037622d8772ca1be16de6a40bd6c12b794a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255790, "uuid": "671ad4b0-60f7-4607-bc0a-9fbd89bfa8e5", "comment": "Malware payload", "value": "c395093da7361d7c4358e721905a71a3fde52ab2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255790, "uuid": "808bdfaf-a38f-4388-9670-a3892b58bd7e", "comment": "Malware payload", "value": "468f886bbfcb3b7b823fd5146b9f37948f811e774768351aeffd4df7bf0b1167300844e7a2054bd0019b67d8a921d561", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255790, "uuid": "ba4eb8b3-7cd0-4dcc-aa46-2fb99e603876", "value": "C4F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255790, "uuid": "75aa9a5c-d00d-4c80-ba53-a96b3f50caf5", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255790, "uuid": "6c715bad-98ec-449f-88af-52096930f0bb", "value": "3072:CWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:C42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255790, "uuid": "63c51e54-6f3b-4622-bab9-667b27fe2da2", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255790, "uuid": "69036f3e-79ae-4bfb-bf28-d823ca3e54ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255790, "uuid": "438a8843-63b7-493f-865d-72077829f084", "value": "361531f2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7510868-ad63-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620192989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192989, "uuid": "37e53c4c-9dcd-4dc4-b7b2-087f25216991", "comment": "Malware payload (AgentTesla)", "value": "574133d59bf0817ecebbaf50b128b3cf", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192989, "uuid": "be88bc66-6ee7-487e-ae8f-9b6969ede88b", "comment": "Malware payload (AgentTesla)", "value": "1df6bbfc96ccb6690190aa435ddd38ef64249181e4c82d9a575960a7b047b1bf", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192989, "uuid": "ded255b4-ab3e-49eb-9480-b9a60fdc6252", "comment": "Malware payload (AgentTesla)", "value": "3bb21586af73e892ef11e18477b46b31f46445c6", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192989, "uuid": "e32f60b0-1e93-4d2c-a4a7-89e381311f51", "comment": "Malware payload (AgentTesla)", "value": "e1be1a9b51a1d6c162108c934cfb4b5ee1ade683948f37e4e0b646368857953f51bba4e8fbe307db99d6f5b6e223851f", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192989, "uuid": "f9549079-5539-410f-881c-040b604d927d", "value": "2DE423DB4DA1A9F9C9D0D8C207B2838F1EA42053FDB96ED05469707D78F817A92F12B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192989, "uuid": "cdf6b718-5a07-481a-97f5-d69c904a0de2", "value": "12288:e0364qlyjWseo+iY4LbyPiEO6ElLSJ5EovxLsTUFmSY3k6EqRZ2ft+2pXQWVc:eR44PJRiY4vyqIEl2XZyCMUTk0XQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620192989, "uuid": "98dcdad0-c949-43f2-9dbd-06080cfef547", "value": 720653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620192989, "uuid": "b63cbc34-4321-4df7-a159-c52437e2e415", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192989, "uuid": "5a643e67-1894-45ef-b33c-cb4ec2736a72", "value": "MSKU4460632.SHIPPING DOCS. AWB PACKING LIST ISO CERTIFICATE BILL OF LANDING DRAFT. COMMERCIAL INVOICE SHIPMENT INVPLTHS0094587231.pdf.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf1f5772-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201967, "uuid": "95041090-c32c-495b-a12d-051d7d0eef61", "comment": "Malware payload", "value": "9d38423803f7544daa8c8c39fdd90511", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201967, "uuid": "ab3cc3c3-f047-48e4-b244-54b52384f410", "comment": "Malware payload", "value": "1e1f86e7ca7a69efabe84abe8641f04fcf2ae0a4eee870e7df6e2517bd1064ca", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201967, "uuid": "f33a8fd5-7fc2-4dae-8632-08c0a6f649f7", "comment": "Malware payload", "value": "3384b48d0fc59e4d7469e8312985abe1f7d1c2f1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201967, "uuid": "3c32f7b3-c798-47f4-ae54-3af8ab2b372e", "comment": "Malware payload", "value": "13d057976d31ee745eaa4458c445dac0144edf8111c96d0d748c4db701c31d1aea74c098eb7aa07fe57980d97d271695", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201967, "uuid": "efd88291-db90-4587-9e28-febba01e6972", "value": "5FC4F0A093F22874E77BAA3B41B62874BC7C0552E2E357C751733A61EC3C395427C966", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201967, "uuid": "4593d519-fa69-4d6a-bf0b-662eb3379681", "value": "f6104a804c327df44363dfd9154cb5ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201967, "uuid": "f3ffbc1d-ed12-41d3-b970-1d0f0472e91f", "value": "12288:ICx4qUCb5H8pX+AuidjJvZ6n6sNW+LFC54Bn8Ybt:Pz5guidjat1LFC54Bn8Yx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201967, "uuid": "66c693ab-df34-4110-a6d5-25c1229d61fb", "value": 545792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201967, "uuid": "113982c2-e068-47cc-a69a-e69a406caa59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201967, "uuid": "f37ecff7-a805-4d4a-8226-dec7a3b87758", "value": "9d384238_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb4bd59-ad81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205614, "uuid": "1c806930-d94d-43f4-9076-5e814b21fa75", "comment": "Malware payload", "value": "c488a81c9bb0e5a0e8b23fbbddc5e0ba", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205614, "uuid": "b6430d7e-ec66-423d-bbe4-9049ab606048", "comment": "Malware payload", "value": "1e5276621916f1509fb1b4c3241ddb193b080f841e5055b911f6463b98a87f7a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205614, "uuid": "c4b4c771-f060-42ab-a55a-33053f2a9a96", "comment": "Malware payload", "value": "f5bd878538b9bf3f7d47c5ea1e3433b6b18f8061", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205614, "uuid": "c5f8738f-b64c-4f01-b99c-83a409818e7b", "comment": "Malware payload", "value": "31aad23c794ccba35c8f3a55d1003e33c63fa3dd97bd8311f8a4d26e39ddc34df53ba9eeb913b438b96486aa38c5c412", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205614, "uuid": "fc5dc14e-f1e2-4428-83f9-150835899d84", "value": "08052346561978E6C374213D30C70D04C55656A6E88E2920E7A367E3AFFCBED3DBA40E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205614, "uuid": "45a47a33-e2f3-4e1a-a177-84cd55b10dd1", "value": "e4290fa6afc89d56616f34ebbd0b1f2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205614, "uuid": "fb27056f-33ce-44b9-8098-10fcbece3eed", "value": "24576:JanwhSe11QSONCpGJCjETPlia+zW7c9Ub1:knw9oUUEEDlZ/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205614, "uuid": "c9937c8d-92a6-49b1-966d-f0087acc54f1", "value": 807504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205614, "uuid": "b3ddfbbc-0209-4d3b-8d9d-6e80ae6658b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205614, "uuid": "cc236489-0c29-4899-a797-2085dfa59a5c", "value": "c488a81c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aec69e0-adbb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620230495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230495, "uuid": "551ce476-394c-4eb7-9453-c3e709ad9d5c", "comment": "Malware payload (Dridex)", "value": "1b1087d08f35baeb32154708ad4cfb76", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230495, "uuid": "f8b41bf7-1580-46db-bec4-5986cbf1d1cf", "comment": "Malware payload (Dridex)", "value": "1e569e950d3fc93049aeb22dd50bf3fb07187319768ac87cb04cd05c8b5b8fbf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230495, "uuid": "3842b80b-482c-4451-9868-564145249487", "comment": "Malware payload (Dridex)", "value": "88195c1f241ee20944fe3f64c1a1b74e76d3fca4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230495, "uuid": "ab131cb9-5c34-4582-a7f7-3f01314e7368", "comment": "Malware payload (Dridex)", "value": "6f1b1def41584a3b6dcb9115f697a19263c3fb47181d345893e98d571827caae6d7e13cade293770080117049732d5fc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230495, "uuid": "e50d9cb4-8c05-4eda-a394-911f92968be9", "value": "69F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230495, "uuid": "c173b30d-26e2-4647-b6d1-18d88793d072", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230495, "uuid": "d11beb65-1ce5-42d4-8c94-19eee1fc6741", "value": "3072:7mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:qLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620230495, "uuid": "ef90aa81-d904-411b-8758-3e766d969cb0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620230495, "uuid": "ec6c6b34-0fa7-4c6a-aeef-0067f863ee00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230495, "uuid": "03a403ee-b254-40c0-b6c8-10a9830a4ef9", "value": "1b1087d0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e58a02-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212600, "uuid": "d32ddc6b-2fd0-4f21-b374-b59f7d1c350d", "comment": "Malware payload", "value": "bc738fbb10fefab85ac54a86032bec77", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212600, "uuid": "0c845d19-0198-4300-9851-e3d1a7ff5f9a", "comment": "Malware payload", "value": "1e57a4c915b34eb28a512193f9714ec484bade68e2dc59971ff7efea9ae3fc0e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212600, "uuid": "267522bb-5088-4ddb-918d-79eb7e0f2b4e", "comment": "Malware payload", "value": "09444830f4fc5e6651c0157892418b1c77704094", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212600, "uuid": "12560469-c490-4a08-8f19-5aa51e938503", "comment": "Malware payload", "value": "2bab36968a0e7e6379b5c4740ddf80231eb116290b4e8500c651407b88bee844323a5af8fcdb08046612b7ad943b1bab", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212600, "uuid": "b4b2a5b2-9693-4f86-8f95-0374f8a54efe", "value": "6A947D20E701C07AE4E042FED5A78BB2BA685F306F9844E3C7E176DD16B51F26A3154B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212600, "uuid": "1d317afc-0857-48dc-8461-ce416b417969", "value": "bbbaf1c2eb723302fbbb7808c45c4bc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212600, "uuid": "891f982a-e6c0-4820-bdaa-8b3c2c2904da", "value": "1536:NZ/fgEAqJlV+n1EgGHo7P1YPx28VcyonSsBBEh8TA:N1gEZl0nt/P1YPxtonJEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212600, "uuid": "53fbebbd-28c1-4f95-8ebb-4514d331213c", "value": 442530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212600, "uuid": "478fba2d-6fa8-43a5-94d5-c95b652cdf75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212600, "uuid": "a5bb815b-66b1-40ce-b4b0-ca29b7ad3669", "value": "bc738fbb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d61c68b4-adaa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620223481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223481, "uuid": "e1aed10c-8455-4754-a560-f27bc2135bc4", "comment": "Malware payload (Dridex)", "value": "c1bfdbbbf593b8ab5ead5d7bb1ce81e9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223481, "uuid": "4d827211-b1af-406a-9224-1552171fb79e", "comment": "Malware payload (Dridex)", "value": "1eac277a79e4d25e2f8eb3a659f232e5acf1b368e257243e13663b78405c24af", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223481, "uuid": "f1d28b44-d5d9-4f5c-91b6-0731959b40ad", "comment": "Malware payload (Dridex)", "value": "f2aa5872446a83399a22d20619fae8fa4cbae8e2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223481, "uuid": "4886175c-0b42-41c3-8658-03900b1c5552", "comment": "Malware payload (Dridex)", "value": "96710e5460e8e3eca341cb46a14e372bbec2068daff89065e75093d4a73d8c5d6f7acc7bc53ef217e619412746d40f17", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223481, "uuid": "ed97adc2-f20d-4fc3-ab4d-dca63f4e1eeb", "value": "C7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223481, "uuid": "34ce9164-8b6c-4bf3-ab24-4ec5113664b6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223481, "uuid": "84b24721-ee9a-4c52-aaca-8bd3d979710b", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620223481, "uuid": "8eb71900-c2e5-4a17-9c6f-73e966cf216d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620223481, "uuid": "cd6d1b4a-f80a-4bc5-9eb5-c95a606331bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223481, "uuid": "b2339966-0642-4652-a2ec-5d96d3f33bea", "value": "c1bfdbbb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d58e9c5-adae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Stop)", "timestamp": 1620224969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224969, "uuid": "ef9a15d4-2773-481d-8ba1-a80c654ae2d4", "comment": "Malware payload (Stop)", "value": "f6f863670b1315ad67df975c14c75c02", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224969, "uuid": "c08549ba-6b47-4551-b487-af660c794261", "comment": "Malware payload (Stop)", "value": "1ed1b4315c2525253918400777d7622581d7f8c161101e918999bd9d8c99be85", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224969, "uuid": "0d276e85-ffd0-4a3f-a3c4-a46487cc3ff4", "comment": "Malware payload (Stop)", "value": "deffd6edb820748afa555652fef3ff27461a61bc", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224969, "uuid": "9737358a-3c98-49de-86f0-a1f7eaf6d9ee", "comment": "Malware payload (Stop)", "value": "151c72ae845a76b3c20feb4159b76350453bf680dd32fddf607875ff3cbe2d82913302d023617557d8d5d59c9594749c", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224969, "uuid": "5d18a531-a63d-4cf9-ba41-b0d4a15cda42", "value": "DD05F131B680C034F5B615F84AB98278A73CBEE25B6450CF63D436EE16346E5AC3169B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224969, "uuid": "3fc17232-d414-48cc-8edb-d74340a848df", "value": "9ab3c560e142af9dc63cb09246cc57b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224969, "uuid": "60404c0d-1f73-48d8-aff8-3dc46ab995b3", "value": "24576:23Yr3/Wjz8X3+f2R8MGcpYvFSioYkrOzfzaN:GGOfErpYtSivrz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620224969, "uuid": "f97366f7-836c-4917-a034-3e7a414e9f4f", "value": 850432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620224969, "uuid": "518083b2-4ebe-4367-b2f2-ca619a2f8b1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224969, "uuid": "8d6f1e1f-cbfc-49f7-8729-c441a61cf27c", "value": "build.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2217027f-adef-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620252814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252814, "uuid": "8e6ade08-8ec4-4cda-84a9-4ff9f59ead76", "comment": "Malware payload (Dridex)", "value": "8a2a415d204c2a755f392129f8cc35ca", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252814, "uuid": "b07d7165-1d54-4e2b-82d6-655ecb9b7073", "comment": "Malware payload (Dridex)", "value": "1ef79d59c54ce91075fe7fe3c0122edeee156452cabd54e448590b9369b94382", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252814, "uuid": "980b93de-6055-4646-89a7-498938d9f345", "comment": "Malware payload (Dridex)", "value": "54dbeaed5f769c69e14863d472b157082c60831d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252814, "uuid": "bb58d282-4760-43b5-8c57-289c2a6dc924", "comment": "Malware payload (Dridex)", "value": "6f1bf6b27b8d7c26748a9431255497b9b9e68021f72d48534a1f21b623399b87d43bf5f7838dd59088f1217d265e7fa9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252814, "uuid": "cbf54b3b-ee43-4fde-9760-e84342bc0899", "value": "44F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252814, "uuid": "a4a037c8-602e-46ca-8baf-af619ad6616f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252814, "uuid": "98dfe70b-6067-4dc3-b515-e5e1b67086aa", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252814, "uuid": "ead6e02b-a043-45c2-8520-5bd7ae06f35a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252814, "uuid": "847239ec-af2e-492d-a56a-38fce4f76b80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252814, "uuid": "7b4c5436-a010-4f68-851a-b1ff37bc8432", "value": "8a2a415d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81582bff-ad95-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620214319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214319, "uuid": "7d59a350-8a51-4e6f-bd19-1409513da98c", "comment": "Malware payload (RedLineStealer)", "value": "a4f61bad23090fdec0a408d6fce7a4aa", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214319, "uuid": "2a67bf7f-ea65-4311-bc0f-2293d21ff04f", "comment": "Malware payload (RedLineStealer)", "value": "1efeb065915f4f4dc1a53837ef5f428b4c73d27fb30086ccb8d792d2f68295a4", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214319, "uuid": "0f67c04e-caa3-47d0-a63f-d4063f81638e", "comment": "Malware payload (RedLineStealer)", "value": "e183b9fda5c7a9e4ddd98d9cf93b5aab4670aae7", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214319, "uuid": "07cc44fd-4297-4bcd-8a7a-86607fda1296", "comment": "Malware payload (RedLineStealer)", "value": "f0ed73198f4ccc19461a7e51499b8580feae667ea61c6b59f3a9cd75b62563203ee77d75352590afd4a35d2ca8152df5", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214319, "uuid": "822a84e7-1ef1-4a3b-80b3-80fc75b89424", "value": "9425CF45B64C8A21E36464F992F3591C03E5ED8171B653C37A04326AFD76EAB9ECF380", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214319, "uuid": "1c714b89-ab06-4828-82a0-04323de66e28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214319, "uuid": "98245bad-e77e-4b74-bff2-a22a6aed392f", "value": "12288:fB+SBSxr1JFSlr7YZ9FwIRWf50VOxo1O8Tykwoqa9XC9OTH+oYMxz1:5+DxRJFkPqlofmVOx18TyWTo9OjZFxx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620214319, "uuid": "de352e2b-9c4a-44c8-9fa6-c7a9db116856", "value": 1018884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620214319, "uuid": "a196111d-58bc-4825-acbe-9c92668a9593", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214319, "uuid": "21c53d69-ffff-4f9d-a17c-9e7b55278f5c", "value": "XORLo47xgeBB82g5D6rM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033141bc-add4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620241166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241166, "uuid": "4a9c4dfd-5b17-4595-af49-00ea24a78754", "comment": "Malware payload (Loki)", "value": "e3d92998a368dc7608e450cab51bd5dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241166, "uuid": "f8a29e91-21bb-46bd-bdfe-646fe370222f", "comment": "Malware payload (Loki)", "value": "1f15f5df64176de149af116d6fe5e21e29d9c3808b3a128eab8119af97655eb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241166, "uuid": "949c6d03-51a1-4195-8e31-193bbe7b5343", "comment": "Malware payload (Loki)", "value": "1e0f5873d0eb3ebc50123b513d1985ea7a61bde6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241166, "uuid": "8cd285b6-3350-45b9-acf5-cb2426ad6825", "comment": "Malware payload (Loki)", "value": "477c28f9a2ae1d61fd2b5008b59e22d958bcf6f88073fd9d94144a783ac95a0d46577d597d09d8d5e5759ba7cc0e9a22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241166, "uuid": "1d45210c-9e15-4734-85ff-586121afcb1b", "value": "00F4123822889B65C92F5B7C28A8C40027F4773E96A3F71E7FD0347B1B7679146227A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241166, "uuid": "76ccd13a-0a7c-47a9-ab87-8bd30fdc2c70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241166, "uuid": "eada382e-4f37-4b0a-a675-3b2998225d7b", "value": "12288:Xmtkfv3e0kPMljk0KW+uq35AxEk/fHngiAPBjpVF5no3xCUOXAzKe2CR:ubVW+7QEoPnuPx3F5oBC1wL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241166, "uuid": "bf05270e-a442-4b5e-82d9-503d04392c15", "value": 725504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241166, "uuid": "d0810852-efad-4bd0-b385-cdff70b6a05d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241166, "uuid": "d8ac6acd-1ddb-4267-88a1-7b7633dad6c2", "value": "e3d92998a368dc7608e450cab51bd5dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "196e72f7-add6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620242062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242062, "uuid": "64e9fcc5-0a59-4675-8fb5-7b9f01418c9d", "comment": "Malware payload", "value": "b8b724de2d7d30f6c5f26925bf74df56", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242062, "uuid": "cd72c7bf-74e4-4be8-9f72-f15e4dea42a9", "comment": "Malware payload", "value": "1f3ef69840d712133612f720b37cc610cb0b5acf190f2a03599cd2c8fa24ef47", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242062, "uuid": "81b50fdc-64dd-4ccf-9342-aae0c6fca717", "comment": "Malware payload", "value": "4c610b7f5503e8c73d2be15ddc6bef64c8e5619a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242062, "uuid": "de729eb3-4459-437d-accb-ea04019cbce0", "comment": "Malware payload", "value": "120883ca677c8a845867445567990157e24c605efa3bf9a7722890ec19515e05aa6fbbc876d99d650fdaabd22487100f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242062, "uuid": "5a6b413d-2bce-4fb7-8e91-508495db5d8a", "value": "7EF3C085DBABE87FC45A35399071DFFB5B388B149640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242062, "uuid": "f53b8244-f1bf-4594-b005-33332dbf2773", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242062, "uuid": "113b8110-fc5a-4a46-bbf0-af8bc5161ff9", "value": "3072:p945bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:r4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242062, "uuid": "2a67e7ab-cf93-4948-b36f-0b85bea33f9b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242062, "uuid": "1a2ff8ba-65d1-47a9-a5ad-2ec3a8337c77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242062, "uuid": "0ade4865-251a-425a-9cd2-aa60003c4a9a", "value": "b8b724de_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22fe5e13-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252386, "uuid": "d9eb43bb-60b6-4f69-a3e6-57c230c42ad3", "comment": "Malware payload", "value": "00c0006c7ee39989bfbbe7abdda30fe8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252386, "uuid": "dafa7d9b-4c1c-4fd5-a019-5486db66b78f", "comment": "Malware payload", "value": "1f401cb7a22060bebd06f5273bb89cf1a5672952651a173dfe6f72dac64c6104", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252386, "uuid": "41038f0d-9b0c-4a6d-b1c0-5d2176a3e38a", "comment": "Malware payload", "value": "d62b60d0b0ad74bc20a7bc1dbe7fceb05295cf4f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252386, "uuid": "5803e058-9e05-4e93-90ec-5b53739d7a70", "comment": "Malware payload", "value": "a479e27e521e8579a3e5c974a333ecd548071c2c070c6e364e26e4ce38e5d808758eca8fd53cb2396e837ac1e0a3e34a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252386, "uuid": "4b5f5e2c-51a0-4e51-a6ad-27e204b5e91b", "value": "38F3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252386, "uuid": "ee309fd8-e44a-4d0f-a0df-6957b3e06fac", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252386, "uuid": "74198fde-2462-4e6e-86d8-2dfdd419a6d0", "value": "3072:qB45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:A4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252386, "uuid": "b82cc5fd-7f8d-4280-89c3-2d7aa20c2406", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252386, "uuid": "324d784c-870c-4c29-bea2-d5ecf55c6dd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252386, "uuid": "88a8cea1-6541-490f-b5ca-20714411b3d2", "value": "00c0006c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e022bd94-adce-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620238960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238960, "uuid": "ffc80800-1334-451d-9d74-b2b1b921e03c", "comment": "Malware payload (AgentTesla)", "value": "b94c5f3f3d0a1e955d1ab59a950cb2e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238960, "uuid": "ff03628f-1442-40e9-953f-4700fa159f7a", "comment": "Malware payload (AgentTesla)", "value": "1f4349a08e548a9dbfc58aecfae2bf5aca9c3a6c765afc641447acf4818bb07f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238960, "uuid": "57640050-4b3c-4a4e-a287-b501fe237de0", "comment": "Malware payload (AgentTesla)", "value": "d92fc04c4b6c7f5c4b92235dc3a4b242f79f6152", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238960, "uuid": "ce50763d-e787-4cf1-a2de-e3fa4722686c", "comment": "Malware payload (AgentTesla)", "value": "3ae4e4dde8b564286eb41fae5a53128787aadf43ba37e46f7e37ecac378e6cf600f40bfff444c6e08c82043a302faa5a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238960, "uuid": "9d0b4fc4-5202-4138-982a-133a9bbbaa2a", "value": "38376BAC751469F0E35B5E7263CF0C0643651270A93BEA0A8F6113FA1A57F173E3998E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238960, "uuid": "a399377a-3d93-43e1-a6f8-3186e059cb88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238960, "uuid": "38e662c8-023d-44b0-a3b4-ea5d9d65d79a", "value": "12288:lBooLLoS60/K7yh0gJMhLxhMHTI2J/CEwrJZ0waEzrTCxEd521XxeG9I:HooLAgiLrLm6JZ0wCeX2pxe6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620238960, "uuid": "c0119e2d-39ef-4561-ba56-dea7c84d427e", "value": 24117248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620238960, "uuid": "52a3bc60-3fc1-40a4-b266-8d4ed4fc0278", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238960, "uuid": "bc9ca4e6-f935-4d2e-a00f-8d79fbfa504e", "value": "PLEASE SEND US YOUR CIF PRICE FOR THE ATTACHED ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5399f43-adb2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620226969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226969, "uuid": "055a7a73-181a-45fe-b680-a2db14b88dba", "comment": "Malware payload (Dridex)", "value": "263b54f9fbed697c8d9753f70338cec0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226969, "uuid": "983f8722-726e-4458-a8a9-c6956d5a299a", "comment": "Malware payload (Dridex)", "value": "1f4ff38cfe97fb6b86ad52aae5ffbace53d25d676230086b18a4db7bef8a178d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226969, "uuid": "f5c575db-f16c-45c8-8ae3-a9df03c76554", "comment": "Malware payload (Dridex)", "value": "8fc61cd20b625da8f63426401c92f5cea0d056f2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226969, "uuid": "2066738b-ec3a-46d6-b805-192620c700e0", "comment": "Malware payload (Dridex)", "value": "010d03b51cedbd20915b72086401a2d52c110cfd5a4841dbbe96a9c7ceb1d1b6de5a67961447b264e822269d6532a4ec", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226969, "uuid": "67d8bb82-44e7-49ea-86de-cd5f901f0ab9", "value": "1FF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226969, "uuid": "43f5d782-4a07-46a3-bf9c-8ab3a833466f", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226969, "uuid": "bfb65d57-3d4f-4e7f-964e-56411365840b", "value": "3072:hlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:hlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620226969, "uuid": "b7f74c58-e528-4bf5-a060-d9de0fee51b2", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620226969, "uuid": "caa1b598-c26c-4d58-b48d-3de1fa879bbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226969, "uuid": "ec34e8ef-3b90-465c-9c03-e42e18957da2", "value": "263b54f9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fefe7dfb-adcd-11eb-abe1-42010a9c0039", "comment": "Malware payload (STRRAT)", "timestamp": 1620238582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238582, "uuid": "8764f8cb-aa3f-47aa-bdef-7505b02ab633", "comment": "Malware payload (STRRAT)", "value": "ea6986be8e1e7979486a225717ac5a90", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238582, "uuid": "5aed8c7f-1615-472d-aa11-453c5915f49c", "comment": "Malware payload (STRRAT)", "value": "1f5a181d3bef582f5a8a4baf4b7e84939a56a6c1030144ed26376b29aab7cd8b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238582, "uuid": "2612c676-c3a4-42b7-b163-b6b36e5fed8c", "comment": "Malware payload (STRRAT)", "value": "a317ba7d9023ddcb3fb669195ad18a84e43a2a5f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238582, "uuid": "a58ae9db-a629-4ecb-833b-23d987bf96f4", "comment": "Malware payload (STRRAT)", "value": "ab92bd45eeb311d81bad402bc3a1170e48aa822b1465d63f8a4a51c3c8c4826ff01bae71753efe536ac43cff208eb7af", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238582, "uuid": "cd30ad9d-75cd-4b24-9b29-38348ffc6679", "value": "D793DF6F3CBBD974D40324326F6A5236AB4D0694DD09A20BA3FF55CA1D34C694B12ACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238582, "uuid": "0bb08a16-882b-4873-9524-0a6b8b947db6", "value": "1536:lw6WTVXU0P4idW+Dr3IdvDbNr+faQap36Jvwt0MSs88ZvjueGCZaGyTc7iWo/XVY:UTVdQ0yd+yqJvwQYZaeGCZvuxHFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620238582, "uuid": "6f89334b-4122-4480-bd3f-b7f69e212cc6", "value": 91595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620238582, "uuid": "f7f6a2e2-28e9-4ea3-97d5-5f6f57e515ec", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238582, "uuid": "652870f3-41c5-47c4-b4a2-9f7b1bf3b2c9", "value": "Signed Contract.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea9cc30-adef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252781, "uuid": "43923292-8a78-4dfd-b2a3-35e863f04e21", "comment": "Malware payload", "value": "bb596da03678fa743dd90ddb20d6f079", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252781, "uuid": "d0d4eec7-a940-41da-89f1-9e63c726eee7", "comment": "Malware payload", "value": "1f86a6eef9c657afc63002a12acf4b249a211d73d01c476e721a98d6825bb332", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252781, "uuid": "4a25eeaf-6a78-4e76-b971-1ece88be4f06", "comment": "Malware payload", "value": "13ce98ba49a5d6c2993d7ba8b685baf46fc07d66", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252781, "uuid": "fde5ab6c-d90c-4ceb-9565-9dc958fede8e", "comment": "Malware payload", "value": "ffd0fbf6991c147faa1348ed7479ef1c87d2a8ce5d39c0a903692461943a223bd9a98f74be37f8199e8a6de447773c59", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252781, "uuid": "f6ac566c-3846-4ad7-9780-c1e8957b48c0", "value": "0FF3D088CBB3E4E6EFB3D37966F85E1B4A1574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252781, "uuid": "4404a698-0b9f-47c7-aec4-1e05ba3a7ea7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252781, "uuid": "6ee4787a-209a-4362-a962-1040984b8168", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252781, "uuid": "4fefec8b-dd03-4de3-b0d6-715d7145bdee", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252781, "uuid": "429f95f4-6b22-4e60-b9f0-7ce473af20c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252781, "uuid": "b7c6d271-f727-42a7-87f5-3482912dfb70", "value": "bb596da0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b846240f-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620212693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212693, "uuid": "1e5fdf67-c63a-44ec-a664-4d7ecac303f1", "comment": "Malware payload (Dridex)", "value": "e4dbb170b7fee50b1df1dde890b7a5ed", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212693, "uuid": "c1193aae-5009-4fa5-81cb-68e78ee83dea", "comment": "Malware payload (Dridex)", "value": "1f8b55cd67686af0001399260008d4d7e46855138dfaf5a1ef54eaf168254bc4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212693, "uuid": "2597beef-1898-4227-8ab6-6fe272b5e7e3", "comment": "Malware payload (Dridex)", "value": "ac4d32af334cc7c9bd586c73c60a81d3e281256d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212693, "uuid": "b0e55e9a-d37e-45d9-b7e5-6d2d384f0938", "comment": "Malware payload (Dridex)", "value": "6a98ef74fcee8912190d7d0d0743cad6c33272c7bab4892d0dcff3c142f3ffbdd05def7018966271bb69ab68ec5f47e0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212693, "uuid": "99cd49aa-f20a-463d-b37b-f7e371b9b82f", "value": "EEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212693, "uuid": "916d9127-003a-4ada-8066-1086b0eb816c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212693, "uuid": "14581057-fbd6-4174-94a5-0343423b499e", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212693, "uuid": "24869bdb-b6f6-4030-bbe3-ed11da0d977b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212693, "uuid": "836011d5-bc9a-4020-8092-6325654384fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212693, "uuid": "451087ec-4240-443c-8f9a-f507914498d3", "value": "e4dbb170_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa3c8243-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208939, "uuid": "05186998-f387-415a-9302-f3be34a17142", "comment": "Malware payload", "value": "5837ccf65a2d7041302c133a3c91c989", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208939, "uuid": "accb8aad-d4c2-4b65-8453-f6e89b6e9895", "comment": "Malware payload", "value": "1f8db497ca9b5e717b840c120443b60cb63696c7b7bdac28da7cbc4ca6baa588", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208939, "uuid": "301f8d40-0cf9-4901-b5d2-44c8b9a2c49e", "comment": "Malware payload", "value": "e948d6199436bb9c29fdbb6643e663ce38317267", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208939, "uuid": "4f98a8eb-2e1a-4cca-b7d5-aa921cd41b14", "comment": "Malware payload", "value": "001f0eb043a58a12d90d107914fddad9611b8e28e2bdcd20934f2123d7bc7ec18cf56a28395c4745888bb3b0db37ddd3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208939, "uuid": "55428d6e-998a-4616-bbab-20bfa1a43b6d", "value": "5ED4E00E70399741ECFA907D529ADAFED5BE868474C30778BF981B4983EC552E22C385", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208939, "uuid": "3129262a-039d-4651-8b2a-a8170e6d7b3e", "value": "dfe36a37a6e816afc85660cb545ad87e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208939, "uuid": "7c130749-a373-4fc4-80bd-1f0e416558cb", "value": "12288:Fa8QrFERt6RtS6mtYH1DqzBJc5BwcpsQqn/51U:sZERt6ndzVOz3nGFqnR1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208939, "uuid": "80de8302-559c-4d6c-b3dd-761a0c4319ab", "value": 635904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208939, "uuid": "0c25fe6c-95d7-4bab-9bc6-69fae79ea6ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208939, "uuid": "d4feaefa-b561-43cb-96fd-27adabbb0348", "value": "5837ccf6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86556b9c-adad-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620224635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224635, "uuid": "54195f0a-e28f-4a7a-b0f4-bedfdf2fb9b5", "comment": "Malware payload", "value": "4e367efef3d333591ab8c3f9691e3e72", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224635, "uuid": "77496eb6-35a4-4f51-a748-a802dfd04918", "comment": "Malware payload", "value": "1fc85978f3b776d0bd7abebdc302641a3da45ba768428134df4acdc622fd5f86", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224635, "uuid": "fe939e4c-20bc-4b74-bf74-8d6e912943ff", "comment": "Malware payload", "value": "687ddc9a262d872a5d386ac9ee04a260304a255a", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224635, "uuid": "77fefb80-9626-42c1-be10-fa99755276d5", "comment": "Malware payload", "value": "09eb190c128c26ee58dbddaac99a371a0de07073ac2ba87dd2ea73eff27460a12bc164b13658b202afb014fbfc964f22", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224635, "uuid": "0080c60c-084b-47dd-b574-7f6dcd770b1d", "value": "7D05023E7108AE10C57E1F3BC874E56096BEED17A513D22E6AE0367E99B7FE50410623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224635, "uuid": "3d64e489-e9ab-41e8-8498-a58459bb9953", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224635, "uuid": "123f3b5a-7fe2-46ce-9258-c757dad24236", "value": "24576:rqcO9/44BQqt8JzHmYMNcVaDC+i8xwK8BkPt:rqciDJeCRbai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620224635, "uuid": "64b017bc-8ceb-4eef-b157-3e99bf29934e", "value": 827392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620224635, "uuid": "7cf89e60-5623-4ddb-9753-7f516855998e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224635, "uuid": "7b2ade99-f219-482e-97e7-9f3cdb5c39b8", "value": "DHL_May 2021 at 7.00_9BZ590_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "035dec4b-ad92-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212819, "uuid": "971e991e-2c94-4d06-b675-aefb756b3f8f", "comment": "Malware payload", "value": "ce41817bddaf26b6fb165fb9b7ee2fb8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212819, "uuid": "c86e1b8b-0aa0-4e84-a029-c98bcd9fe6f4", "comment": "Malware payload", "value": "1fe21db20056df5650ebf0a4eb4cbc375a546d3abfab1536cfb90afc692d00cf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212819, "uuid": "19319d88-882f-443d-8e5c-fe82a055ba6e", "comment": "Malware payload", "value": "99917714610f01559faf649a0b9f6a02da885f72", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212819, "uuid": "90fac806-d98b-4b18-a6bb-27bbb2b2e590", "comment": "Malware payload", "value": "0a6ddccbf05539bc0bb17b832d76284259b21118d65e19b1a17d63bd4bcc1d59def16bd3c3e7ce8d1c73178fb60e5e7c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212819, "uuid": "1df25298-f587-4ea3-a173-f20541b39797", "value": "05F4AEF2B8B6191CD0EA49BDCF677E534C85B2CDE97B5824687303492E0CFBB5119898", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212819, "uuid": "0ebcc197-8baf-4b33-8e87-84d9fdd59087", "value": "5349b745f8796307f359f9c409828568", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212819, "uuid": "e73aa2f0-1ba4-44de-9c9f-34e868a6e25f", "value": "12288:9hvwhU14LPiIvb372VroA/aSGgBuER9KgEBPTaIvFnmOBqYv/ZmB6NKL34/gE6u3:9hwhU147RjiVroA/+GH6gEBPTaIvFnmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212819, "uuid": "60cf0874-97d8-4c42-ba5b-e8a1b61041d2", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212819, "uuid": "917fbe8e-020a-4115-9190-72d0adf339cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212819, "uuid": "173f3d16-4b16-443e-9ff8-b2afaf4fa026", "value": "ce41817b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61126ab2-ad81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205675, "uuid": "83576aaa-25e7-48e1-85bd-a671afed0ab9", "comment": "Malware payload", "value": "b2793bcdc304a97b655369ee611da4ce", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205675, "uuid": "1ca63c96-0a20-44c7-8b25-913b84496079", "comment": "Malware payload", "value": "2010dfaf7b4736b0c60265875c8a1ac0595f9929a325d25093424e9c698bcb58", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205675, "uuid": "e4afe164-a277-4122-a00f-871c41c0df18", "comment": "Malware payload", "value": "4e4a734ba7e12f0cb321bb6666534ec7d5ceeecb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205675, "uuid": "31b4a308-11d2-4784-acc8-9c48a7d492a2", "comment": "Malware payload", "value": "a485ce4261a4684e0f6ff7b1af82f2ca93fe245d65a7466675cb139f10d4bdce2c8a0efcfc833802e2a277b44ded8633", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205675, "uuid": "6f583796-5460-4ae1-a842-c29ce3d0114a", "value": "DCF4BE296E498924D38E72353E99F5E4F1F5D6E6D0BB7B0A3060DE46AB572DCC43CA00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205675, "uuid": "17bfff38-9cfc-4558-8462-24e5e414bf2e", "value": "7aabfe35802e11927d115a55c4cf289e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205675, "uuid": "043f8c32-8c01-4f1b-a79e-c1d0e3cc01ab", "value": "12288:roq3cmyxDBYEQTF/cR3La6HXgyTRHpZEUjqTm:Hfyxlt+F+BQyTRjwTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205675, "uuid": "efc8e1e5-3c0a-4fa9-813f-8510ee6f1ced", "value": 770560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205675, "uuid": "0f470ffe-6213-42d3-ac4a-df297d6573b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205675, "uuid": "233e3809-b8cf-4083-a537-1d92aef4e279", "value": "b2793bcd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb234dea-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620242011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242011, "uuid": "5fe99318-a531-4803-bec9-ee442a614dcb", "comment": "Malware payload", "value": "6b74523705c5d486eba012c47ca69d9d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242011, "uuid": "a10ae115-b0fc-418c-9b4d-380bfb2ca72d", "comment": "Malware payload", "value": "201c306a9b9a20f5fbe49eadd46959a0bd1f1d16258a5c7e6813abfc41a48c60", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242011, "uuid": "1d91435c-eac1-4d94-9c8f-0b6209a37dfe", "comment": "Malware payload", "value": "248b50871d6efcdbda9e2ffc726ef80f8f0e2829", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242011, "uuid": "44ee5d0f-7313-4766-be93-0c1a21ba2d57", "comment": "Malware payload", "value": "e3647b99bf66796e865c6945f704eb144818638227409b194abfc829a47c61293a41a134f8f0a71739f3211f255c670b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242011, "uuid": "072a1b9a-bb1a-4e96-b581-f3247c0e857d", "value": "49F3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242011, "uuid": "93c26072-e383-4899-ae15-905a0b347b91", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242011, "uuid": "03c05ec8-4aca-47c3-af10-134272174fd6", "value": "3072:Ui45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:x4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242011, "uuid": "b7d2ed5f-540f-4e58-9a92-3e55a9bcc981", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242011, "uuid": "03382d89-40d5-48fa-b258-37492e1f6712", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242011, "uuid": "feaf386c-176a-49f2-a83d-c73dd222868c", "value": "6b745237_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff8a662-ad9c-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620217297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217297, "uuid": "9f28f67b-ffa7-46ef-ac28-5a73b085634c", "comment": "Malware payload (IcedID)", "value": "f2802408d46abe4dfd91855961aeea1a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217297, "uuid": "1f9f4ba2-050f-43c2-bc74-aecd1c2e2b96", "comment": "Malware payload (IcedID)", "value": "208697cb7cb04b2a6e4bfa49606d50956c2131901f83ffa4b21240352a662ea3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217297, "uuid": "5c6d6922-50ac-498c-9f58-136330664cf2", "comment": "Malware payload (IcedID)", "value": "552d4f910aef793bda3629c1677e68e48105b060", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217297, "uuid": "7e63c92d-b4c7-4bf2-9cd3-b44c49f611e4", "comment": "Malware payload (IcedID)", "value": "52ea4d0f84027d7841ce6664edef68757df8a128716d22c367165e0319ed861d7b46b0526bdbabeeba5c72092d5136b6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217297, "uuid": "f2ff4f3d-914d-4a58-af56-996d34a464db", "value": "AE833731AB699BD0DCCA7D375205CAB1D7324F80474377EBBE6C760D2B68991482522F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217297, "uuid": "528d9fac-7f79-43ba-9697-0627dce1b438", "value": "1536:n0vdhd1bTDkNnhipFnY5IE2vYjsRL2Slb:nedh73DMInY54vYjsRqKb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620217297, "uuid": "60fe2eb1-7caa-4d5b-84c8-d5638ef267cd", "value": 81503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620217297, "uuid": "78fb0c7d-47a2-4b1d-93af-d085645327c1", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217297, "uuid": "df080e33-370c-486a-b1f3-f5919a017d6b", "value": "prescribe -05.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cbc653b-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252376, "uuid": "9f52c33c-7837-482a-a420-b046c5504ebf", "comment": "Malware payload", "value": "784347257be1722571d3f81bbca96457", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252376, "uuid": "a641ad28-18a0-42b1-9e04-a9d2be842ba5", "comment": "Malware payload", "value": "208a4af2bf740a688b34fa43a5687829dac242dffab6413fa7a3fbc1dd180bb0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252376, "uuid": "9f0cd835-9b8a-405d-93fe-614212f018e2", "comment": "Malware payload", "value": "0a6d873b842fbb9919d9844e86bf02ada87ae13c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252376, "uuid": "74087207-1c52-4728-a68d-14c3840b0802", "comment": "Malware payload", "value": "1387d5053e25907217021ffc508cb49b2c6465a1300e82b8df4e18d29c5bcb916f60fee6e2f9ef440be997ed219c428a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252376, "uuid": "11c0316a-4445-4e73-92d3-e7f12e946752", "value": "79F3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252376, "uuid": "fb409fd8-56fe-474b-837a-0153c69fb1d8", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252376, "uuid": "c51472b4-94f6-4122-a2de-99a15f879430", "value": "3072:q84Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:WDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252376, "uuid": "2b989421-bcc3-42da-9bb8-e2135e39de9e", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252376, "uuid": "60a5701d-cf32-45bd-8e77-e52f60dcc34a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252376, "uuid": "1d5add18-043f-498e-95a9-c1e203ced652", "value": "78434725_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a17bf388-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201918, "uuid": "99b406dc-5c6d-4f54-ac66-e791a57dbef6", "comment": "Malware payload", "value": "b8fc5474163c85dfe0aaeee320459100", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201918, "uuid": "1c7ded05-86ac-4c1d-964f-cc1f213cc0d9", "comment": "Malware payload", "value": "20c1f2c87396f3f2f839e0da61742daac245b80b80af94da1db36b50b07d27cb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201918, "uuid": "bc2d1f49-4cfd-4d14-825f-5e2e5b7958e9", "comment": "Malware payload", "value": "75ab505d7d07619989e4008ec955160806b57d35", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201918, "uuid": "97be69c0-55fe-4076-a5d7-57bc4495e297", "comment": "Malware payload", "value": "f9138261f5a5e7fad8bbc591207df703dce242271be0da080f38881d66637ad0a820a264b247f6497a1301817ec79acf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201918, "uuid": "1ae5c0c6-1690-4137-b685-8486653be055", "value": "2ED4ADA2BCB30B1DF24043326E450BD2E266B772D637D02C95477265B64EE2362B6F47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201918, "uuid": "67eb1ead-37ad-4f85-915d-9b8f4a634289", "value": "615d736f15e9c4ae83d21df872e9948a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201918, "uuid": "4257f4bd-bf37-470c-8fe4-99ceab1b6d80", "value": "12288:QfJhxVOpIZskqh9bEhbajb29PcE6oEuf9X08Frz1JEcosUFTan9A0Tm:QbOAIEhbajbC65uf9X0kX73A0Tm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201918, "uuid": "c3aad66b-7297-4d24-8383-a64b591fcd1d", "value": 640512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201918, "uuid": "bda3936d-1956-4bcf-968a-945d4b562dda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201918, "uuid": "99bf8e98-8c24-4976-9059-79ec83073029", "value": "b8fc5474_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2805047d-adbb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620230490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230490, "uuid": "a4043995-71ea-41d3-aa7b-6a41f5c17d0d", "comment": "Malware payload (Dridex)", "value": "02a58998301bc272f4d2f185e6a190fd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230490, "uuid": "1cc154f3-c0eb-4cee-8999-dd4e8e22d38c", "comment": "Malware payload (Dridex)", "value": "20d8b98ffa411781678c0bef26f5f84e44cdc54ce3a40894727777c1558005d1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230490, "uuid": "7ccac66c-ad07-4dd8-a8c4-a49664c0c8e7", "comment": "Malware payload (Dridex)", "value": "f0671b8288c9e537e5e08f22e3515815e7c78e20", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230490, "uuid": "9a6e02d0-68ce-4ff7-8b54-c43afef29f20", "comment": "Malware payload (Dridex)", "value": "c91a25e321fd8489fcb202b47a97e282b5470d280607458204693b3016dada7e76203fc333e78643d8d150b5fd8c9c81", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230490, "uuid": "0ba134fc-da6e-4142-9485-57385aa4946f", "value": "2CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230490, "uuid": "4b0aeca4-fc90-45b8-9e94-84a48b915af6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230490, "uuid": "e576ec28-4dc0-499b-92a1-542dcd9958f3", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620230490, "uuid": "9d10ef84-4de3-456c-9c82-9093c48dc3a8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620230490, "uuid": "f2f315b7-bad0-4877-a7a1-69aeb762c76f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230490, "uuid": "2915e899-3853-441c-8ac2-cc03c61786da", "value": "02a58998_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13945da5-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241623, "uuid": "8171ebf5-6e3e-4270-806c-c30f393e12a0", "comment": "Malware payload", "value": "fd68812de14910b333ce7db76f7d3f0b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241623, "uuid": "454183d8-f941-408c-9ad5-33f7b3a05106", "comment": "Malware payload", "value": "20f0751c81bbe0be560c6eb1c410ae053f707ab17647c17209f027dcb82a883a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241623, "uuid": "6ca85310-4489-4e9a-b39e-1982c27ecceb", "comment": "Malware payload", "value": "1c448e075d18251eda7098c607a7d5324543140c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241623, "uuid": "451d5f48-7536-40d6-8a76-6b7bffdb9974", "comment": "Malware payload", "value": "e0aced8d46841a4018f19490940ff3748ec007255535a935f6c173a3ea0bac76560a7367c2c0c1ea43cd347dae20f6e0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241623, "uuid": "5412d5c8-de1c-4eb8-a4b3-546b52eb9183", "value": "80F3C085DBABE87FC45A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241623, "uuid": "c96954e1-7b8e-4e3f-9016-740394d961e2", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241623, "uuid": "e55d76df-2e37-4b12-a5b1-c4a3b4bfaace", "value": "3072:Dy45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:24KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241623, "uuid": "a05731c6-21f1-4eaa-8bee-7d5ae5081836", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241623, "uuid": "1f37abac-28b2-47c7-9a9d-5f373c422afe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241623, "uuid": "209389e3-dc37-4e7c-adb9-7d0dcbb45a35", "value": "fd68812d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04b97f1-adb2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620226934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226934, "uuid": "0ca0b0a7-fc0e-4320-b6d0-a5fa69f14362", "comment": "Malware payload (Formbook)", "value": "92dd951a685151d1f6643d09d0862789", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226934, "uuid": "ed22684e-cc88-45b9-8875-294004b7d173", "comment": "Malware payload (Formbook)", "value": "20fadf5fe385b80b6178b2e553bdb5b1bf8f7cc57140ab36cbd7c34099993e98", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226934, "uuid": "3024d126-dccf-440e-aa16-4e95f98b6399", "comment": "Malware payload (Formbook)", "value": "b88132b7c92de28922b38f358c1cd97e3a099f8a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226934, "uuid": "3b5bd76a-00a5-445d-8db7-a0dd5c34e39f", "comment": "Malware payload (Formbook)", "value": "fbf260a51b426b6fd7af77b36b35039183b97f50cf786205ff953205999b5614a2bcb15ec265a66538c324ff6e40814e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226934, "uuid": "25e3c6ee-c0b8-4dca-b8a7-35ce746897bd", "value": "05E423E41BFE2373FD578858AD42A13956868203744C0293A2529E129FD4FFB893D7DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226934, "uuid": "8298c959-1593-4247-a731-3bf4c51cafd7", "value": "12288:Le3Ge3PNhFTgKwDWjMtcgXccXKUfm02b55vxnqiafYm:iWe36K4PvccXvmV5tmYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620226934, "uuid": "225bbf16-9c54-40d7-adc7-5696f0073559", "value": 696822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620226934, "uuid": "8ae64906-652b-4851-aacb-e37dc72f2387", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226934, "uuid": "8045ac79-faeb-4315-90c2-6a66d5301f59", "value": "92dd951a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ace143-ad80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205490, "uuid": "85875cdb-e80c-450b-b885-a3f669d2247e", "comment": "Malware payload", "value": "3def8bf892343d8ebdd9358b0fe3c7ff", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205490, "uuid": "7df6432c-f429-4326-a097-51a4533407ca", "comment": "Malware payload", "value": "2109fa71b6cb894611ef5d30ce2aac8144eeeca21da28d56ddddca6d79a7561a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205490, "uuid": "171c5206-ffb4-49db-bd8b-d59bda2aeb61", "comment": "Malware payload", "value": "71b2c445ff8a5838e7eff991a7726eacfd306c84", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205490, "uuid": "56ddd2e0-97bc-4809-b38d-2b6aae64025d", "comment": "Malware payload", "value": "7c46d6e009be06dc7c58b70cf3441f8d352f8c493c2d37fbe9710cb810156a29abc0dccd4ebc8a97710f32d5ef99744b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205490, "uuid": "4356bec6-6da0-4dba-9423-a208fa7729ce", "value": "46F4F133E8B8473EDAF5B93837174A15543EC888F82DAE110B94E60D341F276E25E85B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205490, "uuid": "4720fabf-6ee1-4bf4-8093-ad3585837bd4", "value": "094698d88a36df7bdd7b30cb3f68ff2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205490, "uuid": "a1cb440b-48c4-40fd-b81b-49b89a25b5fc", "value": "12288:rUARk2LBJxGspE56gclULss7CIzcSoR+psQxXhxP9QiNoX338+3+O7:r7O2LBJxGqXF+oSoRQsQxXhxVQfn38+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205490, "uuid": "d1baea23-7173-4e60-9c76-d9bb172e72fd", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205490, "uuid": "b8a13ddd-684a-4545-b64c-3f9f4969d254", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205490, "uuid": "c1dde1f4-7bbc-44ef-99b8-d7553a10ada2", "value": "3def8bf8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "309f7239-ad81-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620205594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205594, "uuid": "583003ee-b3ef-41d4-a91b-106c3df2b1c1", "comment": "Malware payload (Dridex)", "value": "adb12be5be595f2c2bbc895d39f56ef3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205594, "uuid": "94d71a00-000b-4afe-9ab4-ce2ef9e67339", "comment": "Malware payload (Dridex)", "value": "211586edf9a14628133b19424824d8f3fda7cbfd172abcb09732d68e549ff682", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205594, "uuid": "06b80a27-bf31-4edd-9187-afda30676203", "comment": "Malware payload (Dridex)", "value": "f85cfc89ecaeece29d2fc4d9a1ad48a3b94fb50c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205594, "uuid": "b60b5de9-4b89-413d-b9d5-3ee37a70b2a0", "comment": "Malware payload (Dridex)", "value": "39d3a7cabf02bf089fbcfd2cf50213bc378873d42dd35190d2a066c54cb73b942970c4fc589330fe98b89c59d6c22c53", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205594, "uuid": "98bb8d7a-f073-403e-8595-5011d964ea7c", "value": "6AF3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205594, "uuid": "96d2919a-2c7b-4124-9759-d58e49637fb7", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205594, "uuid": "51a9f0ae-374d-4c3a-847b-b8ade046c85c", "value": "3072:zWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:z42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205594, "uuid": "6c4ecff6-5767-4f1f-9ab6-343468f20796", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205594, "uuid": "832c79b3-571f-4513-b3d5-7c689b15bdb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205594, "uuid": "446e4b16-62a3-414c-8102-2e0e14111fbf", "value": "adb12be5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62222388-ad95-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620214267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214267, "uuid": "166f4fde-579b-4c8b-9a4f-36bee3ce4170", "comment": "Malware payload (NanoCore)", "value": "c10fec6dd0e174896dfdfa792df52b08", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214267, "uuid": "a0a6c31d-43ee-43b4-94d1-dbb22703002e", "comment": "Malware payload (NanoCore)", "value": "212978afef219790cb55a0faf1a6c1b6740dbe50a0c930a41c7a2b3ba79a3305", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214267, "uuid": "a67cc5cb-8db1-46fc-8638-c5ae2ad44bf7", "comment": "Malware payload (NanoCore)", "value": "caac6e67fbbd70648f5dec351eab9faa3c62da50", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214267, "uuid": "588ded7e-b39d-401e-bd7b-c5ac8b343490", "comment": "Malware payload (NanoCore)", "value": "7d86a1ee6ebb7a80021f78048f078f0e8fa47d8ec64901e28182813b9e465a62e462ade0185cc64ed95990f5a6d5a446", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214267, "uuid": "41fd1e53-fb4e-4a26-930d-896a8228d1a0", "value": "4214CF6577A94A2FE2DE86B9711212129378C2E3D8D3F3DF18D455B68F263E0060B1E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214267, "uuid": "e4b8860f-ff85-4e52-ac0e-7da4ead6f60e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214267, "uuid": "065975c9-9286-42b9-b22f-3efd9617e1cb", "value": "3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIHvZle+FNy3W211XP3NS56fdAm:sLV6Bta6dtJmakIM5WleBHAcdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620214267, "uuid": "983ea2b3-476c-4bb7-ad4e-cb5f39e45a71", "value": 207876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620214267, "uuid": "d338d8fc-520f-4d96-ae28-90dbc02df24c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214267, "uuid": "0d39777d-9e39-4b72-abf3-f0d1cf6d3495", "value": "k20nFvxJ2siW4gl849gk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dac6227-adf6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255786, "uuid": "ebe3f738-3f9f-4391-80bc-01e71c44fa54", "comment": "Malware payload", "value": "eb42007bea72f8e881d1ec80db5337de", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255786, "uuid": "013e6388-04b0-42d1-b5fc-f60fa53ef3f5", "comment": "Malware payload", "value": "21339b2ff9d418007ee22a61738d352757fce30379a3c9824d65f67923f75c4a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255786, "uuid": "e42b17cc-08a7-4c89-9494-4276c3950d4f", "comment": "Malware payload", "value": "94c216c187941140d7dd6cf2c3ed4656ce64c38f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255786, "uuid": "fb626bd6-5e4d-4624-92aa-02c217c88d7f", "comment": "Malware payload", "value": "ab4c01e11961b12928867be61d821b90b28630f19170f99fef02f0bb3c46bb6b5a0e5883da6d416392bf19c35bc41471", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255786, "uuid": "af4cb18a-7f98-4377-809a-f056f556ab38", "value": "83F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255786, "uuid": "d68f6b1a-8f30-496c-913f-412f9a4aa1c9", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255786, "uuid": "4a9eb231-78ab-4d9d-b73e-f3bcf8aeb0e3", "value": "3072:pA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:p3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255786, "uuid": "33751082-f703-47ee-9d82-670531e25140", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255786, "uuid": "13c8b097-3c43-441d-b829-1af868cb4df1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255786, "uuid": "0dbb7ef6-fc20-4902-a4f6-3b2d9758ffcb", "value": "eb42007b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0985128a-ad62-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620192214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192214, "uuid": "27b98904-065f-4b71-bfc8-dc948140131d", "comment": "Malware payload (AgentTesla)", "value": "2a1e1e190417126cf1fe1a8263b27a67", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192214, "uuid": "00e32b7b-808d-485d-b89f-b408857332e0", "comment": "Malware payload (AgentTesla)", "value": "213b80722c8d52212ea30fda42745d0fc58599b2821a1b474a416dec3af15fe6", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192214, "uuid": "4cb150e6-3823-4afb-95fc-6dd21f77560f", "comment": "Malware payload (AgentTesla)", "value": "f300ffee6c817a0d0d8888ca182d9e1f0514bc48", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192214, "uuid": "c82cddbe-9115-4936-b143-9c02286eb697", "comment": "Malware payload (AgentTesla)", "value": "308d8983f07d5e360cfb3635516d7c135ed2abd1522e04d935b8c3969597103ee8e3b2e330b6467952d0a5f2c274d14e", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192214, "uuid": "80f99706-2a32-4600-82c9-ef686c65f136", "value": "46C4333F109102D86C748ED6DE99F60F83AD146B25B9783E216D3FD3871ADA445F8B48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192214, "uuid": "af9071d6-f04c-404e-9f11-1477a7e56d6b", "value": "12288:l9KHj7J/sxaRcs7C5L/rzv+rhesEP7de9PWtcQa4M1e:l+j72Zs7gLH87W7de9PW26M4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620192214, "uuid": "ba985613-0937-409b-b09d-4a00565b62eb", "value": 557513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620192214, "uuid": "9b2e1060-b67e-44fe-9f51-39de1939da4b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192214, "uuid": "88a564f1-adfb-46a6-ab27-f36c76c137de", "value": "New Order 2211,pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29065eec-add6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620242088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242088, "uuid": "d1c7fa93-2e58-4f28-94ba-4fd9c912980a", "comment": "Malware payload", "value": "88bc3f456f4560a554ec03b048244b54", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242088, "uuid": "38707dd3-fae5-43c0-9976-60329e7aa147", "comment": "Malware payload", "value": "2158a6be7d7c6af37e302bcae9448e45e681433d6f969deb43fab9f41424eae2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242088, "uuid": "8233d398-2e9e-41e4-ab20-990d384769ae", "comment": "Malware payload", "value": "933b2e5d15a9639a35f48aca53b9c06f41b29f23", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242088, "uuid": "974eacf3-acd3-44e0-9ced-c84376d25106", "comment": "Malware payload", "value": "2a4fc8305404ebe7e50e5fcb796a026c678ebe6832ff0855442c40beb772bc519776b9dec0eedba57bdafa6cee1ed084", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242088, "uuid": "64b8b40a-25d5-4a9b-9309-b9acd90efd7d", "value": "39F3C085DBABE8BFC44A35399071DFFB5B388B145650C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242088, "uuid": "a50eee12-6956-408e-973a-f2306eff7f59", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242088, "uuid": "b8b1675d-a231-45b0-a5b0-b747784f6129", "value": "3072:vM45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:E4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242088, "uuid": "d9ca8b99-a06e-4828-bbec-ddef6cc40463", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242088, "uuid": "d9652648-35b9-4820-b16a-86a03d545afa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242088, "uuid": "df5414a7-1782-4c79-83f9-bf91ef160eb7", "value": "88bc3f45_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a61eb9-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252501, "uuid": "3f5f52ae-6b7d-481f-ae9b-79ead2001018", "comment": "Malware payload", "value": "c376c80444e2f07cd0d5ccb0275f57b9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252501, "uuid": "b907fe60-e08d-43d1-ad34-8635a1c2a463", "comment": "Malware payload", "value": "215a4c9be22d83479ba7c167310d8ea06463303d5c60430406b17a59d9717fcd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252501, "uuid": "b52679fd-3059-49b6-938c-da69027c852f", "comment": "Malware payload", "value": "e4adf52a1f96eafa94610b1ce906189fe2b6d13b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252501, "uuid": "a2fe9096-d45d-46fb-84a2-7d3f1c59888a", "comment": "Malware payload", "value": "9996251f6330e76c0151f9b76bcc3600c0beb5be2dd9c69630cfdfdff284694d337a7607b1efa8ca3d97f4bb34ade2f7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252501, "uuid": "a57a9205-2c52-4e13-affd-6f994f8b9d66", "value": "B9F3CFE89A9FC097E663583055FF3BB6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252501, "uuid": "4ff8a49f-f55e-4867-b668-b3fdffb28286", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252501, "uuid": "1b9d0524-336d-4af9-83ce-3db3d7f6ebf4", "value": "3072:uf4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:xDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252501, "uuid": "b6e02019-7956-4e99-9873-edf8074e1c2e", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252501, "uuid": "b7b76d24-f7bd-4add-918e-2fda3aa10181", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252501, "uuid": "5467b9a3-ae49-4cf9-8847-bbedd61d6a9a", "value": "c376c804_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c60c141-adcc-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620237745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237745, "uuid": "56434122-dda2-4317-8b7a-0d9e97f18371", "comment": "Malware payload", "value": "a60f00b085daf1454fc229164be49862", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237745, "uuid": "396762ef-dc40-4101-9f6f-37314b1a49b8", "comment": "Malware payload", "value": "21905e3b19ea3c56637b8c5315cbe422c78d7d8fa48ff6358057b305e748cbfb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237745, "uuid": "d87b3af7-2c7d-418a-9e40-5b38081dc1cb", "comment": "Malware payload", "value": "71adf78e05ff5af07d9dd6154c1ea0695a013eb6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237745, "uuid": "cc418b7f-ba54-4ce8-9eb0-96ca3107c39a", "comment": "Malware payload", "value": "b07c665b736b3a6eabc2f28980ef99984c76d0ba1b0e63ba8470b8bd59a048e35c4657964882916b56b033d22a0e8620", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237745, "uuid": "5fc582f2-096f-4c73-8df2-c4469e2a574b", "value": "2E832731AB699BD0DCCA7D374205CAB1E7324F80574377EBBE6C770D2B68991482522B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237745, "uuid": "a0cb58ba-9200-40aa-8c0e-87510a0b5df8", "value": "1536:n0vdhd1bTDkNnhipFnY5IE2vYjsRL2SlX:nedh73DMInY54vYjsRqKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620237745, "uuid": "456e3b63-4a7e-4bdc-9fea-24e5d107e714", "value": 81506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620237745, "uuid": "44e0fcf4-3dd0-4282-8ded-ffdbc6d6c612", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237745, "uuid": "b2dc3e55-cd8e-4758-81b9-aa2dd9b499ba", "value": "a60f00b0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ddc2f0-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620202056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202056, "uuid": "dd393ff2-a92b-403d-936a-a86ca6578d0f", "comment": "Malware payload", "value": "652c1182e7c2aa28c44db4dd12ba398c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202056, "uuid": "a9b2c04a-6a14-499c-ab7d-0bbdf15f48a1", "comment": "Malware payload", "value": "219e4ba0ba1f5379b52731d88487b23ab66a091ce1542c1c5475058e7c04c0fd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202056, "uuid": "90407428-800a-4553-9332-8b164ee8b148", "comment": "Malware payload", "value": "2cdd3b8d92463bcf88c22ad8aa2d98f7d2f6f61d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202056, "uuid": "8156bbc9-daf2-4b31-b5c4-cfe981b156fa", "comment": "Malware payload", "value": "ef79c8da457d4bca4420c6e7f50f80258a4425a40431e3396686ab7b6168adba4517e026bcee295ad916aa55679b8e12", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202056, "uuid": "cf770f03-bf67-4f9b-a1b1-7a1ea4dd32dd", "value": "7825E1329B329D79E2549BB18EAA0B861916C53D94230EED313C5E7C9F54284D78FFC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202056, "uuid": "f216ee7b-b917-4c07-85ea-54e365f5b54a", "value": "341a91ac54a644774e065c699205222b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202056, "uuid": "4aaac1bc-fa13-409d-a7be-050f4cce485f", "value": "24576:yMIW5q+pFYlHWAT8vVVFijQoZBc8goq26gnYyFkPy+Vb:yMIuq+pC8/0jgpoqKn7kPy+Vb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620202056, "uuid": "f2fa55a4-53e3-4444-9161-d3b6cf60d379", "value": 1044480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620202056, "uuid": "d5f219e7-d7b5-455a-95b6-7cde1f395417", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202056, "uuid": "e32d9a5e-7d2d-4a46-9b9d-8c4255fa8584", "value": "652c1182_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2953bff6-ad81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205582, "uuid": "65a7b635-23e4-4807-85e7-72a0e3422100", "comment": "Malware payload", "value": "07966307820b92e112a4468f71864ad7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205582, "uuid": "9d6b6011-4234-477d-9855-e3877ee9da00", "comment": "Malware payload", "value": "220b62cb973e9776c78b72d905c70d2c1b750332e9c988e8027116b109c0042e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205582, "uuid": "65deb8fc-ce36-448b-a476-264256f938b1", "comment": "Malware payload", "value": "4e8107540044340adce77d31aff4b127c16bd125", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205582, "uuid": "bdfe523b-f7fe-4c2d-821a-cdd3c6c845ab", "comment": "Malware payload", "value": "5716722d1fdd96dd330480216b62eab01f19161ad32bbf538aec6cd27da9c765a75b430aef333e597b463e73019150b9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205582, "uuid": "4a15335e-fbd8-464b-8a5b-0426dd45d63a", "value": "ACF4CF1A5F96B351E3BE3D75B938D1AF3F14670FC66A4B4DC34E420E42062E918E09E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205582, "uuid": "ceef9d89-3e17-4c64-ab36-c7bb4fa70538", "value": "8d9c990388ba2bd39698604a815c404c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205582, "uuid": "cfa11764-e12e-49a6-8ee4-92d4a1a1bc50", "value": "12288:Kb/WU7WoxewsphKKAfpHYu7cRp1sk+aCV/UaB9h9yBdPtXIvftN0WQKNJ15GTm:4/W6Woxew1KAfdYuusk/CV/UYduVKNLD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205582, "uuid": "1ae332a7-7ceb-4bf7-b67a-476845b0339e", "value": 768512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205582, "uuid": "83901875-7ad7-4942-967b-eec764be08cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205582, "uuid": "b50b8a5e-bb63-4f48-a69d-52f76c70f2b1", "value": "07966307_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "610ef213-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620212547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212547, "uuid": "13201919-25b0-4972-9cb0-c7ad4d2dcd91", "comment": "Malware payload (Dridex)", "value": "ecda8ad6c6bbdb7e9b2b75ee4c12d320", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212547, "uuid": "f8fcbfb3-8555-4a4d-893e-5789fade077b", "comment": "Malware payload (Dridex)", "value": "22791e0865af5ca9bae4a55cf28b6e963722910d97584451861ed1c2a56a1c6b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212547, "uuid": "16a81b31-e06a-4073-aa30-db066fdeae6b", "comment": "Malware payload (Dridex)", "value": "0e39e581b0b69deab7bf714b157d14dc820ce2e5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212547, "uuid": "c9954a12-a97b-4cad-828d-b9830a4a13c1", "comment": "Malware payload (Dridex)", "value": "6332b92d6cb7c9fb93bd4f2773c3a42a60a6ecb5fe379dade3d8c7337584f16debb0519b9c2a683ad1412f43233df6f4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212547, "uuid": "dcf108c4-4fdc-4050-8e3a-99b1f1b3fb7e", "value": "B7F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212547, "uuid": "214a4fa6-1eae-46e9-b7d4-469348c886b0", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212547, "uuid": "b7808e46-dd23-4d04-83a6-b4503b91c048", "value": "3072:Dlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Dlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212547, "uuid": "1ec6fa67-9fd5-4ffa-81eb-6163f8b20a48", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212547, "uuid": "7ec73bd9-5e17-45a0-8b4b-b42c19f59b0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212547, "uuid": "0c64783e-cd55-49a8-961d-ee842bb8bfb2", "value": "ecda8ad6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f503c9-ad63-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620192656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192656, "uuid": "0de4e33a-0d9b-4f92-bff8-f8bddb5aecf6", "comment": "Malware payload (AgentTesla)", "value": "ced7b763dfb96db8dcfadb3068b988cc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192656, "uuid": "d6b5e00c-72ad-4020-af53-b9654451deb8", "comment": "Malware payload (AgentTesla)", "value": "2285432d7570fcceee10fc35ba0e761fa33f8853a39be5cd62d2eec68b74af55", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192656, "uuid": "4c6d1af5-87a1-4805-811f-089a603f2373", "comment": "Malware payload (AgentTesla)", "value": "3b6fec368aaa35b7ebef4f18e6be291ac15a5d15", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192656, "uuid": "56adbf3f-7ae7-401e-b2e5-892e1ad6714a", "comment": "Malware payload (AgentTesla)", "value": "b0f8606a8637df8d849b00690abcbc88c34678ad91c6bf45a5c0f18d81834b58c03e7b7076ecfe47a6488c1930214a0c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192656, "uuid": "5c5a48c4-52d5-493e-87e0-2df563e486d7", "value": "41C5FCC078EEB2A856BD1D5153D4902EDE5F2A10DDB0578F13081357DEA2A42EEB8F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192656, "uuid": "cf6edbc9-0eef-4a5f-a47e-ec037571f547", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192656, "uuid": "41425df3-2a3b-49dc-a237-04de919028f7", "value": "6144:S9jqSYfw/oNvYGMCpIvzO91SJI+b0znhLeRqeS7Xcd0Vjk5CHMe8iZ4gHfUcA7Cg:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620192656, "uuid": "8461bb88-b5ef-424f-a373-733f8f57ed7a", "value": 2723840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620192656, "uuid": "6dc779ba-b299-4713-ac30-95194124cac7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192656, "uuid": "0ad5dbed-eb81-49d9-9a45-a43925e085db", "value": "DHL_document11022020680908911.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0832c00a-ad79-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620202090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202090, "uuid": "739d194b-33ec-4c4d-9d01-c2bb8e169b74", "comment": "Malware payload", "value": "8f9e8da145c13f326c9ac4e364edc1e9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202090, "uuid": "a664b998-0638-4f1c-adc5-1ed1327bbcf8", "comment": "Malware payload", "value": "228aae793ecb6a0241c75ed406f5e4afd1be8cbbc36af3445bca87f850efc001", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202090, "uuid": "ddbfffa7-a987-4ff1-bb10-f3c2dd77bf40", "comment": "Malware payload", "value": "de9d913ebc15c48e2652008efd237189e24f5728", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202090, "uuid": "abe5acb2-2fce-4837-888e-e3dca4fe3e98", "comment": "Malware payload", "value": "d77d4b71e4512f8ddba69461d4b028fec46efb5452160dc468f7aa7fcb694dfd465bb28ae2bac3c385d2e73bda3e43e0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202090, "uuid": "301d9e11-f9e4-4774-a063-7b84c8727a61", "value": "ABB401FB1F4C647FE68D9E332C5263939271FE0DB4815F54822AC046B2726AE985B0DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202090, "uuid": "39778390-f208-45c0-87de-05a3c7a5348a", "value": "5b411961da95c08956deb7890d909fb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202090, "uuid": "98115271-ae49-4f32-8be9-49e7d287a09f", "value": "12288:vxEvaN0sn3zP0jD+6dquRn7mUayM4D6a69oYdHRLsw4SrZ:vxEi+mr02CX4jV4D6a6d1BZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620202090, "uuid": "3aa2593b-d90c-401f-8468-a9e8d1cdbf40", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620202090, "uuid": "e70e1b86-d5fc-4a41-b87e-9208b7d14781", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202090, "uuid": "097b1ac5-320d-4b63-8dde-76b830392839", "value": "8f9e8da1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d3c19aa-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241720, "uuid": "97e2786a-4365-4825-a606-f6c23fde6682", "comment": "Malware payload", "value": "fbbf9cb8d89a00f57d397a3c76b2536e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241720, "uuid": "667d86ca-d86e-4209-9379-fa1cb9f76e38", "comment": "Malware payload", "value": "229ea7e5f7fcd4188895de6cd44c74c5f12f0f66eae7407ee28d85a52acc7d0c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241720, "uuid": "217308b5-418a-41a0-8178-a134be39d4a4", "comment": "Malware payload", "value": "7a815710ac9c3b0c25fb6ad2adb679bfe4413c67", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241720, "uuid": "123536cd-b1ac-4573-978d-e3933518baef", "comment": "Malware payload", "value": "f015c257999ff95de0651e7327679b8df093afc21958d20213195273e08ea9a12d1cfe362f949bdc04550777c7028101", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241720, "uuid": "8dc17bcc-c6d3-41b2-b31b-cc39d8868ada", "value": "50F3C085DBABE8BFC45A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241720, "uuid": "baedb08a-4594-4b3f-9eb0-42721775e9a3", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241720, "uuid": "15943ddd-847f-4e5e-bd72-65111354119a", "value": "3072:iS45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:D4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241720, "uuid": "34a02893-1ecc-41e5-95b3-defb677555f4", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241720, "uuid": "d212a2af-2973-42a5-8d0f-55652d33c847", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241720, "uuid": "f4432816-a64f-4b14-b042-b1afc518436a", "value": "fbbf9cb8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5864740-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252176, "uuid": "928cdf73-47ee-4e29-9233-d843b521da7e", "comment": "Malware payload", "value": "3567d793ac3641f0303d643252f40903", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252176, "uuid": "17b24679-4e34-44fc-a15d-b1b3fbe1c92e", "comment": "Malware payload", "value": "22bebb47264401b5c6126efeda852050fdab93b4176550b109cd76028cea234e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252176, "uuid": "95b0be85-10b4-48b0-ae3e-c460a138c496", "comment": "Malware payload", "value": "4f14735b461b294cd8423040c5ef72f25c0997b1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252176, "uuid": "88644625-d65b-43de-b870-5dd87bdef7e3", "comment": "Malware payload", "value": "f917f42cac60c3cc569e2aa61a0809865bdae8d6289b9cefe65f9f3b382a0e85e1d40db4fcdfae25f09122b3ffe7ac78", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252176, "uuid": "9b8128e7-30a4-46aa-a23b-45dcd17f6b71", "value": "AEF3C085DBABE87FC44A35399072DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252176, "uuid": "dbf785d8-2ed3-40b7-9bd0-5c950dcdf409", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252176, "uuid": "68dedbef-88c8-4007-a61d-ed4729c7cc0d", "value": "3072:hB45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:L4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252176, "uuid": "d34fecc7-c39e-4ed3-a84d-cb2a2e3df499", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252176, "uuid": "03ae1d1a-2d59-4ac8-b3e1-7e5b94fb4d91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252176, "uuid": "1c02671c-1f31-4f1c-9e56-320de32b1197", "value": "3567d793_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f117cbc4-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252302, "uuid": "6f72d774-9abd-45fc-bd7e-27dece0dbf1d", "comment": "Malware payload", "value": "e2cfcb64eb39b809898eff27c2dd611d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252302, "uuid": "b1db239e-2b89-4165-91ec-3e6741c2d68a", "comment": "Malware payload", "value": "23149a329059466a9bcebc5394429bc8c8476b65c9ab7514aa335ea880e13fe7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252302, "uuid": "e74b3b75-9a52-42e1-910e-449b9d82507f", "comment": "Malware payload", "value": "1ed411b630025b0ff165afeb46f6304764509148", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252302, "uuid": "a24c00c3-9771-46c2-8195-7fa1042c035c", "comment": "Malware payload", "value": "6ea75d9793926ff729a2de59e68feb6afb76e2b69a410b08f24249121a489d288bd724718436a37f3ae1aa390a00e146", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252302, "uuid": "f40659c9-7e09-4be4-bf15-cef33921118d", "value": "D6F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252302, "uuid": "476ed56e-a229-410d-bc71-1d8f2682feca", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252302, "uuid": "5895b4da-7fbd-4d38-9e72-34be2380627a", "value": "3072:Ex45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:S4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252302, "uuid": "45723aae-ee9a-49c5-a7d2-d71f21c39ab2", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252302, "uuid": "b0c4800f-f8c5-459b-ac4f-c077dc4ae435", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252302, "uuid": "c8041c88-d30c-4fab-8ece-18dded831f2a", "value": "e2cfcb64_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f5a997-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241712, "uuid": "88af2e49-a36b-4909-bff3-d24de006e665", "comment": "Malware payload", "value": "e182c31befa9c76ff7901de50e47378b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241712, "uuid": "24257a9f-1da8-4af0-bab8-8ce56885ac89", "comment": "Malware payload", "value": "23294074ea13d104c0f1fb6a6e818b34e857c86fc0df7a66bd7b24704553b786", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241712, "uuid": "d8a389d5-b04a-46e7-8136-e0c0da6a330f", "comment": "Malware payload", "value": "09bd34cb9447cac231a822c40453cf47aae947a9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241712, "uuid": "77be5b7f-c44e-457f-a576-7d90ca881916", "comment": "Malware payload", "value": "8c12fbc68d4cd73b236d2799c018ad67a2ef4271d387e387af7c085f774a6ea77b948d8d7e48c0727021c578f8f67d5e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241712, "uuid": "3ffa5ca2-d810-4e56-9808-babbe36b0cd7", "value": "F1F3C085DBABE87FC44A35399072DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241712, "uuid": "491f7e09-3a44-4d2e-92ec-34ee11fe3c22", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241712, "uuid": "3a12ba06-f9a3-4f59-8dc1-2e5f67953394", "value": "3072:3545bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:p4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241712, "uuid": "9abf85b1-3b8b-4694-b5c1-b4a4b834b90a", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241712, "uuid": "c966d77a-1784-4ae6-b448-48fc84295f7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241712, "uuid": "2f3d8ed0-288d-4809-8a66-ccca9597ed7c", "value": "e182c31b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aff1e7a-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212617, "uuid": "8b2a1ea4-e40c-4e8c-9552-272d74dc3a6d", "comment": "Malware payload", "value": "e92eaa4970b4bca17576a168c82b4f8d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212617, "uuid": "97ce122d-ac13-49cd-95ec-cc73c8377454", "comment": "Malware payload", "value": "238eb2a514043a059146e5fd593ba6b6132848c0cf5c730c1c23bdf9637883d3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212617, "uuid": "34a0c3e3-6607-479b-99c6-066af07fa744", "comment": "Malware payload", "value": "3a049a7aa39f3b7da0c7bbbbb28e7e6816fa4094", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212617, "uuid": "c80dcf46-cc8c-4fc7-af16-5f159814cd44", "comment": "Malware payload", "value": "2c81ad2dc8d8a75339b7ae6326d54b2c029e4a37bae6ed7fbb1afd0accd0ce3091a48b0e689f6af5ccd19c894ce16928", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212617, "uuid": "9ab16a5e-3a8e-401c-9cb0-a9441638d50c", "value": "B3D48C1DF03C5C3ECD5DF9BA0E18AC5A9C0D9B71D2DF837662490C6238A842B672A7D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212617, "uuid": "e8942451-6dad-4e47-a0db-78121e590628", "value": "8e9ec1e551a1ddb94c52b70c7b2b3970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212617, "uuid": "718fa4b2-8edf-488d-baf5-63a702fb63b5", "value": "12288:7kpGNxrMni32iaHNmOt4UfIVSLXbZ2TVaCajvByJ64MiSLrVANDcUgjaKTsUw5PT:ApTiatlPfIVSLXbZ2TVaCajvitMT3VSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212617, "uuid": "01178991-9b51-4aad-9f8a-050cb15d5392", "value": 646656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212617, "uuid": "f05202ee-9e7e-4f24-9806-18858158f540", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212617, "uuid": "a886ff68-8d9a-419e-b6c5-0ccc1e8c88dc", "value": "e92eaa49_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11a18d6-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252222, "uuid": "c6ddfec4-c95a-49c8-8747-1166c8fbec45", "comment": "Malware payload", "value": "d94cd71acc6972631e44644cdc37292d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252222, "uuid": "f4a439db-95ff-4f6a-beb4-eb0ad9e7c498", "comment": "Malware payload", "value": "2396b714f7a79807ee586cd822ecb8002ef4635ed4a9bcd7df4295f983a5faaa", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252222, "uuid": "49d703b6-4cb6-412e-b7a0-8fcea9f5abf3", "comment": "Malware payload", "value": "f8de390d3ff425758be88f4143a1e3419b1d1203", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252222, "uuid": "2e66c355-6b0f-4d71-b7ba-6c88838495f3", "comment": "Malware payload", "value": "490fc6e845eec8ccb406396dd71c77ff2a8b33111481aadb6a8eaa02c8c2bfe611d566a60ae46343546dbf92612f3077", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252222, "uuid": "583694b3-be9a-4428-bf04-c42ca8781c36", "value": "73F3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252222, "uuid": "c7adbfe4-5e71-439a-a960-d44390d75d50", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252222, "uuid": "78274996-ea73-42d7-882d-5e549b62165a", "value": "3072:MB45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:C4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252222, "uuid": "14cb8879-f65b-490a-af99-7af4448e214d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252222, "uuid": "ff9505fe-6fbb-4ce5-8e0e-fa1bb2f122e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252222, "uuid": "4bd4b94b-7c99-419d-9d19-1c38996e8d96", "value": "d94cd71a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02414b08-adce-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620238587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238587, "uuid": "847de298-88a7-497a-a2e2-7f4135330182", "comment": "Malware payload", "value": "f3b5a532ae3d757a2baac3f14be331c7", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238587, "uuid": "4296ac0d-c26f-427c-8b62-230865508ab0", "comment": "Malware payload", "value": "23a732009227514928879e0ad022a05f88df81c2c7c6accbff4b3b50cca03ff8", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238587, "uuid": "b13c077a-97a2-445a-a1ba-6404a97f888e", "comment": "Malware payload", "value": "609a9c8fc3bde1797711968fd03af0ab475b1899", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238587, "uuid": "ef5d4550-1158-40af-9aff-d872c94418bc", "comment": "Malware payload", "value": "e5684a3ab9fa416f7fc23448cfbb7cf0d705ab610c1f777943b1d0053350e1cc679212e55b43be07d45614dd433a3ca0", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238587, "uuid": "0b42aac4-a55d-47bb-843d-e83525e23af2", "value": "B9746B09BD04C8BD252421839D7FF4C6BB7C7903F0BAED6892E1EA58A1252A89D4D40B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238587, "uuid": "26c6f5b9-d439-4d44-9836-282d527adbf9", "value": "24:7+Fj1R2oXTAOgtV/tV/tV/tVIAIPA/juRtHh4u5nY:VoXTC3338ZjN5nY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620238587, "uuid": "72ade7ce-910d-464c-9dd4-f384384ba742", "value": 338022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620238587, "uuid": "73d8abf8-19fe-4f50-b843-daef002ce45b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238587, "uuid": "9045fd9a-bffd-48a6-a541-9cbb35064fdd", "value": "Secretaria de Movilidad..vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddad30fd-adb2-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1620226929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226929, "uuid": "96dbcccb-81ae-435c-b3ed-9298068e2124", "comment": "Malware payload (TrickBot)", "value": "0de5c20eff6c993ab8ee0dd9d2d6f9f1", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226929, "uuid": "70f8af66-f487-4243-b295-3302c91adde8", "comment": "Malware payload (TrickBot)", "value": "241991bef5ce7be4a96b094d109f694114248700a40ae535d5440b242e86e808", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226929, "uuid": "3a4f29d0-43c1-43ad-940c-405f6c330d00", "comment": "Malware payload (TrickBot)", "value": "a1782a3323d625684555af7c4144e2422107dafb", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226929, "uuid": "33fcbc82-e1e1-4aa2-814c-96ae49e25b5d", "comment": "Malware payload (TrickBot)", "value": "9bd0bc3de5ad917aaeb6bba17421e448ece7f678d7da0981ef85afc192819308934c7f37141b7f525eaf0aeb3c8d9968", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226929, "uuid": "554aae41-df10-4fb6-8012-d8c7fdbb4000", "value": "C3E4E002FBE0903BD6B285310FE77B3A57F9A9905B755EC763909B0D48321C16E3636A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226929, "uuid": "fc6cd336-0e00-4003-8921-287aba344fc1", "value": "82d7aabbacaf14bba1c321d3fe1f95b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226929, "uuid": "97a6b642-1fa7-4f3d-8c3d-e1ece245a3d0", "value": "12288:3Y8Id8iWYsKTt3o4iek/WGtMqZtEfl4GnFfTWokO:i8i9n9pd9sMqTaRn1bk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620226929, "uuid": "1ca02156-f690-4aea-912b-6a1147f3f565", "value": 659456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620226929, "uuid": "81035d3c-c6ef-4909-be9a-63a3941bc954", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226929, "uuid": "40947451-06e9-4d93-b116-84ffb1ed96ea", "value": "0de5c20e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7bf7496-adc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234194, "uuid": "2c1e0084-1262-44d6-aa69-8b2e6d3b54d7", "comment": "Malware payload (Dridex)", "value": "fb3d856c42747e23113fdbcb25783994", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234194, "uuid": "3746e09c-2c8a-4e65-97dc-485c6faac76c", "comment": "Malware payload (Dridex)", "value": "24579ccbdca7d7b7ec1c783236ca3bb35ae0ac034d4cd752b993d7424c1092ea", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234194, "uuid": "e9c9ba83-1811-4a26-8174-2ae15653efe2", "comment": "Malware payload (Dridex)", "value": "9ebad7ecd0939dc8606ab432b6a990c58b05dde3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234194, "uuid": "b65ffcc2-e018-4039-b0aa-aac467aa94ee", "comment": "Malware payload (Dridex)", "value": "c1b8004fddf27bdfef57c078474d816c3b3bb8bc5aca1b9ca9925dd074ace4cd11c7ed88ea34cecfaa657440e64ff375", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234194, "uuid": "a32f289e-8721-4e8f-bb16-40d739b3540b", "value": "11F3C085DBABE87FC45A35399472DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234194, "uuid": "c9e3b530-5c78-4319-914b-79295f2bd855", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234194, "uuid": "2e0294f4-1889-4208-ac28-caef2a1b3c35", "value": "3072:gz45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:U4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234194, "uuid": "78073a04-d528-4b92-8e27-ca0b02a96aab", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234194, "uuid": "3d71ac21-7be7-4fe6-b05d-2e35d1926eac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234194, "uuid": "2037291d-06fa-4a9a-a5f7-575e757e30c8", "value": "fb3d856c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1e68f5-ad47-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620180887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180887, "uuid": "06290b71-64ed-4922-afd4-00451953ad67", "comment": "Malware payload", "value": "5cf5b461312eb9c9a94a4a2359e215d9", "object_relation": "md5", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180887, "uuid": "1f31c5e7-63fc-4a50-9342-bc7a5954268a", "comment": "Malware payload", "value": "24d9ff44affea06435829507e8e6cb4b659468aa2af510031ed963caf5a6d77a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180887, "uuid": "65f1aaf9-ba7b-4d50-8bc3-ba7e69b3d03b", "comment": "Malware payload", "value": "fba6169cd4c3be26a9e707c79ea19b42de5f3d3e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180887, "uuid": "00eb7d9a-759f-4abc-b6ae-57f63e3a09ef", "comment": "Malware payload", "value": "d9dee5ae1fba9ca86811fac2140f517adeaf66599d9d3df82d5202e4eacb38ef0dfea0bd2c438a8c3bf87b09cd7c7010", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620180887, "uuid": "178dcf59-6397-423e-8807-9ea5fd36ba1f", "value": "F6E3BD8C8386D8A6D4E3BEF11907B16A864BDD6D10E3E8E576DBFD2C3070692048DB57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620180887, "uuid": "c83308df-f06e-4041-bc09-f33c37b24579", "value": "84245f630674d6573306664292458cd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620180887, "uuid": "f2b04a97-347e-4ef3-98fd-33a3f35cd9fb", "value": "1536:j3icGgKEuISZ+SsxcWRMyEWr4SW55M+3ltHxr1P5zdOjApjVK9eP:NSCcWRMyEWr4SWLM+Ckpj89e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620180887, "uuid": "3a13f7ef-a550-4d35-883c-a3664fd2ebd6", "value": 155136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620180887, "uuid": "0515389f-2791-419b-b275-4ecff2f35b1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620180887, "uuid": "cc535e1b-350e-477d-abc2-db06758357d1", "value": "24d9ff44affea06435829507e8e6cb4b659468aa2af510031ed963caf5a6d77a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa9771d-adae-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1620225269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620225269, "uuid": "88a7776d-de23-456d-bff8-d175dfcb37ac", "comment": "Malware payload (ArkeiStealer)", "value": "422b0d969e07f4153ca2638d90ababa5", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620225269, "uuid": "4795a47f-739e-47ac-a001-b4d4483123fe", "comment": "Malware payload (ArkeiStealer)", "value": "2518104c566d86c2a2876c2c030a1c54f300726d8a15b39e67d10725f7a51110", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620225269, "uuid": "0611b1a2-87b1-4a0d-9aa0-e17b307f6d65", "comment": "Malware payload (ArkeiStealer)", "value": "7170ee4fdf527ecf4e2ae0bbfdfae58d1e767d0b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620225269, "uuid": "4a0382be-4faf-4330-8fcb-a1ad95d2524f", "comment": "Malware payload (ArkeiStealer)", "value": "96685055c7863cc444be47ffd7e4e5262ca173229728a24bb0e7158e80e6b229de8bba9d22f67ca1387c14c5a60af9f0", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620225269, "uuid": "7dfc1615-4ba7-4c4a-9679-927290074f3a", "value": "D4050130BA52C035F9FB25F886BE83BCA52C3D61672150CB92D116ED3634AE5EC31796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620225269, "uuid": "fc938b76-8275-43b6-ba2a-e2eef5e61ab4", "value": "eccd8454bdaea67267cc8192a6bb73fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620225269, "uuid": "1b1b1c8e-2639-4878-9f2a-a8dc325fb3f9", "value": "24576:iVjzhCUHfWq8fHCvbu8jEUU6Yd3SAFDpg7gAlFEt:CWxAbunbRSA9MlFEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620225269, "uuid": "32fcf72f-65b5-49f7-a71b-45757121f664", "value": 838656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620225269, "uuid": "fe9bdf31-292b-4721-a6de-b6e63d9990a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620225269, "uuid": "42cb4ea3-fe9b-4363-a56d-f71772327d4e", "value": "422b0d969e07f4153ca2638d90ababa5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8b8a857-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212721, "uuid": "61d89cd8-cb50-40fe-b267-6395f7d0ed87", "comment": "Malware payload", "value": "54d53677ba52e7f8fab236cfc3f1f1cc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212721, "uuid": "4223d91f-9d2f-4665-ad09-ea412e7cf7a2", "comment": "Malware payload", "value": "2548ca58bc2c214f2e99dfccece31222174dc1346337cf9fe4839fdcfd2e8cc0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212721, "uuid": "fa69e545-8bf4-4af0-a160-a250359138bf", "comment": "Malware payload", "value": "ebf29c523bce3b7a12c05ec091c0b23b14b2356c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212721, "uuid": "b277e05c-5a1b-48b5-9d29-54e4dbfd295f", "comment": "Malware payload", "value": "4dd51a25f76a31c5214f390853078bb36af7c3d04f1b1928eeb95f097020cecedf5f742a6e934b78cc60096e1e5f88d3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212721, "uuid": "e21608ca-da14-4c68-b865-472b4a1c8cf4", "value": "E3650134E6A97F5FE17801FA8594DC0E088A791FDE3309DBF37900AD166BA086D65B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212721, "uuid": "2c8a5e47-d80e-4583-89c0-f357884961e5", "value": "e35b552a892100699f44793825b05291", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212721, "uuid": "ebd11c21-98a1-4c5e-9336-2cb44e834594", "value": "24576:inTGvYRjXCExxG2R0Xw71gy1YVs9Opyz2qLAOMbiDJ:YT5nxxG2574Vs9OpyjcO1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212721, "uuid": "2a149e7d-7501-4002-8ddb-6980e56174be", "value": 1462272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212721, "uuid": "b885fa7f-a24d-43f4-848c-2c5180e349ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212721, "uuid": "3d70e0e5-8570-4aa2-872b-b0b8926fcb14", "value": "54d53677_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702db22a-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241778, "uuid": "8b83b7a0-151e-489d-bc2f-954310f811e1", "comment": "Malware payload", "value": "93ec779040035faa364f7a7775ca23c8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241778, "uuid": "471ef922-4503-4345-afcf-95e2c3651592", "comment": "Malware payload", "value": "254da00d1bafe82dc7a27020746641b5595b485ebab012d02b67f8c1715b2349", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241778, "uuid": "e7ac660a-38a8-41b9-a6ee-6cb48d16189a", "comment": "Malware payload", "value": "285edb673aa9adef6862a044860bc7cec2b3f5de", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241778, "uuid": "32ff32ef-bb25-4b98-a81c-fff94be9a3ec", "comment": "Malware payload", "value": "673f5fcbd8ab09cedfdba79165326dd8157f4ab77547f643dedbda532e0580a95245953cc055ef5372976c29eb6d0877", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241778, "uuid": "26c95312-c884-4f4a-8968-be8b8e771bd2", "value": "78F3C085DBABE8BFC45A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241778, "uuid": "f17924c0-7be6-4ebb-bea1-ef9d9494a575", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241778, "uuid": "65799c2c-b903-443c-86fa-c4bdf8ed0dc5", "value": "3072:7S45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:+4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241778, "uuid": "dc889d33-b193-461b-96c4-6aee6312c813", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241778, "uuid": "4fa12bdb-9d42-4014-b04d-22a6f90628a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241778, "uuid": "c2be5102-9481-4e39-8e20-6279768096ce", "value": "93ec7790_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e016554-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201724, "uuid": "f42ef9ff-1a81-4702-87c9-840ca2ec2e68", "comment": "Malware payload", "value": "0b7521038ca845ed911bcd075638baca", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201724, "uuid": "d90d57f4-9af5-4f4b-aac1-0c763a4df719", "comment": "Malware payload", "value": "257a7b04de629743df0d7c72406abcbf06fe13d727d380ab413a6c79829f0e06", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201724, "uuid": "41c54461-8110-4b82-9143-cfa8bf84ce00", "comment": "Malware payload", "value": "43aea4888b4a30bc3a7a1512b7572d161f187701", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201724, "uuid": "6b5e2f1e-df12-4acb-baf0-cd5974367fd3", "comment": "Malware payload", "value": "d2beac09f8baa83ae678e0a15a32fbbe305171063b7707fc725f5c564f9907d1844999b982ff335cd6365744532e9e80", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201724, "uuid": "1cb6e9b0-27c0-48e7-a835-2f76a56974e5", "value": "0053F8834BDE9CF2F791117108798AB9927B99D4950EBEDFBF90CD150037292E53A10B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201724, "uuid": "26c30c91-d7f5-4589-a544-4da877c807b9", "value": "ba23a556ac1d6444f7f76feafd6c8867", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201724, "uuid": "9fd9b50e-b303-4b2e-9358-0b72360c23ef", "value": "192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwEMY04/CFxyNhoy5t:vbLwOs8AHsc4sMfwhKQLron4/CFsrd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201724, "uuid": "0a11b56f-04c1-4549-afd4-26d11301a83d", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201724, "uuid": "177bd022-7fe0-4c36-9f17-ffc976772653", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201724, "uuid": "f9637786-f49e-4912-8b68-16bb277eb5be", "value": "0b752103_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21061861-adab-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620223606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223606, "uuid": "20c58561-265b-4c15-bca6-1545a6f830ac", "comment": "Malware payload", "value": "36c0e137c7145144dbba9f4f37ddb95d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223606, "uuid": "af3aed46-2e7a-45dd-905d-bc9f3217a27b", "comment": "Malware payload", "value": "257b37819626bdb98d6e10b87bcb823798849699b77d2a7537c9dd4f94c5bb98", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223606, "uuid": "45705135-2bdb-411c-8d25-926824436742", "comment": "Malware payload", "value": "95df2baf0f57249b3af9544e61dedbcbcd587053", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223606, "uuid": "1229d730-9904-49bb-88a1-b3f0941fefcb", "comment": "Malware payload", "value": "599cb9bfb47dbf7c71cc9d149cf1394d2fd41d70122dde7bc4b2897824601624f7bc26124caf2e66b898ee3fe48df4ca", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223606, "uuid": "ba04b5ea-2081-484f-a6ce-7212946998f0", "value": "1045123006889FEBE7BD5478D0415659CBF881867842FBC97DF902E422EFB4137A275A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223606, "uuid": "e6837afb-7a30-4410-b68a-c9dcdc19bff6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223606, "uuid": "c057f3b5-9cd4-4d15-a947-8c98d2cc14af", "value": "24576:uSUpBW8X+hyB2UDYAMPZJ5wDGKTDYM0o7EQe/zjd/+vPSqf1bZ/vzPiR:0SZJG1PY04zjIPSqNbZL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620223606, "uuid": "7190c150-f561-44bb-96e8-2eee7fbc1f22", "value": 1196032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620223606, "uuid": "6591ade3-2323-4c4c-914e-daec9bf5c8bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223606, "uuid": "105a1048-ee6b-420e-a1bd-9dd55978fa71", "value": "36c0e137_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3118ba7b-adbb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620230505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230505, "uuid": "e686f01f-1fcf-4975-b240-e6d0299b9add", "comment": "Malware payload (Dridex)", "value": "eab5b2d75034965f6a676ec9c67ded5c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230505, "uuid": "9c61a38a-79f8-493e-99a9-a16766197c54", "comment": "Malware payload (Dridex)", "value": "25c184dddb86d1b7db580d51be4c663c43ba571963d2f319fb0757ea352e27ad", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230505, "uuid": "ee9ae163-46be-40b7-bd82-18fc54729fca", "comment": "Malware payload (Dridex)", "value": "8021275ec4ee5318e5aff01d1ff8464f8c596b6f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230505, "uuid": "963216ed-1ef4-44e4-a445-b757ef00e4d7", "comment": "Malware payload (Dridex)", "value": "8618b3d29ad028983be96e62b9da3b8ee0f000bf9d153932f0c899137a3622ffc4b5f83a58045c0e85743ff40744fefa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230505, "uuid": "afd4c917-2f5e-4af3-9e00-ec7d6d6f135d", "value": "14F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230505, "uuid": "76236208-96d3-4479-9d33-1e725b0e6e68", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230505, "uuid": "8496b438-f0c2-422e-9108-3bf063936807", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620230505, "uuid": "8a37c72a-2852-4ce7-873d-18b197e90673", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620230505, "uuid": "4183f17b-d4ce-4b2b-a00d-5151e379f176", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230505, "uuid": "e67ce60f-1207-474a-b69b-3379bdaa1f8a", "value": "eab5b2d7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff9659e4-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620202076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202076, "uuid": "feb42dbf-079c-4690-b3ff-730af3072179", "comment": "Malware payload", "value": "97f60722c6ea94329332952464edd85b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202076, "uuid": "f9dee41b-dfe5-4907-b0e4-ad586ab70390", "comment": "Malware payload", "value": "25d9f43c4e3d2584816653f9ca87fdc2b6ea7e6fb9821412b4b26b31c5c6f99d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202076, "uuid": "9269e101-cc7e-4f37-bf6c-77c09255e362", "comment": "Malware payload", "value": "b2f7b67910ec49e6db2374bef1e441d7160ba53c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202076, "uuid": "7d42c184-0cff-4441-b40d-72a09d108a60", "comment": "Malware payload", "value": "bbbe955f825cdb0d4a6423b7242734d2aa5eb10141915f11448cb17e39a9e5439a7cd1942d934145ffa8b5a8d863706e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202076, "uuid": "aefcbe66-240d-4335-8ec4-23a0dfb4c938", "value": "66D49CCB86CD49B3E05431B43FE0C09E770627E4E9D0E76AE8AABE757CA105EB544B04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202076, "uuid": "ea15e308-70d0-456c-a364-46bf8f6bdcc3", "value": "090b8a28618906799d96d15c7e5626b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202076, "uuid": "1f5a0644-7ce3-4b73-bfb7-1d01acc49536", "value": "12288:pCwpP9xWDIC63u5OBbgTgo/FrkmoDcGnC7E7Tm:hp3NC6e5OBbgkUryIGRTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620202076, "uuid": "b1532cb0-7813-4c65-813e-ba7ea9540843", "value": 639488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620202076, "uuid": "95c4ce90-7191-4985-b680-e298f58fca88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202076, "uuid": "8f1574a3-968e-43a8-b77a-0689524c3f89", "value": "97f60722_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d061cc85-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620212734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212734, "uuid": "d86e8a0c-1e8e-47f5-a7ea-30ddf27bd318", "comment": "Malware payload (NanoCore)", "value": "e5d253a0116d84118ad9d2ac8fb045ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212734, "uuid": "4a700ab4-f05b-4eae-8ae6-d7f63da4a246", "comment": "Malware payload (NanoCore)", "value": "25f52cda7fd68071028d4552aa20ce7477c1ae0cfc3f37ab4c2a51dc475df99c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212734, "uuid": "c5f7b54f-75bb-4cc2-a633-e578f76c03b6", "comment": "Malware payload (NanoCore)", "value": "734250172f9064da9c809e75cbea78bb7793ca9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212734, "uuid": "7ee95072-ce50-4377-9554-915025e2b09b", "comment": "Malware payload (NanoCore)", "value": "19fa60abf578b745f086b9bb181575effdea1b3de5be96b549a7f69623dd7f15758eb8fb652b73b71fe6eac7232e1929", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212734, "uuid": "41d12b62-a773-4f6b-8353-b77366d2f93e", "value": "6865A3AC325471EED463CAB9EBD96C14E6207476472F9506822307FD9A4DEA3DF240E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212734, "uuid": "870f6ffb-cf84-4fc5-82a5-5bf50552d8cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212734, "uuid": "28ed9689-bd55-4970-9914-1bfe58becfbe", "value": "24576:ke9eme2emeX5Y0omoLAcEsYA4t+UqmPhbdggM7CkWNpn:PE5p5/r3EUPMn7iH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212734, "uuid": "4593671a-d1c6-4cc8-bbd6-3bd8ba148c27", "value": 1502720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212734, "uuid": "fd92f881-e6ad-4196-957c-ea8833a79db8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212734, "uuid": "5b91aa86-d818-4f88-b2ad-30d032cb047a", "value": "IMG0398736938736BN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9eb7fa-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208973, "uuid": "6cb1ca2a-a0c9-4489-84cc-0c0d078d06af", "comment": "Malware payload", "value": "fcdb1f0c9263ded5602bc45c6d856c21", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208973, "uuid": "b30e49e9-5cbf-4ed9-89e0-a6d17fc1db4d", "comment": "Malware payload", "value": "2601f484c79211d3d38da9782be3657b4e8dc8dda525d051717592fb77a0d217", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208973, "uuid": "0a1de741-abda-4829-8f63-6319c5d88363", "comment": "Malware payload", "value": "fae97b41546b774dff10478263eb4be64b6b096b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208973, "uuid": "d6f62219-a1cd-41f5-a518-9b6b2827b9cc", "comment": "Malware payload", "value": "b22360591aeba45de836bc1f307203ddff00904c6850ab20fc48bed6b311a5bd4a4e09582e9391b0be13b83a94b6c65a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208973, "uuid": "43c996f3-8fee-4c14-869e-c4a9ae39af3a", "value": "7B05331E595367FFF186A0FE45F1609059820F38EA22099B4DDDB12E06CBAC53D872ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208973, "uuid": "2702aa88-3e8d-4d34-bda6-42c997365212", "value": "48d2fd07a874efd2ec47be1996e05533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208973, "uuid": "99bc24d9-f5dc-47d7-97d3-d48e61538d4b", "value": "12288:4B+5sjhoYIPC2k6trwonkW779hLNzT3sDt2mP/1NkdvzJU63dicqy:xsIP66tcdW77hQDMmXAdbXM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208973, "uuid": "2bbc4f9e-8454-4c83-af78-91f6722732b1", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208973, "uuid": "9bc6584c-21f5-4cf9-b626-452ada6a6cb5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208973, "uuid": "c1960707-643d-4ecf-826b-7595e6a797c2", "value": "fcdb1f0c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193c9b80-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252370, "uuid": "a6a9d506-49d4-40da-b3c2-f68bf1c32d40", "comment": "Malware payload", "value": "65f90a98825fdccb159904a648239fc2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252370, "uuid": "428cac29-d8bf-4ece-acaf-713a6ff93e80", "comment": "Malware payload", "value": "2607dee90aaa4462e4e92036a0862b013f02e9e74eb027c9e973006b8735e51f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252370, "uuid": "8f720943-7dad-4816-9380-921f5dc7e023", "comment": "Malware payload", "value": "0ccc61f0f2af7664dd3e2a2b06068118e90b28e6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252370, "uuid": "8192e6f9-e662-478f-b188-f02dbee6365a", "comment": "Malware payload", "value": "57017773cad4f19bff49f920c651c5f990553a3b5e0ded36e2f8c4d962094257ef8568d9ab3dca7012f066284e96a384", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252370, "uuid": "44c4064f-4c3d-46e2-9bb5-bf3f99970e1c", "value": "3CF3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252370, "uuid": "e7defec1-54d1-4897-a4fc-10633cbef336", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252370, "uuid": "a5351ad7-44e9-4e13-9bb0-d4eff6c9c176", "value": "3072:Xd4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:GDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252370, "uuid": "24d95b1d-d2f8-4921-a3ae-634318ee0f44", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252370, "uuid": "f3ceb219-3500-4ef7-9139-8044a4124604", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252370, "uuid": "70ceee53-6b2e-4fc2-ba02-d92e494169d7", "value": "65f90a98_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "296543bb-ad92-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212883, "uuid": "91dd5dea-1082-4277-b533-defe7ddad3de", "comment": "Malware payload", "value": "cfc2042cfba9c9198695f5d8225c1e18", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212883, "uuid": "181466d7-e3d2-43b7-88a9-7f9487d810d6", "comment": "Malware payload", "value": "260d42da5478025970f78fdaabbfc83384795e96412ba5040d128572b691b48f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212883, "uuid": "e3e2c496-e9a1-483f-a977-42e8965d2b5b", "comment": "Malware payload", "value": "6e5ddf8e712a91e162c3d8fdf9dedcced0a1cc46", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212883, "uuid": "6e955e0c-af88-4a1e-9dd7-01edbae904e0", "comment": "Malware payload", "value": "f5100441082c475a6a0e467c452eb02949cc9ae9c2befad8b8a3f7f5ff2794a68df90c9862a7af2f36c29e364b9f594d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212883, "uuid": "b1e421a4-02f1-4cdb-8c46-e082a332ed54", "value": "E475E04792F93022DE7BAFF856BAB5023289017C832F607AF11AE6DD77120FB5125D85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212883, "uuid": "74e3005a-0ad3-4023-b66c-5c76f19afbf1", "value": "360d83621a91670004a2bee810de7f83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212883, "uuid": "8c5fee2e-c71b-4bc1-8081-fb403f70da3d", "value": "49152:McQ0V9XdNzJtoC6ihS2zhrQ/EGGYeDHay23zNrxSRBOWOYxiFQ/2v7H3z:RQ2NNzJtoC6ihS2zhrQ/EGGYeDiZtYj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212883, "uuid": "54e605ba-da82-4a50-90ec-d99e281c1914", "value": 1598464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212883, "uuid": "75740c0f-10e1-416c-a232-20d3a84ce1cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212883, "uuid": "ef2d111e-b6e7-4413-a4d1-8465ffb00871", "value": "cfc2042c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01edc14f-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208951, "uuid": "a1fb2b35-e348-4d19-9467-6c9ec5bfdeb2", "comment": "Malware payload", "value": "fe5bfa40d9105c92f65e176effbf1b97", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208951, "uuid": "43805b98-6141-4fa0-a2f6-d81513ca22ab", "comment": "Malware payload", "value": "261af19bb09ed5d1165dd031a3b6e5fa37edbdead61bd41ad9c6956935b3b72d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208951, "uuid": "abf4aee3-6f25-4b73-b9df-3d859b458f65", "comment": "Malware payload", "value": "3e4d8db9c3ca8fe506597bf0287508d8c520ec18", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208951, "uuid": "02bd53c0-5ba6-4a40-ac7c-f1ac85f0f134", "comment": "Malware payload", "value": "87d5d40ea12876195e6c023bb29f7b0755c18182cf5cdda0f29204dbb86bcc20aebd17d4d3820a8761a29ccc5f1ca2b6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208951, "uuid": "41b3e762-4ffb-449d-8f4f-a5a6c495f081", "value": "0AF4ADA943DAF54BDCB53FB8697AFF8201740ABB96E05398B0A47C3A1CF91F510D4891", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208951, "uuid": "7d4f4506-992a-472b-834d-47deddf74f6b", "value": "fdd668e67acc177084128cb151e831a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208951, "uuid": "65f818ca-aba1-4874-a3f1-8f175f58f9a4", "value": "12288:Jc7t++qFRH1+fx3Z868Wz/53F30cO8zhOZIRj68pPaafElaZqjEqxvPETm:2Yofx3ZiWz/t10yUZAj6GaIv6HETm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208951, "uuid": "9bca6be9-3a44-4c06-b6f5-6a649c0c9a9f", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208951, "uuid": "a56f7145-87fd-4af1-8c69-7237f453b26d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208951, "uuid": "ed4e2cf2-cbdb-470a-930c-50ceea98c99f", "value": "fe5bfa40_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac1f77b-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209154, "uuid": "fd1ac4ee-c60b-470a-80d1-b38d7a1c28f2", "comment": "Malware payload", "value": "d4be065a49641b5d630dbf936127047d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209154, "uuid": "c18a817c-a11a-4381-938c-e0a5d6238385", "comment": "Malware payload", "value": "264056a442bc28aa5164be4a4fba30ee1bcb66a816170cf7b63155accf1ecc27", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209154, "uuid": "bfc5b6ec-81a6-4c79-bbcf-f8d924419f4e", "comment": "Malware payload", "value": "900f472a69108fa513c7a06791e6bc4c8f9df869", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209154, "uuid": "8328b34f-7ebf-42ab-9f3f-1288965279b6", "comment": "Malware payload", "value": "306f8f2ad5cfdcab72f93a5704c61ddc4f712f69699a89438728d5d4e6d64c223b4220b4c394915461132faf3eb87119", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209154, "uuid": "6a8de808-15ee-4b11-b624-ff52518e1551", "value": "64C4D011ACA5C002E5468CF42CA1949D30651BBBDF53C9E3BEB5BF7764D922DEC09B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209154, "uuid": "cf0e11b9-5310-4693-ba33-a905fb497ce9", "value": "113f176b80a0f3808e8d53fc5e256250", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209154, "uuid": "728d2c3d-fdec-4a69-82bc-28a44df6438b", "value": "12288:bejk/hgtSkdfOAnDZDuLsTHDgyzBGavyfIE1mzasw959:CjIYfO0DcLsXxfvqIEyaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209154, "uuid": "b900258d-b278-4542-b6de-dc2e004be788", "value": 596992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209154, "uuid": "59851270-e464-49c0-a1b6-156789743548", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209154, "uuid": "588c278e-982c-4db9-af81-5afc34268c04", "value": "d4be065a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd3340c-ad81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205616, "uuid": "849b4a28-4507-4646-bfd6-fc391220908a", "comment": "Malware payload", "value": "6df6726d1603bce1e386c4520e71e161", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205616, "uuid": "5940a7e3-da50-4d04-a9a9-4de37861649a", "comment": "Malware payload", "value": "264462d42c7efc9ad49bf1cf9a43831d004856ecdf1a0e908d6ea0c647316e89", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205616, "uuid": "37b9addf-0c45-4358-bb9f-50762d77bbbc", "comment": "Malware payload", "value": "8a2ef3bc0bfdfc36c1ad8833026c9e4d1c1cb32d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205616, "uuid": "c47851c8-1a0d-440a-8ba9-84c3b68ce8fb", "comment": "Malware payload", "value": "3d61ffc42a291da0db0a42d9024b29863fd389cd40bbc22acdc67384d2a0a21e57b32f1bc2381f4a1f61e11f46e85dad", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205616, "uuid": "7788f91d-ccd7-4b99-b56e-eed89d482bd4", "value": "28D4F1E8C6DC3390D94A6AF55E50902E9FEF6A638D4B35EA9130D80CCB591E91F1C32D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205616, "uuid": "7dbfeb60-17d1-4838-b5cd-375570c1596f", "value": "abe5ff6e5724b6ace5642b954f31e317", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205616, "uuid": "08f1551b-5d80-45f6-a23d-e24fe5159421", "value": "12288:yd7mZiHEUhua4iJgieGeRD1be7z0Idqbd1olsxCk6RXWUVIh:ypmZp2pgieGedkcNCP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205616, "uuid": "33689ee4-21b0-4924-b489-c54cf6d3adc0", "value": 633344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205616, "uuid": "670998e3-565b-4429-802e-5a3145b72371", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205616, "uuid": "7e9849fd-027d-435c-8d55-99ad5e3a81fa", "value": "6df6726d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "133704b8-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208551, "uuid": "5aa43334-fe41-4454-94a5-e500bd21993f", "comment": "Malware payload", "value": "b73bb299737ee192c47088889f2a8048", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208551, "uuid": "1e995549-90b5-4322-82f0-6b8163401d09", "comment": "Malware payload", "value": "26453dd03341249b93d26d3f257cc650bec70b02a2c2709e648678ef83897db6", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208551, "uuid": "1a762308-5daa-460d-95bf-b7cabaf90b87", "comment": "Malware payload", "value": "679440846cd8bb76aee70b2c351a5fc898b88ce0", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208551, "uuid": "4c17940c-b9c2-47d4-916e-89d5eb50b1ab", "comment": "Malware payload", "value": "7ab04b39319566e933d7e24aa46f1e991583abc56a1762cb808193a28d9d7e57d64b36fed07e1f7e56e53255b508699e", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208551, "uuid": "d3ba3ce5-4f11-4863-a4c9-8ce6cc05fe7e", "value": "3:BjB:FB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208551, "uuid": "4db18023-f2c0-4472-ba8d-9b759acb9c8e", "value": 12, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208551, "uuid": "753270f9-4fa9-4e13-b7b4-445746a126a5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208551, "uuid": "38ec18c5-a0b5-4d14-be13-684965f0eb4f", "value": "26453dd03341249b93d26d3f257cc650bec70b02a2c2709e648678ef83897db6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cabe39d7-addc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620244937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244937, "uuid": "f067e042-72c6-4947-84ad-b38cdf71e795", "comment": "Malware payload (Dridex)", "value": "4385e4ce403243e250cfd329c6ed291d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244937, "uuid": "ee62ac4b-7486-485a-a0be-bf3e4d6d6d03", "comment": "Malware payload (Dridex)", "value": "26599f46cdbd70907bce1c6d087c591e7b02c0a3ec47bab55d346cbdfa7377b4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244937, "uuid": "532bca07-4719-47fa-862f-8d96ce7bca15", "comment": "Malware payload (Dridex)", "value": "2435179c9de36e18e9bcec152df74a7b3efdf4f8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244937, "uuid": "09def1ea-ae2d-47ce-8c85-97f89d1ec0c4", "comment": "Malware payload (Dridex)", "value": "27faa69c8922b99f3c36bc65f9305f00e96c89ac75cec673b607b429c85961cfb81c6339aea98458d618ccc3c0db8939", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244937, "uuid": "14df229f-34a4-4e28-a24c-def5324094f9", "value": "08F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244937, "uuid": "f991a67f-f68f-4479-87a7-85a87500006f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244937, "uuid": "84516beb-89de-4004-9302-07291cec1377", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620244937, "uuid": "75d026d9-6518-44cc-b4d2-aa4f6c778bf2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620244937, "uuid": "ca2ccbf6-5239-4ee5-b8f6-8f7adcd6dfa8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244937, "uuid": "0d82e49c-f657-457b-939e-2907c1099eaa", "value": "4385e4ce_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd24475-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252354, "uuid": "fb7d3f5e-14b5-40cf-8c86-6ceec01d8e63", "comment": "Malware payload", "value": "f2febe970fcdcfa776dc9529b1b11c8c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252354, "uuid": "f3489cd4-a03b-41f8-9efc-d596e568b636", "comment": "Malware payload", "value": "2659b905293bf3a4b6436ec1284bebbc775e9fca32f3af58123ac6fd281f233f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252354, "uuid": "dcddd3fa-8734-449c-8f53-1e44940ea40c", "comment": "Malware payload", "value": "7d91006eb895e74d175bc178f7c0de8378929d16", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252354, "uuid": "5c8c4cf7-dad4-4f36-bf4e-b7bc4ff3062b", "comment": "Malware payload", "value": "a435b85b8f9613134a92fe58ced1aac30a4c96c2f04672a1d06c98095d4e322b9227c79b480981d3e5d94614dd5f4c43", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252354, "uuid": "b5f05bfc-cfa5-4445-859d-7dcca5bedce2", "value": "FDF3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856883", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252354, "uuid": "1df9c3f9-56e0-486c-a3d6-599bc0888e3d", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252354, "uuid": "45228152-85fe-498e-a8b3-0319839d64f0", "value": "3072:rB845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:+4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252354, "uuid": "a53d860c-d17c-444c-8b73-5f0c69b17c8f", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252354, "uuid": "e28a064a-022b-4a8e-a170-9c0c0f52f54b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252354, "uuid": "8a7684bb-3297-432e-9097-3db7ad5a2ec5", "value": "f2febe97_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b12b1171-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241887, "uuid": "31d487af-4566-4670-a28c-bf61a02bfcac", "comment": "Malware payload", "value": "b728875370d33006676aa850c1335fb2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241887, "uuid": "1f70b5f1-065b-49a2-a620-12ca59db4983", "comment": "Malware payload", "value": "265ee9238181910265a69e385ff4209644f52ee5f2aa046682f5554873dd0b67", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241887, "uuid": "f990b1b0-bd04-4108-80c5-ab605e2959d6", "comment": "Malware payload", "value": "06525a672d1db694adc79bff0a820a9759ae37c6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241887, "uuid": "79abc5d8-d725-482f-8a26-93c432af9ee3", "comment": "Malware payload", "value": "88929db40680f68c1291579f14f8e185058496fc6d032e812c1b952e2f6922af4499ede88a9e94c4a118c1e202b5ad61", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241887, "uuid": "d5492dcf-e1d1-4f7f-85c3-833f4334776c", "value": "54F3C085DBABE87FC45A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241887, "uuid": "6503a13f-a47e-4284-80d0-de357430eb5a", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241887, "uuid": "9ec9f5dd-0d13-40e7-a000-9a967906fe0f", "value": "3072:k945bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:G4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241887, "uuid": "8e9b9128-b293-4186-8a61-be1ce5419cbb", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241887, "uuid": "3ab38454-31b8-40d5-83ed-64e409b0de06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241887, "uuid": "303b7aff-e169-4ae3-b07b-fd1516349267", "value": "b7288753_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "653fada4-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209118, "uuid": "f48d413c-6235-49fa-9cd1-1173c3d94aaa", "comment": "Malware payload", "value": "fdd607ed9d043d60a1b5cd17c3d414ff", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209118, "uuid": "dfb99e47-2e39-478f-b826-96a33bd8b34b", "comment": "Malware payload", "value": "267f118e37004b54a50b9ef48911df7d600106f03b4e8f5d3e41cdbc7c0c7395", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209118, "uuid": "c987dd7a-859f-4075-b0d0-569ad70c1e6f", "comment": "Malware payload", "value": "44191ca291bf9d612d78d525bb760bd6d4babb6c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209118, "uuid": "25225252-afda-4ca9-8595-9070b900e056", "comment": "Malware payload", "value": "0eb609b7c3ed95634d7e0ebb703665176eb292a1a9d07ee3e1ee8e67f9ffbb0689bc1054437545303de96c6aad88f4bb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209118, "uuid": "6241e935-06d9-4663-bd2a-68b54e5ac593", "value": "39D4AE5F649336E6C06215737CAF0F6C9598527400AEC1DA7A592FE00B73E260D7AFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209118, "uuid": "fa4f7813-c3ac-4e15-b90b-3608bdb4acb9", "value": "abe6a3858459c327204fa5e111aa051e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209118, "uuid": "13ba90aa-fad8-4169-9c6f-9d73ba626b73", "value": "12288:NCOftKFFyazsUEN/AhvNHh/Mx+UlYmseiSSPh2Tm:NCOf3dFAxM+iPTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209118, "uuid": "514e2b67-d57d-4264-b993-66ba0a6142f2", "value": 640000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209118, "uuid": "ba6588ad-de0f-4893-88d8-a6ab533743af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209118, "uuid": "df22c025-2a73-4855-8bbb-16fa58d9ae0c", "value": "fdd607ed_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1048eeb0-adb4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1620227444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620227444, "uuid": "b1d42a66-658c-4934-8df4-7d88faa2bef7", "comment": "Malware payload (AsyncRAT)", "value": "04d0649b4bfa1dfeae3a8c86453397a3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620227444, "uuid": "7bcb6b3d-faaf-4101-8fa2-44b0a39427e3", "comment": "Malware payload (AsyncRAT)", "value": "26b9ff2aea0f6bb6e98627a46effb1d6f0c72908fc2fa4985a72a4d199ac0870", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620227444, "uuid": "80e50707-33cf-4b57-b568-163e17de2cbe", "comment": "Malware payload (AsyncRAT)", "value": "f47a6585df4bbb264017cacbb11a2d0e88fcea84", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620227444, "uuid": "46de1e37-4eb5-4014-a853-c72d343f9659", "comment": "Malware payload (AsyncRAT)", "value": "5827b26984aa9bdfa0b541ac796b306f2205a8dbc2f16b2d36221590a04bbb9de57d524c1014ca5c42b8b0e3a449e895", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620227444, "uuid": "e6bdaad3-bf92-475d-b9ed-0f9812d5ce37", "value": "B9232C0037E8812BF2BE4F74A9F26145467AF2633603E54D2CC451DB5613FC69A52AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620227444, "uuid": "d89b1b3f-35cc-4c80-9980-c6b0297249f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620227444, "uuid": "79d23839-8fd0-4d2d-b03c-72efaf263fbb", "value": "768:nuyRNTAoZjRWUJs9bmo2qLUcY3xBXVNLPIPzjbAg33i9nMixER7BDZKx:nuyRNTAGo2XceVCP3bn3SdotdKx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620227444, "uuid": "2c896afb-f9e6-4061-ad48-d4881d9ab669", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620227444, "uuid": "dbd5bc09-59c5-4ecb-9b8f-de225a9a9e81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620227444, "uuid": "96eb00e9-b750-492a-b0de-d8fdcce8ebad", "value": "04d0649b4bfa1dfeae3a8c86453397a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811f0638-ad61-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620191985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620191985, "uuid": "33820b07-07bd-4ee1-ad56-89b4c8ad8d13", "comment": "Malware payload (AgentTesla)", "value": "a0368e558bc201b1d6a350d73977c90b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620191985, "uuid": "14f5ee19-6f52-49b9-9fe4-47a07d4659a9", "comment": "Malware payload (AgentTesla)", "value": "26deb225cdafe80b335918792324464ff199bbd5a1ed003359698f0c6179c3b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620191985, "uuid": "1517a708-5d4e-454b-8875-15790052055b", "comment": "Malware payload (AgentTesla)", "value": "5642c449a8f671658b599fde966feb6609db6b12", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620191985, "uuid": "839fe9c9-c9f3-400d-920e-68e86e7bd286", "comment": "Malware payload (AgentTesla)", "value": "8135ff6686fb7e71844f38be3e3bcd1de4bbee9783fbe0df43da4df4502d767aaa6caf44f255493bcf29c438e429ed80", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620191985, "uuid": "918b3be9-642c-402a-9cb0-149ccce920e4", "value": "BBC4231BD49786DFEBE7D46E07412C1CE5DEFC1CAA5A39886D74884632F0BDD2B20189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620191985, "uuid": "1c93a707-ff8d-4ec0-919a-de9f50ad1d54", "value": "12288:XzI0F8ZaYkkZl0dguSQKs1X6j+pMxd/sHChWI42Avzy5j91+ty:sr4+4au4yA++/Gb691+ty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620191985, "uuid": "24c342ef-8d2f-43a8-b597-afbd925e7875", "value": 546807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620191985, "uuid": "483f2318-e828-4a51-aa7b-457f73dc467c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620191985, "uuid": "211994de-fc77-48c7-8a11-4888c958bc2b", "value": "Order Request .pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9b0961-adc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234093, "uuid": "4ed9df03-5873-4874-9380-7c929348cf90", "comment": "Malware payload (Dridex)", "value": "5cce0ea4dad7bb602c13a4a7a55e2cc1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234093, "uuid": "e726ca23-eeb8-4a02-9313-658f05d19f5e", "comment": "Malware payload (Dridex)", "value": "26f8c64ef7f0ccb00f4a341dddc166c978513e622e065b3e6b0f0a2047d037b0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234093, "uuid": "60a0a582-44d6-43a4-b4cc-5694d4957d49", "comment": "Malware payload (Dridex)", "value": "a8f656bcaa70fec970848a2db7008dab3369a56d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234093, "uuid": "13bd5768-a3f1-4439-863b-2e29f3b3e59f", "comment": "Malware payload (Dridex)", "value": "99de1456d5da2f3044d3fe1751b254841f95bea935b9a301c59bb7fe6d8edbba390ba752e350a0b0bcad9300d0b1bea2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234093, "uuid": "3edfda82-9580-40a6-82c5-fcb0e111664a", "value": "B2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234093, "uuid": "d9f8a1ec-4fb7-43e0-8d94-e4463c18b2a1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234093, "uuid": "a254033e-5571-4d04-9ba6-c368c02ab01d", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234093, "uuid": "fa2a8468-f61b-46a7-a1f3-249fffc6639e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234093, "uuid": "fd6ae0cb-e533-4900-b828-c63feb69d75f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234093, "uuid": "8cd05bbd-b2b4-4c2c-81be-d539622d73bb", "value": "5cce0ea4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e0e1e34-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252378, "uuid": "de8fdd00-0468-4175-b869-35a025b7bb04", "comment": "Malware payload", "value": "0aa4311a3fdc345347b27c81e8340979", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252378, "uuid": "89dc841c-b1d7-48bd-93c4-a6e1ad4d9f86", "comment": "Malware payload", "value": "26ff577a7392161a68a58101e88decac37be38e4274c2a25417d0a69478732c4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252378, "uuid": "8869cf34-cb24-4f82-8706-d619ba09ba1f", "comment": "Malware payload", "value": "345145626a1e157fe4a3554c005c9e956b8cbfcd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252378, "uuid": "0a1773e1-cc06-4cc0-82ad-0e615ef2c6df", "comment": "Malware payload", "value": "70fc78c94232420f1eee1bc831cfdaddbc978d461e8cd84ce2e8364545e16261a2201907588f15cc0e3ed5e0fe4a3d4e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252378, "uuid": "1d136fe6-ab94-4ba9-b948-26bb02a51157", "value": "0AF3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252378, "uuid": "83280f7f-1193-49da-8674-6c14f41d7b97", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252378, "uuid": "040c7916-8a6e-45f4-b232-b420274b8726", "value": "3072:XQ45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:A4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252378, "uuid": "94639df0-f0e9-436e-98ea-9a168f2ebc14", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252378, "uuid": "1fa3a670-e018-4af9-9234-fb7384181f05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252378, "uuid": "248c8738-4f62-4bd4-81e9-33bbe7d95b06", "value": "0aa4311a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32edfd09-ad81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205598, "uuid": "cd48f3c0-aee6-4ab9-9dee-f9402d06172b", "comment": "Malware payload", "value": "1366a72888556b3408f42a089a96c836", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205598, "uuid": "b0e431fd-0a3f-48b3-a05c-49727571757c", "comment": "Malware payload", "value": "2730acfa6d41e164c1fe6ba4fb7f9e41b21a5ea42a646652e1d177b2d9f3af5d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205598, "uuid": "bb61dfc0-ee2e-4661-a2c6-1839d26c0b8a", "comment": "Malware payload", "value": "6af7a9d60b7d701e4a526da9bc78df167cc59be8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205598, "uuid": "eb539dbb-f44d-4cdf-b968-63ec0d298a78", "comment": "Malware payload", "value": "bd1db4aa3e66326e2ae53509a650aad2bf57b4c24d5f9f62a4f07de13cda322bb4e99c8c01ee0d324d2d1976ab14ce7a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205598, "uuid": "f9008cb9-b176-4f05-8521-57f8bd61573e", "value": "23D4E003AD7E05C7C2BB18F6F97C3D9FFE65160F4EE86088311D1A785A14167B79A02A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205598, "uuid": "d4c2fb19-76d7-4df8-bc36-63a963295670", "value": "e125afdbc249bf37b99d2cd627e66bc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205598, "uuid": "f72fef94-2955-4d76-a498-04cd2a0dc8be", "value": "12288:jipWPrScmCk1eW7178m/HgGryr5qzvlwQIxlWb+45u2Oh140qU+:j6WP1mVUa4TR5UwQIxAS2m140U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205598, "uuid": "a97df8cc-251f-41b0-9245-655d1b6586dc", "value": 652800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205598, "uuid": "73208c81-62db-4be9-8f16-8a12ede759cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205598, "uuid": "b8f17c2e-4905-4b04-bbda-c20de64a6a1a", "value": "1366a728_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bd66756-ad7f-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuasarRAT)", "timestamp": 1620204807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620204807, "uuid": "2928429f-53cc-4115-9a39-683bc0c18c65", "comment": "Malware payload (QuasarRAT)", "value": "93646434512908cb0f517c0a436d7bbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620204807, "uuid": "762223cf-f062-4cf7-af0c-ffbecae24f09", "comment": "Malware payload (QuasarRAT)", "value": "27b2f105687515dfa6b3850d758d548a3b41601552dc1d5218b420a26463ad12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620204807, "uuid": "46683471-9d91-4abf-926c-4ffd2c164ff8", "comment": "Malware payload (QuasarRAT)", "value": "50b23aee4b20556d756a351dd6ef4d15844851be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620204807, "uuid": "5870a1bf-142f-4c6f-a23d-bfe97f99e2a5", "comment": "Malware payload (QuasarRAT)", "value": "b7ec315d88783b262faec5d11f61c4658876301d77e55b3fc6e14bb6b64b64082297d49a1632a192e14d92534e0f8aee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620204807, "uuid": "9c604069-562d-4b69-befc-34189fb2f205", "value": "96152A6832641BE1F27B5FB663DA1C0183B92574653EE61D8F9113FE0963F032A35A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620204807, "uuid": "3a9c6492-da45-47b6-a4ae-091dd2d8b3a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620204807, "uuid": "68ada3af-da09-417f-8509-a0180b639d9f", "value": "24576:aI6ZS7foLAcH2ia1n+A9gTFMS6akzH/8wPR5Y:aI6ZS7q2n1+KgTaGIHhz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620204807, "uuid": "707cd66f-0cbc-4550-8cda-0648d821c96c", "value": 940544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620204807, "uuid": "5d9d897e-d204-412e-b9fe-4efbee6103c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620204807, "uuid": "b2868a97-5ffc-42fb-a135-497a11f73b18", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "171709d3-ade5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620248501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248501, "uuid": "1f38237d-a00a-47b1-a905-23be6a8368e5", "comment": "Malware payload", "value": "9e1589308fa63b088ebea4e33565847a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248501, "uuid": "2a2f0cb2-2f2c-484a-9c7c-2a993907d398", "comment": "Malware payload", "value": "27ca740aec2890f8f5bc903719967046f6cef1011e33fc93fe150246bae2eeaa", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248501, "uuid": "cf94fd1a-2c7a-4a95-b970-c7d4482d59d0", "comment": "Malware payload", "value": "066e874959c153642b679470ce4b649041963fef", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248501, "uuid": "f34af8e6-fc75-43fa-beaa-f13b820cc74c", "comment": "Malware payload", "value": "b2af29f98078adc94b0e243c17fd4364027f39d9c35d396223242fa99464ca5c094fd61871f349d13dfe3b798f59e06c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248501, "uuid": "e5243b4a-6681-4917-af59-ee644434dec6", "value": "7BF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248501, "uuid": "f3f75fc1-66b3-4286-af80-682cc3a610e5", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248501, "uuid": "634de482-74de-43aa-a03c-32baf3314e4b", "value": "3072:SiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ReAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620248501, "uuid": "1a582df2-cb8e-492e-b852-84387f39786c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620248501, "uuid": "ebcd6076-32d4-4b30-ad3b-2700992b3467", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248501, "uuid": "3810163b-9446-4352-a8ed-85d26c4ffd32", "value": "9e158930_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d59822-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241868, "uuid": "ffb8de0d-3acb-46e8-95a9-54774bdcd9d3", "comment": "Malware payload", "value": "a8de268d3bcd78698e5c80c2258917c0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241868, "uuid": "c32974b8-90b5-4d60-b49e-1d2cde1def99", "comment": "Malware payload", "value": "27d6000a34e9d91752bb5c892fff7388a3ecfaac3766612ce72345d345259719", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241868, "uuid": "be89be27-7993-4f9f-a725-7f2da4be4aca", "comment": "Malware payload", "value": "780b3cb0e575b7795b6f5695d9c5aa1b3ecb2a88", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241868, "uuid": "3e3849c2-2f97-4a0b-8f0e-8e5a295e6e45", "comment": "Malware payload", "value": "417a0c3d9a5012b329d4b25621a970fbf7e16b92df45085091a3f8d7074011f9ff6645b4c0c5ee9c7d808584e39b8a2c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241868, "uuid": "94dfa4a7-aa77-418c-b12b-38fce3271d68", "value": "66F3C085DBABE87FC45A35399071DFFB5B388B145250C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241868, "uuid": "92eff067-b83d-41a5-94a2-5e34a2420514", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241868, "uuid": "2c1cd074-fccc-4fe4-b8f4-5f0a80d50bc4", "value": "3072:oy45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:Z4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241868, "uuid": "8a4e12cf-c056-4f26-ae7d-9a30999e3b06", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241868, "uuid": "042096e5-9982-4a00-9750-67f5fecf7fa3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241868, "uuid": "a5fb9d6c-7091-4e1a-a49a-ee95bca11a75", "value": "a8de268d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae3fa31c-ad99-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620216112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216112, "uuid": "7913cd8a-9d06-472a-8a98-1094d3d0380a", "comment": "Malware payload (Dridex)", "value": "c553a50c92e8418a389d4e5bf89e6d1c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216112, "uuid": "cd7be6c1-e13a-4ca6-8cc8-5bcb2b443978", "comment": "Malware payload (Dridex)", "value": "28320bfe7a9b1b1fe2aded338d94f348c7f881d20ae6dc57d9b9a5504c4a751f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216112, "uuid": "a069e5d0-0a53-4d19-aa3f-aaf54475fe91", "comment": "Malware payload (Dridex)", "value": "6475ad41d8300fdb618d1385bbded2706d8dc05b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216112, "uuid": "a4f2487d-1e40-455c-91ba-ef51feee5a1f", "comment": "Malware payload (Dridex)", "value": "31269c95fa350153c2b979f425e053ee1c3c2399a8422a5be1ede82796022ff776b2c283741d611cecbbfe1f9c103de3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216112, "uuid": "0db63d1e-7ddc-422c-aed2-1f5982f8b105", "value": "87F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA68F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216112, "uuid": "5a9b8912-c21e-4b60-8b53-865eca45495b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216112, "uuid": "38ed5daf-d997-4442-b46e-cf5fa4f3a9ef", "value": "3072:JIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620216112, "uuid": "826a8112-4f7b-4f8e-a550-7dc8543027ff", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620216112, "uuid": "b6e15aac-718a-4c13-8790-5a7ca43a16ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216112, "uuid": "c797b501-9061-414d-9df5-f6fc2b4cabd0", "value": "c553a50c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6e6227-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209214, "uuid": "7f42954d-cdb5-4fa3-8442-a9baf89cea04", "comment": "Malware payload", "value": "d4807de35724ba540ad3f107e7b1d9e5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209214, "uuid": "c12a6d24-ec9e-4bd5-af85-ce4de76042c0", "comment": "Malware payload", "value": "283cb500bc71dae4de74cf6adc1f890528d64e8f46741e4a2afc34fcfcf46970", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209214, "uuid": "af0f0379-8774-4b75-bb98-0b0f793cbf4c", "comment": "Malware payload", "value": "ce417ea68727e983f577f2f2e51b3e8b66927f8f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209214, "uuid": "ac4c2002-198a-422c-9c18-4d2eec627b47", "comment": "Malware payload", "value": "da29de4f95242be6c12f42b91f789163ec71422fa426551193186a96f10effb66deff768af65946742c922566a8664b0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209214, "uuid": "c02b161a-0e59-4a2b-91f0-20cc5e0699cf", "value": "E2F4BFAB6CA226C6F107533A916EE5B3D69B069E239ECC21711427D71B13F37913BC06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209214, "uuid": "cab6765f-2767-4444-8bf8-ea4601f80cfd", "value": "c9ad022dd93012610d966d5a9e246f21", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209214, "uuid": "99db9e57-49e7-4734-8e64-7ecb1881c6a0", "value": "12288:VtuzRC2OyNiS/Ov7rmsHyW8mnrrB3o+51bR8CSQ2sG2/JnpWTAHj/xPYqej66IYg:VtuU2/NLOv/9ZSwG2/JnYo/xPYqej6BX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209214, "uuid": "c7cd52f1-41ad-49a4-8fee-d8349b8afd5e", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209214, "uuid": "e11b80a1-0549-4621-8765-cb2fb2146f9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209214, "uuid": "11f68b97-a801-41c1-a3f2-cec3787ede49", "value": "d4807de3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ba0054-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208559, "uuid": "814c8a34-c34c-4d3b-8692-351c424d2436", "comment": "Malware payload", "value": "195f0c5344675c5c81c249f4326565c7", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208559, "uuid": "e2d4baf6-4468-4991-9d79-d2af71339224", "comment": "Malware payload", "value": "2843dbeeb0e59e0dfaeded8dea967f9585d8b647b61b2eadab610d9730d06bac", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208559, "uuid": "21c0c65d-ec28-4a58-90a3-2605b97bd3d7", "comment": "Malware payload", "value": "2afc572a1330c15db748f6a66386a389bb64a948", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208559, "uuid": "b7b38323-cf2a-4107-bc30-0881328d2348", "comment": "Malware payload", "value": "f1c38a6952680ea2591a8536bbd67777180c86130f4014840de5195a344478db26753bac5be75535eae1c5226228e334", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208559, "uuid": "382d7922-6f5d-46ff-b527-06f02d9d58c5", "value": "0806330C229EF8FDB85A0A6C3B228EB0C5D452F1DD4225F286791544093F5BE5BDFA63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208559, "uuid": "df99e74c-9a90-49ca-b370-115114abdd8a", "value": "98304:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpQM5PdUzyZbpmwXGM2qKSAG:0XSxVJG2fLAqFOfT9sMYNM29SAG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208559, "uuid": "a54598fe-2e38-420a-a288-a22397c0ecd2", "value": 3928064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208559, "uuid": "31b93c36-61cd-42b6-a428-e97ed02e7247", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208559, "uuid": "1f317bde-52c5-4b3b-9b8a-e82911305588", "value": "2843dbeeb0e59e0dfaeded8dea967f9585d8b647b61b2eadab610d9730d06bac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25428400-ad65-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620193549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620193549, "uuid": "ad3da01f-590d-45a0-9374-e0e9562e2010", "comment": "Malware payload (AgentTesla)", "value": "4d998f2b6a0dbd773d861640714e30ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620193549, "uuid": "cadcfe4e-ef65-4c38-8221-e386d07ddf5f", "comment": "Malware payload (AgentTesla)", "value": "2864b89d3d91a088e0f782ced1e0116cfb66a48d3e78d37d455466fa699fa0c7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620193549, "uuid": "676357b6-e6e7-4353-afd6-9bc6f9c6d1f6", "comment": "Malware payload (AgentTesla)", "value": "fdb4ad0f9bc912572126c25dfac492b71507ddf7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620193549, "uuid": "44cea226-940c-4f50-aa4b-81ae2b386a5f", "comment": "Malware payload (AgentTesla)", "value": "9d894a53220d4c83bcc9a0c3393699b84b1e11b31e52dfb7d20bf7cf453dd3d9637ac88640fb874e5f19581dfeb180d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620193549, "uuid": "030554ba-d4b4-4ff3-8ca9-ccba844dbf27", "value": "A35571AC325031EED567DAA69BE92C64E6203476472F8107922303FD9A0EF57DF245E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620193549, "uuid": "93e8f817-ee03-418e-a158-888b082b71ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620193549, "uuid": "eef24282-05dc-46f1-916e-434a9b4d4244", "value": "24576:0yNpZ13qOsboLATyTTIUEfsZjr5QDjoTDefOB:0yNpZrTTIbkr50EDef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620193549, "uuid": "3cb99d8b-e3dd-4dbf-b78b-bbc124f0caff", "value": 1297920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620193549, "uuid": "53ed03b8-f9e3-4432-a1cc-00ef50aa1920", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620193549, "uuid": "b51abebe-c7ce-4bac-a4dc-9ed810e98622", "value": "VSL PARTICULARS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc4310d-ad80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205346, "uuid": "8fccf685-45ba-495f-88ed-5831aa3fcf1c", "comment": "Malware payload", "value": "bac2a5a291b6db5fa477abbf9f6db2ed", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205346, "uuid": "634724d4-e6e5-41d4-a8ec-df1b4ed60ee0", "comment": "Malware payload", "value": "288a42b03d1409ee289b7aa0896150467dc850fc56661c12d850114acaf88363", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205346, "uuid": "f237933d-b24f-44ec-ad75-c0b55e6ec160", "comment": "Malware payload", "value": "7429886345d24ffa8e23e0a257be528612878ba1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205346, "uuid": "eb579fea-9c5f-4696-83b1-55059d7b08d3", "comment": "Malware payload", "value": "1f1ea9ee874a6cdd6882586bac0399ccbb89ddbf4fec5f0b77ecb0f084d3e5dacc41d09383e59fcccece7354ccf3ba89", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205346, "uuid": "a747d249-5913-4c86-bbdc-c81c24a4ba93", "value": "9ED59D12B7E8E575E0B601350D27E3348A7AFC216D0C6B0F7394795E6D78785AC2AB0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205346, "uuid": "af363384-34af-4034-a55c-e8906c7955b1", "value": "17ed737e8e77e97fd1eb6ad9ba5d3eae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205346, "uuid": "f4dc83b7-a19e-4db3-8407-9a879565681a", "value": "49152:PEs1Y5W/x5W/b5W/p5W/S5W/f0g7mM+M6RkMkIM7I067T5W/q:PE2Y5WZ5WD5Wx5Wq5WmM+M6RkMkIM7mh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205346, "uuid": "76369bd1-d947-4981-bd7c-1f00dd286466", "value": 2935345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205346, "uuid": "cb7843bc-1bd5-4035-9514-3d3bdfdb9c85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205346, "uuid": "c49ba10c-9cc6-42f8-98e4-b8ecee8ec327", "value": "bac2a5a2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060551f0-adcf-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620239023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620239023, "uuid": "c378c6fc-82e7-4b50-b1f7-50e92029387c", "comment": "Malware payload", "value": "e2c801b8df85d1dd8254b86ae2a61b6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620239023, "uuid": "b3414a64-0f25-4872-b96d-a845e47acc39", "comment": "Malware payload", "value": "28b88aa9eb8a0c26b778b76cf91f5ad2b05c013fcbee258c5df0f9d23200bbf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620239023, "uuid": "770a29da-d24c-4319-bef6-a2ccac931ca2", "comment": "Malware payload", "value": "8c422abbefb516b0e4aac85fbc98e639904508fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620239023, "uuid": "2ab38e0e-8bc2-400f-886e-95a3c65fd648", "comment": "Malware payload", "value": "eea67131ed8c43a0f7fac5a682c3c689ecedfe607ffb55f3894ff115bad75f51b72a10b7f2d75afa0a147742cc2c0e69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620239023, "uuid": "6e219f25-ec73-443a-8640-e54dfe8a200f", "value": "4D45CFAC755869F0D35B5E22A3CF0C0683651174A93BE90A8F6013FA1A57F173E39D8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620239023, "uuid": "92e67f47-56bf-40ff-9719-1c93f704f949", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620239023, "uuid": "69653c05-a8d7-4867-85a9-90bd80c4ba95", "value": "24576:EooLAYDk28KMbyVTMxGu2hGM5kVA/fT2ettf02r:EyCTN5kVGtttf02r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620239023, "uuid": "2f539bda-ad97-4258-96cc-bc492a2e288f", "value": 1272320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620239023, "uuid": "156d4d3d-a7d7-4258-9902-663cc73be4d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620239023, "uuid": "5b89bb68-1ea0-463f-9ab4-8ab1a31b629b", "value": "DUE INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c2e8d76-ad8c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Anubis)", "timestamp": 1620210257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620210257, "uuid": "ce292b32-c7a6-4ac9-8c50-055d0c0cf96e", "comment": "Malware payload (Anubis)", "value": "92891906b5842b1daac01661731116b9", "object_relation": "md5", "Tag": [ { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620210257, "uuid": "e7981534-32ba-4d09-bc27-9c7b107b7394", "comment": "Malware payload (Anubis)", "value": "28c11bb998bf8c023a212c6518b4f8219c8583c2e79fc87d76be6fcad51b522f", "object_relation": "sha256", "Tag": [ { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620210257, "uuid": "ab91f734-9b92-45a1-946a-393f1e3b02cb", "comment": "Malware payload (Anubis)", "value": "53ff2b0a928fda3439d188c9b7d2f989f7e93eec", "object_relation": "sha1", "Tag": [ { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620210257, "uuid": "2e7617cf-b660-4ca1-a397-9ab8ec4c4874", "comment": "Malware payload (Anubis)", "value": "d88c56a15314bd993b1acb1928bc04b428c74bb2b1a5830aef0242354dda8a0c061067c99841ed2e815b0a49c844958d", "object_relation": "sha3-384", "Tag": [ { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620210257, "uuid": "73816544-9fa9-4905-b3b0-e727340beb12", "value": "A636018BFB05A86FC1B7823646760556651B4C2A8B83D7874AA4713C1DBBDC04E8BFDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620210257, "uuid": "9b7e882e-1b41-4b57-a25c-297bebffae72", "value": "98304:Ctbtx8eId6BxzYR3veFk1lW1zdMQ0pDDDxjUXIklfie3RrQm+jVNryVIh:Cxq8bzYR3WFk1lW1zdMPxDDxI4kXV+xF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620210257, "uuid": "72aaaddf-ce53-4a5d-b741-2ec20b95bd89", "value": 5091611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620210257, "uuid": "918711b8-d970-48dc-9df5-be0d807f3a5e", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620210257, "uuid": "83d7afc6-8f3e-45a4-86fe-61bd8b8cb41a", "value": "UPS943.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a83156-ad99-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1620216180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216180, "uuid": "93d86727-2df4-4081-b7e2-01925fb241a3", "comment": "Malware payload (TrickBot)", "value": "9cf167d168f07d574f4a9e72590bac0d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216180, "uuid": "9e9f792b-8016-4982-a6d0-8cd343b45cbf", "comment": "Malware payload (TrickBot)", "value": "28cd71a03ac7380eb1af07b7f79a8eed63dd1857d4d714b2cc1ad2c01e481287", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216180, "uuid": "e35475a9-6b53-4121-bf1e-97d5dd913ed9", "comment": "Malware payload (TrickBot)", "value": "e890c79328dddf0aeea183c1e067e1e63f5665b4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216180, "uuid": "cb92726c-a54a-4e99-8435-d44ec5eb6636", "comment": "Malware payload (TrickBot)", "value": "9c5753a2471f3caf35805d982f3b8c35c8cca993fcbfd2700e861810ca7a468f7ecd7bfc966db0454bd8238bf3ef8f91", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216180, "uuid": "01ac9d00-cb0c-45d3-8fb7-8ca6657ac343", "value": "038423355FDA06D49A7EF1A4C296CF005A0460CE747F6033E7A4DB904F6D61EE87067A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216180, "uuid": "de47a1fa-a619-441e-90c1-e035aadc9c81", "value": "6144:PoRNQf5GANyB71Eo8k63vqCu7x3S1YhHGQ5a9mm18q065uPIfKSGS6IGKLXsIJpV:P8Ngje71/LjGka0mEguP0GS63csyU1A3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620216180, "uuid": "736d3d45-1a97-4bb0-9c7b-10fe059de350", "value": 383820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620216180, "uuid": "48b173b7-6ce8-4a02-a8f0-700ae6d6a68a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216180, "uuid": "52e558a4-6616-4032-8f1f-a4dc8a9e7023", "value": "9cf167d1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05692918-adcc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620237734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237734, "uuid": "83404aeb-5a47-40c7-8eb2-2a16f8a54557", "comment": "Malware payload (Dridex)", "value": "0c6915e5ab7154a5b00dfe6f59f56fd5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237734, "uuid": "f9893cc3-d7a8-48d7-8c79-01bda84271c6", "comment": "Malware payload (Dridex)", "value": "28ded042ca1f25ee22ac2ee648603442c494e11135f919c26d790ce55524712b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237734, "uuid": "5fc7115f-bd39-42e9-8a87-d0b4b8d5c353", "comment": "Malware payload (Dridex)", "value": "cb9fc4786df22fe763b448419127184fb5500553", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237734, "uuid": "107ef214-1370-49ec-8189-2bdc5678a08e", "comment": "Malware payload (Dridex)", "value": "afdc5abe7f0fdb56b5a945a3751012889685059a3c07ebeeeafc40fef77910b36da8c070f09e3050313432e5d91356e3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237734, "uuid": "863b27ea-a0eb-427f-819e-1167d4163cad", "value": "3EF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237734, "uuid": "1afdaffe-1801-4f36-a4c3-feee6a797468", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237734, "uuid": "9637bdfe-e016-4862-bedc-dbe6cee16c23", "value": "3072:+WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:+42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620237734, "uuid": "f1ebee5c-8a1f-4e93-9d86-a0fc354ab7d9", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620237734, "uuid": "a03b28e2-be3f-4b36-93f4-45a22eee7cee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237734, "uuid": "f54fa92b-a149-4c77-b597-82da8b34b779", "value": "0c6915e5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f46c8fd-ad62-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620192331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192331, "uuid": "cdd585ba-b705-4509-beef-ad52e3d63847", "comment": "Malware payload (IcedID)", "value": "cb3b944c864e2b6a906c7c0978d971af", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192331, "uuid": "931a1d0a-9a89-4551-84fd-58af96960f06", "comment": "Malware payload (IcedID)", "value": "28f595fd9961f03b150ede3bf42261126cd55000a296a32503e76dcd2602877f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192331, "uuid": "fa70e3a3-6f83-4d98-9bf5-5cfe63039a49", "comment": "Malware payload (IcedID)", "value": "2506cb87b5b72f109487b560a884e22bbd72e3ac", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192331, "uuid": "eda18afe-6771-4a42-a8ba-e330cd3b437a", "comment": "Malware payload (IcedID)", "value": "7222c648fb565f4ca1de9c23f3a8a3c63a4702969cfcd681b7579b42fa609c247747a0fc643927aff764c0f925d44496", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192331, "uuid": "dcfa0347-6d3a-487d-ad58-71b5c6f9d999", "value": "9F434BC2A784B2F1EBE56F7590795A2C86346390DE83307BD09C7227CF7225B072275A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192331, "uuid": "0093b21d-3a71-4084-845a-d7e6c3c0dcd8", "value": "cfa8dd488fd4044f7dbcc5838881a33c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192331, "uuid": "9313d8bd-6b3b-4570-8989-92e6df843b1e", "value": "1536:dZoOQeP15YCslCvzF757+Rcl/K5InG4X9:A6fslCrF7QcNqQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620192331, "uuid": "735c4ab8-7d3b-451f-a81d-9d007a48d2c3", "value": 58456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620192331, "uuid": "701e12fb-b5ca-498c-97dd-00e930702ae3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192331, "uuid": "36233d91-1f68-40f6-9460-474490dddbaf", "value": "cb3b944c864e2b6a906c7c0978d971af.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e1bd02-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209174, "uuid": "a75cb0ab-aa1a-456f-adfd-8cb42ea8fb82", "comment": "Malware payload", "value": "d331a53d6deced27e44a1b23a897c660", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209174, "uuid": "f88234c2-439b-445d-9562-af366bbed3e6", "comment": "Malware payload", "value": "29051e0cdfd29405d4766b2d09e93c03b190fc71d094d11fb0e7bc998187689d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209174, "uuid": "65d489cf-7435-4667-a314-064c86e34b71", "comment": "Malware payload", "value": "a96d6f7f562943794a632b7071c2bc228477ed6f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209174, "uuid": "7ecbf2b7-826f-4491-9ebf-30538eccb361", "comment": "Malware payload", "value": "387db9a97e498e81f54a6d721e247e02fe69c1a1b875c46693b21010c6a4f1c8148c89a6d2011b4ee547f5f03823c3cf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209174, "uuid": "134d5e2f-de05-4fdc-b8cf-e1f929304414", "value": "1CC34B1AF50295F7EF2908B002C7F2BE4A20AE34D4244E86E784DD69EC73DE5766D352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209174, "uuid": "4f672bfc-9755-4b30-814a-efe7c8cfbb1c", "value": "1ab4a64725d1bc79627f25a38a864ecb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209174, "uuid": "e680ff2f-4691-428a-993a-7aa3b10ee283", "value": "3072:pOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPb:pIs9OKofHfHTXQLzgvnzHPowYbvrjD/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209174, "uuid": "1d41c235-61e2-4db0-a83d-72fd4238584e", "value": 121440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209174, "uuid": "559e0e96-2062-4c4a-8a02-dade67ff7e95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209174, "uuid": "2457c0f5-2a62-40d0-9a84-3850e40533cc", "value": "d331a53d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc90f17a-add4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241504, "uuid": "c9f052f5-8082-4911-9128-660eb06b1f44", "comment": "Malware payload (Dridex)", "value": "333b63bc4f4cf0732cc41ed734cb2a87", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241504, "uuid": "7be178cc-cc44-41c1-ad35-b908ed346876", "comment": "Malware payload (Dridex)", "value": "294703771975a9074b967940a343a6cfc69bb1ca17359d398fc657fb15462def", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241504, "uuid": "dc5d7120-95c8-4da1-b832-973c8214b081", "comment": "Malware payload (Dridex)", "value": "e99356a0583c031dcc8996181f62c3a36f404da2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241504, "uuid": "d79b02ba-2a53-4a52-b544-a9c2a8a28dfc", "comment": "Malware payload (Dridex)", "value": "50f9af319a2bed2e7ecae3e8d1decbb5a986b20adef3e1395846d33b4a3923fb192fd40f7299d281e3624d117091933a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241504, "uuid": "50c5273d-7918-4dde-bc45-aae8af64b4ba", "value": "B8F3C085DBABE87FC44A35399472DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241504, "uuid": "8e92b3cd-445a-4835-98cc-5354c1645d36", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241504, "uuid": "02e2cc8a-f93d-4235-852e-430ec6f58fdf", "value": "3072:9X45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:p4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241504, "uuid": "8cafa618-bf20-4e4e-a212-81665436f8ec", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241504, "uuid": "29fad547-b2cf-43c6-a289-61a573ea8245", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241504, "uuid": "585c3da8-ce4a-4503-a86e-d5b718e57579", "value": "333b63bc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5340c234-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload (Matiex)", "timestamp": 1620212524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212524, "uuid": "d1e7190f-bd7b-4dcc-afcd-da5ea9e9272e", "comment": "Malware payload (Matiex)", "value": "1c24719aaa1f1a844cda4bc2ae526f89", "object_relation": "md5", "Tag": [ { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212524, "uuid": "814ae89b-348e-4f7f-8e6c-a626a6790ffd", "comment": "Malware payload (Matiex)", "value": "2970094c7e9ee7e8e31524d996c5abc830e2e480602e0d223c4409a52ba55ea6", "object_relation": "sha256", "Tag": [ { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212524, "uuid": "75ef63e0-05b4-483d-a5a3-0531cc28ba30", "comment": "Malware payload (Matiex)", "value": "ed3ec0824fb31ee0abd1d95e0069721ede2f97b8", "object_relation": "sha1", "Tag": [ { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212524, "uuid": "b1aecf79-6ece-4a64-bee6-0422d7b3e853", "comment": "Malware payload (Matiex)", "value": "f1fb7c2cf4356bac62df0189989061d2cc488e7c2c62f9487b4b2ce44520fcc891d62f5a98f89d4d77777f54c7ade2f5", "object_relation": "sha3-384", "Tag": [ { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212524, "uuid": "351ca845-73f3-4936-a065-5540f4ca4c40", "value": "6925CFCF18A4DAD7C2A665BC20F7A96203F32DC28A05DED9335C7285777FA6E4416603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212524, "uuid": "e57e12d7-1ba0-42ac-87c1-e91a678504f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212524, "uuid": "f6e30eff-3697-487d-af45-8d7efcc7623b", "value": "24576:GLGiJbaiJbxiJbPFI3dxbxGZupGCq4dBpiKbt:GLGiJWiJNiJzFWfFEA3NdBpiK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212524, "uuid": "81cfafc1-4554-4bc5-98e8-7ba2a4b04d2f", "value": 987648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212524, "uuid": "d75eeb1d-8f0b-4108-963a-31ee5096384c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212524, "uuid": "468fd231-4715-4041-8f54-21ebe17d9739", "value": "10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f7451e3-ade0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620246367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620246367, "uuid": "2b57a8b0-af71-432e-87d6-0e1b6b51bdd2", "comment": "Malware payload", "value": "1bdf780ea6ff3abee41fe9f48d355592", "object_relation": "md5", "Tag": [ { "name": "doubleback", "colour": "#E06F1F", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "UNC2529", "colour": "#0D96B8", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620246367, "uuid": "0ca04dea-d3c6-45d9-ba0a-abe034a7d470", "comment": "Malware payload", "value": "2989581e8a8e3a756ec9af84ff6692526e440349c668e8636e3d10d452995c95", "object_relation": "sha256", "Tag": [ { "name": "doubleback", "colour": "#E06F1F", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "UNC2529", "colour": "#0D96B8", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620246367, "uuid": "5ea21350-4c42-40e5-8a69-69f937964354", "comment": "Malware payload", "value": "90177c060567990e289f746cd126975b9102d675", "object_relation": "sha1", "Tag": [ { "name": "doubleback", "colour": "#E06F1F", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "UNC2529", "colour": "#0D96B8", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620246367, "uuid": "b32540c1-5c85-4ba7-8a46-b96432937b93", "comment": "Malware payload", "value": "d570faae2cdcc6a86da79d64215ff5ee1a5e5672671c0f562d97b5348631440f1adced5ee51eed76aca73125e116fc8c", "object_relation": "sha3-384", "Tag": [ { "name": "doubleback", "colour": "#E06F1F", "exportable": true, "hide_tag": false }, { "name": "pedll", "colour": "#17A6D9", "exportable": true, "hide_tag": false }, { "name": "UNC2529", "colour": "#0D96B8", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620246367, "uuid": "57589070-3efb-441c-961c-cedc98ba8320", "value": "FEF24B4EB6640CA0D0968174C66FCC3BEFBDB06A25748A4F5185C7752FA316376BD302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620246367, "uuid": "17001989-6141-4fb1-a209-fca50fd438c8", "value": "022bae4e2816aafe7551cdcfc5f9ecf4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620246367, "uuid": "992f0e6e-c8b0-465f-95bd-1dcbe5df01e3", "value": "768:9aAQaSH1F5D82DP0ZchCWRUjKtus6raeuwGfaNR3Q:Tkp8A0SM0PSX3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620246367, "uuid": "1be4bd79-6daa-4667-b96e-26dc5884f9a2", "value": 35840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620246367, "uuid": "fb365053-4531-4771-bfc2-7f092daf83b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620246367, "uuid": "815e689c-ac8a-47c4-86e5-c5161ab3d7b3", "value": "2989581e8a8e3a756ec9af84ff6692526e440349c668e8636e3d10d452995c95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa9fcff-adcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620237697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237697, "uuid": "e66f004b-c864-4e5e-b45c-a5e7065e5b1c", "comment": "Malware payload (Dridex)", "value": "b4bb343c0f64252daf1973551c8a0f33", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237697, "uuid": "86b0d5f1-c2b4-4d16-b287-51ca377cd015", "comment": "Malware payload (Dridex)", "value": "29fe5b716d9e8d9d95ebbda106cbcbfe9eead8fea2f7b9f96a5f3189e6bc16a8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237697, "uuid": "61eba79b-4cb1-47bb-ad46-91cb9cf0f091", "comment": "Malware payload (Dridex)", "value": "a90a551237e9ad81fb8d3bc8d305614ff1b5fe8e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237697, "uuid": "7b5d61e5-70ca-408f-a2aa-91bf5b6057bf", "comment": "Malware payload (Dridex)", "value": "66171ad46464af87dc7b43e8fb4a7d0b1ed5a3b250835ec59e68eac73196c9b31a754bdb64dbe1a8a1d75aa0829df081", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237697, "uuid": "9880446a-3377-4185-a346-4e56cc21d30e", "value": "12F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237697, "uuid": "dbd163c4-fdc8-4ada-a573-4ec254b5d28b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237697, "uuid": "8a93ab5b-fd7f-4220-b320-df7943a0f654", "value": "3072:mmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:3Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620237697, "uuid": "b26ec4bb-b6f0-4906-a117-4d55dd44e7ed", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620237697, "uuid": "d584195b-666d-4bf3-bef0-ccb6ce72c39a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237697, "uuid": "79b11faa-e397-4b12-9395-572a80d41902", "value": "b4bb343c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acfd7dbe-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241880, "uuid": "41c0b26c-1375-4ceb-bce1-1a8495d91b03", "comment": "Malware payload", "value": "5f3b940b3c272472e3dd09750888dcdd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241880, "uuid": "25480d40-6ae9-4f00-b29c-a28430a9a346", "comment": "Malware payload", "value": "2a1e73f4e989db5610e82645ca779e84c5a5e0682b8b5f3be50e6e721b5b2efe", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241880, "uuid": "102a7d21-6b33-487f-bec5-19cf743f9c02", "comment": "Malware payload", "value": "e87212b2a7dcbb4b7c495cb5d333a52329cb75f1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241880, "uuid": "58025c0f-11f9-4650-9525-a9ef81f87746", "comment": "Malware payload", "value": "04a787eceec4b24b1a149acc9422d1b3a7c1fe11dc7451cc80f5588ab47516e74ec2114f98838311662401270726bd3a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241880, "uuid": "4a8b2795-21a7-4bf2-a5fa-acb1b7c9c073", "value": "E7F3C085DBABE8BFC44A35399071DFFB5B388B145650C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241880, "uuid": "db3b7f48-db4a-43f3-856f-5c441f5441c3", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241880, "uuid": "cd50eba0-899f-4a14-b727-0e2cbfa08ce3", "value": "3072:GM45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:54KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241880, "uuid": "f101fa07-d2f3-422e-a1ba-61c8d34a74d6", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241880, "uuid": "7628fcfc-6412-4e12-9bd9-ab680a7bd8c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241880, "uuid": "430647f0-c2bb-480d-b9d2-98812890d92f", "value": "5f3b940b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815bc08b-ada3-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620220332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620220332, "uuid": "df9ef983-952c-4b32-83d6-d2d7b68f44ac", "comment": "Malware payload (SnakeKeylogger)", "value": "442fb4502caab7fa16f958a5c436db31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620220332, "uuid": "ff506033-3d2c-4367-a0f1-e6549d2bc116", "comment": "Malware payload (SnakeKeylogger)", "value": "2a25a0d03e734108ad19931b8c3ba15bf5edd9cc347b82dd36117a5817f2b5ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620220332, "uuid": "6ba92de0-2895-4f8d-ab98-0506cb41fa02", "comment": "Malware payload (SnakeKeylogger)", "value": "40739e409be2517c6d25156df6324b7cf1374338", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620220332, "uuid": "c1c461e5-f82e-4504-b6d2-cccb7868e06e", "comment": "Malware payload (SnakeKeylogger)", "value": "b09fcb511cc5e18bd3d7ad6cd1e553b4d0563c90c6d6c66c319977c195547601a132feb6ce6631b81c9a808b95deb18d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620220332, "uuid": "c0d56f5f-dc46-4504-bf11-0dbaaeba7a7d", "value": "4415CE277F685656E0BA1F381839031097F5F11AE725C31F2D6860ADEDD2AC28E637D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620220332, "uuid": "86a49251-76bb-43e9-a165-89e0597c4b7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620220332, "uuid": "6e6ebbfb-1d32-4d64-a47c-5411a20d3ebf", "value": "24576:CVfEtxQPM+QLTDXvnoOcX1hMmHPNEs6F:D39+M/noOcX1hMIP36F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620220332, "uuid": "710d2161-98e3-40dd-9a27-e00b8b6d9879", "value": 875008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620220332, "uuid": "f2deda9b-6c51-4210-866e-d702ee3a353f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620220332, "uuid": "25a37cd1-eed3-4272-aa40-332574d2bee7", "value": "MUM4y8fomnbiPwr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37fba8a6-ad98-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620215485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620215485, "uuid": "fd783bd3-435e-4eef-ad2c-c2a6792ac4a4", "comment": "Malware payload (AgentTesla)", "value": "3a324b5267c7bb582f568ce423df64b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620215485, "uuid": "ff8e9653-b81e-4224-b36f-dbf03ad1405c", "comment": "Malware payload (AgentTesla)", "value": "2a2bd58a0bb16a00980f69985f105a8588f3c25a4e7a1f77eed3fc740c250759", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620215485, "uuid": "f7f0e726-bae5-4108-962a-b4ed9737b062", "comment": "Malware payload (AgentTesla)", "value": "28fe941d6bdbf4792d3c08db846edd8d3431a1e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620215485, "uuid": "2900115a-eb4b-49ae-b230-9691ff0a5fd1", "comment": "Malware payload (AgentTesla)", "value": "7b7601d3a3d418f208f8f3a323542ae879d6ba5ef0efd839570dea0ab67fdda206cc6488a1a5021a655205e2e5db3e6a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620215485, "uuid": "38a7b38d-5dae-48a9-b527-30b41d0b217b", "value": "D35570AC325031EED567DAA69BE92C24E6203476872F4107962303FD9A0EF57DF245E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620215485, "uuid": "a3b1fabd-c658-480b-9aa7-3c2fec2a22b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620215485, "uuid": "606c7abe-9e31-4dcb-a861-f9b1a93ba71a", "value": "24576:yGT3uAhgsIUoLASW6nPVi/NaMx2pWVpMIaU:yGT3u3NqaM8sVpMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620215485, "uuid": "d582cd48-e22c-4492-842c-6f4f55ed0863", "value": 1308160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620215485, "uuid": "ff019068-1e46-46a2-ae4a-8d8013e3bdc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620215485, "uuid": "af023031-5642-493b-bfdb-6eb984540b6b", "value": "arinzex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd90fe0f-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212702, "uuid": "3b6bc576-5646-4d98-8889-013812379843", "comment": "Malware payload", "value": "6d9529725994ce5d0087c6302bae0f03", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212702, "uuid": "c2ab2f9f-e3be-4eb5-8dc1-c2fe4262945b", "comment": "Malware payload", "value": "2a2f5ed858b050a8123a0a0350c12ce1b8fd11d83d0e23a49addaaa515dcd962", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212702, "uuid": "1eab93e9-ac7b-4323-a4cc-d2be76e73030", "comment": "Malware payload", "value": "984228aad58f56d7e81e01952dd6938aa90449e8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212702, "uuid": "9e7a7d4e-c744-4ec7-9a13-09721734d479", "comment": "Malware payload", "value": "781764abaa6fc927686e743e9de0c217614658ba9c92ab637c300721024687e84555bebf14556ad5bbecaaa9e034b01f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212702, "uuid": "1413e3dd-010e-47fa-807d-c1c904c69d08", "value": "28D4BEB5E7F33FA3C8A717B9CFB42C198DBBE9C0E0793581246656091E42284D8867D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212702, "uuid": "5accb4c1-f87f-4be7-9140-98c721f835a9", "value": "28555a72dba1f3717f1798f7e7fba12d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212702, "uuid": "561131b6-9690-4e7a-a724-776c82af2b47", "value": "12288:CgfMUeQF4ji6tzfFN843NRronCdZwt+QmMdqWiV3LVriZTm:Cg9eC4jiKfR3NRdZ1Mdq7V7VUTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212702, "uuid": "8587e21b-0b61-4bec-a538-bd2acc915fd7", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212702, "uuid": "50198217-37a1-4a8b-973d-c714aec8c0a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212702, "uuid": "6b3e9ce3-8357-486a-aa44-3267ef19c55a", "value": "6d952972_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd87e30-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212808, "uuid": "d92b6891-1bb6-45b8-afef-af639263aa7a", "comment": "Malware payload", "value": "5936c25cca9017437d5cb9b6d0fa0cbe", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212808, "uuid": "07c39a03-4168-4141-8f06-9af18a3b1c46", "comment": "Malware payload", "value": "2a6987c08b3f5aa3dd595fc684af68222accf71d5acd332623e830bd7657011f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212808, "uuid": "1cbb32a2-9c0d-4676-a09c-e2f6da72bf92", "comment": "Malware payload", "value": "225db09e02d2b16cfb0b5a1b2b7d4f6d9848d809", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212808, "uuid": "5ae6c39b-8446-447a-9968-407e8b6249e5", "comment": "Malware payload", "value": "cb961a783ff7891a7fdb13edf17bc6d42deb9113681da1fef6e3c9d36c1c51a96d3015a8b67aa4b1a8ff7814823246bc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212808, "uuid": "e5284518-afee-49f6-87cc-ff39d318f83b", "value": "C7B3AF51B391C076D05A24354C6EC2B20B7EBC3295B9898BB7D47B3F1E71380AD66B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212808, "uuid": "845ca25c-c47e-453d-98c1-b759486da0c0", "value": "48d9f490785d88da17cb6102720bb303", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212808, "uuid": "1c0fad6e-f3e2-4aa7-a626-d04b5e9fc528", "value": "1536:BA7DoMCOeTFj5m+UcYmTuw32JEHCSBKb5l8lTfNYFfHYTogoFGCq2iW7z:iDwNmnHMCZUTfNCfHYTorGCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212808, "uuid": "91f06cb8-4340-4b9a-9543-81a9a3b1128a", "value": 109568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212808, "uuid": "3b2cd2dd-4914-4824-b905-639a948ba454", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212808, "uuid": "7bb1931d-22f0-46cb-a690-ef0f3530ab4e", "value": "5936c25c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea14846-adc4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234340, "uuid": "cde0f497-58ea-4bbc-afaa-0a02348601b8", "comment": "Malware payload (Dridex)", "value": "d06632932893c5cf58b9731a4aece8ec", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234340, "uuid": "e91c8047-343d-491a-a266-82f530e66bad", "comment": "Malware payload (Dridex)", "value": "2a71d6b7ad178323ff7ff95f0154efc574117ea1626cd37200c19266353a170e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234340, "uuid": "1bcb1914-9cdb-4460-a563-96384618bc29", "comment": "Malware payload (Dridex)", "value": "00b2363b4a26ca721150833936c8828b8da88ee3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234340, "uuid": "d33a0eb5-76d6-416b-b0b5-dcd286ce108e", "comment": "Malware payload (Dridex)", "value": "be24ccc22527e4c99a4f3d8b5687548a996e883bb12131f4fdffa3392df2e5cdfaed7d17b7ed32f87cff497b988b0077", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234340, "uuid": "f7fef152-b3a7-4385-8299-d0d2a98824c9", "value": "AAF3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234340, "uuid": "2eec7f91-e29b-4a67-8c33-fe28ed9fcdf1", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234340, "uuid": "1d2ef584-8ad9-4031-bb92-e55644046e5e", "value": "3072:PP45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:X4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234340, "uuid": "85228989-06e4-43c9-8632-85cc504eb3fe", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234340, "uuid": "88550131-9f27-4dc7-bf21-74e8ab0e1abc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234340, "uuid": "6ec9b391-979a-4d8c-bd00-aa49ab05a957", "value": "d0663293_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4570415-ad94-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620214083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214083, "uuid": "8efd944f-0cc2-4dbd-a5fe-6434a9763d74", "comment": "Malware payload (Formbook)", "value": "2a7d9a26f63de29bbf21016b055560b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214083, "uuid": "52bdd492-3dc6-414c-8057-0b879fa3371f", "comment": "Malware payload (Formbook)", "value": "2a728511ab345b4207ea5959439df12205796548388cc170b427110f9cc247dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214083, "uuid": "3ef61054-26bf-4b69-873d-23e6cdd712ca", "comment": "Malware payload (Formbook)", "value": "8110d53cc373121512c1fb90c4ce12fedc07803a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214083, "uuid": "9dfd4bc5-bfdc-412e-baee-493bb58d254f", "comment": "Malware payload (Formbook)", "value": "c4d9ad8523d37b344d90f8828457dcee9e9c935b4128dafe3a990e51be445142f1cb78634f7e223351a297f8d27e3491", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214083, "uuid": "6e9d5a0e-0d72-499b-b2cb-f9f48077231e", "value": "FB3412EEA170C8B3D21B03B15535194BDBFDE22250B5424753B0AB5BBDA66E2CE0F193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214083, "uuid": "0e423361-f0a3-4b22-bf03-6a4b820e4746", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214083, "uuid": "a57ffa81-3a65-40ce-93c2-5dcde618f73c", "value": "3072:lEre7GjyCaFvcGbp7v8IYVdGi6K0TUHmef3xBJJYrTjQnO1/6UNvP4n8seX44YlS:lPXZBfSGQ+UprYrTj71XtwHeXh0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620214083, "uuid": "2afa7239-903f-4568-b18d-65f37375af49", "value": 234601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620214083, "uuid": "b4898ecc-96dc-4d34-abea-a6430c778810", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214083, "uuid": "38cdd85c-a73b-41d9-8073-b7aec501fe69", "value": "SHIPPING DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4063a6e5-add6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620242127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242127, "uuid": "310a7762-3520-457e-8c24-50191a02b130", "comment": "Malware payload (Dridex)", "value": "4c52aed4099a8de90d74ca3a6b3abd74", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242127, "uuid": "82e61223-b159-44d6-919e-f88765feace9", "comment": "Malware payload (Dridex)", "value": "2a96a3ac044b46068a970529f2c0286878bdb39fa68788a28f2184d9f32de9d5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242127, "uuid": "8569a615-a87f-453e-bdca-d14174898dd2", "comment": "Malware payload (Dridex)", "value": "9ce7f250d3b5eb764a39e74d38bb6955dcb10104", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242127, "uuid": "76681f03-ac94-4bba-83a7-0816049f9f0e", "comment": "Malware payload (Dridex)", "value": "772ef5f447ffa777a199818dfd43ab68befdfc87f283c9e771e481e4443f9ab8e1794e7e7e8f3386c1eb2ab37c46c1ef", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242127, "uuid": "8fc80733-9f79-4144-a804-492d79060028", "value": "2DF3C085DBABE87FC45A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242127, "uuid": "96ed4774-080c-4681-b6a3-c4a3b9c8883b", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242127, "uuid": "0961e127-6f2a-4af7-a932-431d1d4e9018", "value": "3072:3p45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:54KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242127, "uuid": "ee90b092-f1b4-4061-81ef-8fab7a09a984", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242127, "uuid": "1b3f9b83-e078-4669-9812-83f52386427b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242127, "uuid": "8fdee314-17b8-4797-a64a-d0ca8bd03776", "value": "4c52aed4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba4816b0-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252640, "uuid": "1c3f0c63-1f24-48d1-a537-ce7d725f8c16", "comment": "Malware payload", "value": "ffa771992005cacf739526b7345db625", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252640, "uuid": "f3c41a5e-f94a-4d10-b4f2-ef0025db5485", "comment": "Malware payload", "value": "2b07e9899d48fd347a1d38368d2ca6c5670b55a149124e096510888dff13bc12", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252640, "uuid": "871ffb4a-1a59-4f53-83ef-c13ec1cfcb2f", "comment": "Malware payload", "value": "87e0be2598b775301156c7895c6fe4366d252a45", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252640, "uuid": "a3a6b4bb-b449-4bc0-8da9-52ee16332c95", "comment": "Malware payload", "value": "d712f3eb2228cfa1a7889a3ede23f643cae99335601deb499b39ecd98c20b983f45176cf090c74d7a05827c765731e92", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252640, "uuid": "e7a5120a-cf5c-487e-ae7b-8839a1752510", "value": "07F3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252640, "uuid": "bf50b7eb-ecb9-43b3-885e-1dda16028dca", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252640, "uuid": "2392440f-542b-4e7e-9edd-3f63dd50f895", "value": "3072:Xc4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:jDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252640, "uuid": "647152c6-97fc-48ba-b6cc-e1665d9c1e50", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252640, "uuid": "1fbcb30f-f3dc-48f4-ac9d-1a495bb40497", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252640, "uuid": "a4ce7cd5-f3b4-4f7f-897e-b9d4cb10e43f", "value": "ffa77199_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9652e55c-adae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620225092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620225092, "uuid": "af75edad-ad09-4be8-88b5-835b1705b201", "comment": "Malware payload (Loki)", "value": "a89b58c114b0020c3ea30c3f32ac08dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620225092, "uuid": "3a449131-5299-45e4-ba47-0383bcdd416e", "comment": "Malware payload (Loki)", "value": "2b2b2ac6347e5365f70526f097eb6935cacae09a2a8d9c1a2ae68d05f80e3a46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620225092, "uuid": "2615ea43-7f03-452c-ac1c-4c05275b85d9", "comment": "Malware payload (Loki)", "value": "8230205cb57996963b568d3503ebbf4092febb89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620225092, "uuid": "6acb1062-89c2-466c-a89b-05b024e1476d", "comment": "Malware payload (Loki)", "value": "2ae72cd78523e87cb39e55d36fdeb3ffe1ebf630310135584777b295962a2234df26b229a8ddf5554ba71c70b3f67a33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620225092, "uuid": "49156993-f6e6-4da8-af48-fc32886cd681", "value": "AFD423502546A06CCA5C967A913E430152BAF34BEB4FCE1D3E4F859C78D39039BA1B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620225092, "uuid": "e1ce597e-379f-4805-9933-812e38cb7da6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620225092, "uuid": "1e878342-0a40-4c29-b5bf-8c929516792c", "value": "12288:xMa3f/qgJF2U+w9Lf9gDgLL1gdaWgV3Xz:xH9+IjdgaPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620225092, "uuid": "97693dda-bd89-4359-ae25-b424d268c8ce", "value": 652288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620225092, "uuid": "b10612c5-2bdb-4957-bb14-87123d9c9425", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620225092, "uuid": "353d352c-9013-493d-8131-f5d43002f2e8", "value": "a89b58c114b0020c3ea30c3f32ac08dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213dd7ad-ade5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620248518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248518, "uuid": "548a359c-b66c-4497-8dd0-c2fc01bfe7fb", "comment": "Malware payload", "value": "c421bea96b70ffc97a81f4a22193e3d5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248518, "uuid": "2cc98585-6ed5-404f-8496-9227e19a6196", "comment": "Malware payload", "value": "2b6a51227ce7a611dc29086a254c2a66552043bfa736ba7b71374cd917414939", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248518, "uuid": "f13dfd97-0da6-4946-8485-b749617f8bd9", "comment": "Malware payload", "value": "35991423837a852e56a8870fd33cc10c4678e9c6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248518, "uuid": "7bdd2966-e4a8-4081-a96b-288823637713", "comment": "Malware payload", "value": "89b085e9e36a26c9e62bd79f2241ad7dc24465fac78d9970e89e504a96332945f745ac6cd94e5e8ffd3c9dfee16c1ae2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248518, "uuid": "abcf2636-b241-4864-a950-d3276dcaa24a", "value": "25F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248518, "uuid": "abd88207-ed95-461d-874b-4b0532b478ad", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248518, "uuid": "ce8815b7-6ec1-41bf-8105-a97ce906a804", "value": "3072:eiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:VeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620248518, "uuid": "c7c25f81-01db-4518-acf3-0d1a3a25cf02", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620248518, "uuid": "39bb1628-41c7-4dde-b0a4-9e0490777e52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248518, "uuid": "c4c42492-d9dc-48a2-9d98-7dba5e6b9fd8", "value": "c421bea9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10770183-adef-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620252784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252784, "uuid": "156d151f-1743-48cd-b3f7-5894007db10b", "comment": "Malware payload (Dridex)", "value": "f0ab9dc8e25f14337f3cb5e847afa4a2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252784, "uuid": "a4a4388d-de85-4e9a-880e-ed2c25e1a16c", "comment": "Malware payload (Dridex)", "value": "2b922ebf975cc9b596899eed0df06091de359ca4d1002e6acb5f8d281fa22550", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252784, "uuid": "8c2b4ee6-8346-46a1-b079-e60ca0d33aba", "comment": "Malware payload (Dridex)", "value": "d5fd1c2700bad52473f94749fea5e2590f38c877", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252784, "uuid": "4828a808-9306-4502-84fd-eff4804b359e", "comment": "Malware payload (Dridex)", "value": "9a3ffcfb3b1a5e6d31681e72142d79c238206e04b415b5362d28451bb823f2c2e438fbbb048f7f9123a209a24ef19be5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252784, "uuid": "37a0ef67-2eff-4fc7-941a-aef7bfba5d9d", "value": "3EF3C085DBABE87FC44A35399471DFFB5B388B149640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252784, "uuid": "d1c32469-df62-468b-8dd0-f1996a807781", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252784, "uuid": "0115b3b8-30c9-4c90-ad62-e10d6ef59f76", "value": "3072:te45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:U4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252784, "uuid": "453ce229-f38e-4ddf-91bc-97e2d4ff5c61", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252784, "uuid": "609c4531-e8df-45b2-b97c-1a2becdf63c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252784, "uuid": "00ffbf4b-a36c-4aca-a7a7-be628f120d0d", "value": "f0ab9dc8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d204673-add4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241344, "uuid": "bb99a3d1-52da-46a3-92d9-4d70a65698eb", "comment": "Malware payload (Dridex)", "value": "02326d3020e67ce3cee95489ee8f1973", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241344, "uuid": "2444d2ec-3e69-40f7-b0ff-dc1edb916a7d", "comment": "Malware payload (Dridex)", "value": "2b9b86c0239853791588cef742155bde628189b579041e5489916a3311e31922", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241344, "uuid": "81091983-9c9b-4d85-82eb-e933bec3cb79", "comment": "Malware payload (Dridex)", "value": "cb755e03fc404354b3d6aeb6465b0ee42d518f24", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241344, "uuid": "bd6b3ba1-469e-433d-a44f-f82570183fc1", "comment": "Malware payload (Dridex)", "value": "1ae5d35de8bbcecc4041d3ae381248441291fbebdc5b74cd714c98d263106fe7d9c2d1b77a218db53182ca843e8dfedd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241344, "uuid": "63e97ae5-84f6-4ef5-84cf-5f4e92172212", "value": "67F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241344, "uuid": "0ebeede7-7234-4bf1-96b9-4f7687d9116a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241344, "uuid": "bfaf68b9-c25c-40dd-82df-b2c69cb38c6d", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241344, "uuid": "4010d6bb-eb46-4802-9e20-996ff03538a4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241344, "uuid": "5351ff58-8888-42c4-ae3d-cb0387e9aa95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241344, "uuid": "6d3b398e-ef50-4d42-9409-3636e69cc722", "value": "02326d30_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b983dc40-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252209, "uuid": "e598448a-8b1c-45a5-91b1-799cda5d0dfa", "comment": "Malware payload", "value": "fdedc9f6bb0b2fab9edddd264588f3c7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252209, "uuid": "a815207d-e968-4631-b966-64bb56a93876", "comment": "Malware payload", "value": "2ba11191a9da3d155b82d848577ee0b7eed0a90f86091d187bc157dd252a3d44", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252209, "uuid": "6d35127e-037d-4235-b42d-ca635fce4881", "comment": "Malware payload", "value": "3fba63d674884b8ff6f6c744c7b8c76c3a71c10c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252209, "uuid": "0d51bc65-00eb-462f-803d-b3d124de8240", "comment": "Malware payload", "value": "b1c15f4bd2d780c82e7e5d9db0440383cd7717c7ae1b0ede40a71131f64d493e3f889bd457fbf6bf8addf420e426dba7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252209, "uuid": "1a639393-c51b-4a02-b4ed-e3cc636c7622", "value": "D4F3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252209, "uuid": "b1ab62a1-fdbc-4cd3-9305-5d4fa3818d5c", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252209, "uuid": "1f1fcbc9-cea9-4777-80ca-e087fb54e927", "value": "3072:ZK4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:DDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252209, "uuid": "030881ca-373a-435a-a76d-9604c0ef9ac1", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252209, "uuid": "91fa4e7b-321c-40a0-a368-aded880c7a13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252209, "uuid": "bd46ce5b-4e7a-4a42-b00f-fafd4db52dc4", "value": "fdedc9f6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319ac5f2-adf6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255847, "uuid": "968e6ceb-d460-4943-b389-e39f5d7ad394", "comment": "Malware payload", "value": "7d0f9939a7c81602ce4da378568d19cd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255847, "uuid": "9bfe8404-b489-4ac6-a137-a6767a06efe2", "comment": "Malware payload", "value": "2ba7d4ce192c66617995fdca8506658076cafebed232e11a25eeb45218f5c878", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255847, "uuid": "e5056d05-6550-4f4a-bad2-205dad61dcd7", "comment": "Malware payload", "value": "87720d2fec3a7e0b8bf0d81c3bc977fc15339432", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255847, "uuid": "7484239d-65d8-4469-a65d-ea28cf8b3ffa", "comment": "Malware payload", "value": "8c89dd1de6c61ec237c3227e86de0610d070ed6b4cd99ec43d7409c919b03b76dbc72a41f9becc5e9b804b1b268f2d4b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255847, "uuid": "5ce0842e-cc12-4084-96a7-af146b7ce666", "value": "43F3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255847, "uuid": "3b998df8-dc3f-4b2a-ae44-383d1fc60ab0", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255847, "uuid": "728ce0d5-6a3a-4e50-9048-3abaad4ba95e", "value": "3072:kd4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:9DBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255847, "uuid": "2405e6c4-5351-4b2d-9bdb-dbe03a4006b7", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255847, "uuid": "6a35157a-3a49-407f-9033-78644f0cc179", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255847, "uuid": "fd75f43b-73fd-496e-a5a6-c4e1fa5ec5a2", "value": "7d0f9939_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb5f7e3d-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209289, "uuid": "0ce0cdc9-1df2-4965-bd05-39d86765160c", "comment": "Malware payload", "value": "425b8385b5f001ce0f361690c7d2044b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209289, "uuid": "a1239e72-04d8-4922-9948-2cb6a00b7e1d", "comment": "Malware payload", "value": "2bc6aa9baab8b42ab272da013688bbc2a3991388a514e2f0f87ac6e911db5b82", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209289, "uuid": "142c056d-c39f-4545-b97f-8d5c879c8e91", "comment": "Malware payload", "value": "89209f9e82f1703121b31431049747c7be94f4fc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209289, "uuid": "ee4dedbc-da34-4092-85d3-e76ecd931183", "comment": "Malware payload", "value": "f4a555ec304be88a8624522fbce7bce76bdb374c8bd4aedd44d72e43b4d6598898e0d7d06ed7c10717c2c86292f96088", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209289, "uuid": "134e8892-dae7-4cf8-b2b4-b449dc9cdfc2", "value": "4AE4F15DEE892731E98E463A32B1472C5C8FBE613D035D3FA32586C5DA992243D7C722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209289, "uuid": "2d09daf1-0ea2-4706-8b4e-a1078e74e820", "value": "7db1e21b97b5969415902aa2ab38b1bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209289, "uuid": "b59f6010-17c5-4767-a0d9-48f6b79e25e3", "value": "12288:8Ni7vbZ6Rzil8aQ4Dy61D0R81iDXkMbNWBjLvwY7h5V9pBzUmxHQVSvN9VutP:xTbZSzil8a7f1Aos/ZSXwY7lvFUmx99e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209289, "uuid": "71b0a81e-7ab6-4d2a-b36a-510bb9e10fd8", "value": 671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209289, "uuid": "df33ad5f-a6f8-46b7-ab02-e09b708acff6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209289, "uuid": "dec8131f-a0d9-4a90-9cc7-4f0b28b5c21c", "value": "425b8385_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b3c464-add4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241499, "uuid": "37150dfb-dd08-4aaa-97f8-8950c63fba9c", "comment": "Malware payload", "value": "bb2013208e1377e279f666193502386d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241499, "uuid": "e6a619ae-ba1b-43e2-bc99-aae07c7a2067", "comment": "Malware payload", "value": "2bf30c902eeb4f28a2029b331d6376c50b5f3a70c30b106b5f0ae5f805b0d551", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241499, "uuid": "acfbad59-eff1-4a77-a32d-fbeadbeb401e", "comment": "Malware payload", "value": "2f2d5abd1efda1425b21554b241832e003076375", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241499, "uuid": "e420970c-974f-4002-b551-630bf6a8be7d", "comment": "Malware payload", "value": "44f6609460c260a07548ad2704d9e01b7a8b573fb61b49bcb2deb1bacadb09849ce00170bcf7a94f7ac53e8ee0629752", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241499, "uuid": "eb1b04b2-e4d4-4665-ba34-c56671ae7a76", "value": "08F3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241499, "uuid": "edea7257-605f-4587-96be-1ddd3ab85d7b", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241499, "uuid": "1039c167-3052-43a1-ae4a-124dedca94dd", "value": "3072:wXx45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:wh4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241499, "uuid": "77d45ffc-d4d2-4382-a30f-c7b1e66aa319", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241499, "uuid": "43aeaa9b-e0d8-400c-9d5d-e52de93fc12d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241499, "uuid": "c3b8da07-985b-4346-b340-1a17342dac61", "value": "bb201320_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e216fd-ade5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620248522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248522, "uuid": "97c22ba6-69aa-4026-92d2-60bef3d43615", "comment": "Malware payload (Dridex)", "value": "e55710ddf27185079a83d34f4d6b8129", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248522, "uuid": "ca6d44cc-3c76-400c-a614-8bd26d9944c5", "comment": "Malware payload (Dridex)", "value": "2c6808002b0f8cba686f79669a79d42464218faf5d7b025a3bf085da70363031", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248522, "uuid": "02a23a18-d6f1-4135-bdd3-b51c0865c20e", "comment": "Malware payload (Dridex)", "value": "a38e415715dc7cea941f504e2b40b7c3641bd59b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248522, "uuid": "dee70960-9ea1-476f-b701-b8ee0afd8c67", "comment": "Malware payload (Dridex)", "value": "5903513dbd2251bae213d133c0ff2004ee2427dc47422d4f6f9321cfee71ddb894c242c743c3c19f4a6ae2b9fceecce7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248522, "uuid": "bef2496e-fbc3-441a-a43e-0213d473ee05", "value": "D7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248522, "uuid": "485bbc28-0d1b-41fb-aa0f-8c4eca8bded1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248522, "uuid": "3ad263b0-52f5-4bea-9ca5-9bcd8fb73623", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620248522, "uuid": "efb006c3-972c-49ec-8ed3-5d8d3d913298", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620248522, "uuid": "79f8681d-eb55-496b-8ab5-14651c849293", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248522, "uuid": "a270b591-3bf0-40e1-8caf-d64f15a21423", "value": "e55710dd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23ed5194-adc4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234349, "uuid": "330ee55d-a793-4bd2-8f1c-b7533f02d33b", "comment": "Malware payload (Dridex)", "value": "899b500ac99195b8cbdf3598b802b550", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234349, "uuid": "95b17675-b4f7-444d-83cb-aca4ddd219e9", "comment": "Malware payload (Dridex)", "value": "2ccc5dbaa17c2065a58b1c8e0fae651f142f5a5d224c0006b3034c32e32d0584", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234349, "uuid": "5fa61f76-ecfe-4520-82cd-d2c196ae4856", "comment": "Malware payload (Dridex)", "value": "46864aa1c6629ebe3f2a22446f32276b5f0cce5d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234349, "uuid": "62b53e42-654e-444d-90f1-62fed1975348", "comment": "Malware payload (Dridex)", "value": "d6955aeecb5af00ffa53e1c84c2097dbf8a93dd901549774f8f22b5e7445198a1b2db7d1eab20cd410fcb8e581ebffaa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234349, "uuid": "2de030a5-136e-457b-a66e-86ecf43bd6df", "value": "7AF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234349, "uuid": "01ecd8c6-ca78-4388-b719-9ffd5979020e", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234349, "uuid": "0d6da567-196a-4bee-baab-fd2ae00904bc", "value": "3072:pWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:p42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234349, "uuid": "1637e2d8-baa6-4a21-ba92-960000e97c9b", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234349, "uuid": "ba5b3d0a-b06c-44db-bcfb-fb35077b2e02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234349, "uuid": "784eaca3-c99e-4d17-b941-4013a273c857", "value": "899b500a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "546139f9-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252469, "uuid": "858a16c8-65fe-42a3-afdb-8ef3de699e8b", "comment": "Malware payload", "value": "ebf3d535800665c306836299e1269a55", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252469, "uuid": "b68f6570-46db-441e-9efb-5d24479f0a8d", "comment": "Malware payload", "value": "2ced9a96e6dfba79a1d7fa2dda16bc8110f80a85f3efafb81fa75d9d2d217b02", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252469, "uuid": "f5483c90-aec5-4329-a419-7ba8187da8fe", "comment": "Malware payload", "value": "2de8ca2ffa24d583d5553d2dbb7153f170873213", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252469, "uuid": "510f4864-a173-429e-8074-e80a0fd0d12a", "comment": "Malware payload", "value": "ba2bbb24a07121f26c8ef42b46b9530c91d645c9827c288dfb78c3ad0693b893f0a804c593a9852262deade7ed569222", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252469, "uuid": "44e6cc82-ae9d-4366-aa76-789c51006257", "value": "EFF3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252469, "uuid": "bd61fcbc-99b6-4f98-a45e-b9a59fff06b0", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252469, "uuid": "49424a31-470d-4cdc-991e-3c5ab0804a22", "value": "3072:kv4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:3DBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252469, "uuid": "305d2424-a8b3-4027-9e4d-9cf114b7a691", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252469, "uuid": "5a0756d3-2e51-469e-a556-2a32a49c09ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252469, "uuid": "8f28eebb-6178-4d4e-b122-d8e781046d00", "value": "ebf3d535_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0610598d-ad81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205522, "uuid": "5d5db43e-c16e-4e9b-8de3-6bf1abd4b953", "comment": "Malware payload", "value": "69fcf7b7222239bc49038a33862c19d9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205522, "uuid": "d6d4857b-2b5a-4a8d-a327-de3d48b5aee8", "comment": "Malware payload", "value": "2d1918afec2114684d98dd27d791d54f478b40783d2bb9b433dc3d1caf690ae0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205522, "uuid": "0cf8bc6d-1f8d-4825-ad1d-d5f9bed4993b", "comment": "Malware payload", "value": "f749e06d079f09c313224fbbfe5025914e11d898", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205522, "uuid": "5b978c57-e894-43b1-83b1-85af16377c16", "comment": "Malware payload", "value": "39cf49120bc2c0de32233a986b871e9acbce80c562c6341840b08a72adcf41060235660d1b9cd34972e76174cc91fec1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205522, "uuid": "beaa6251-bad3-4cc5-a945-fa54fd8cd257", "value": "80B4F1B84FAE3A75E08EA17844562B8C03541CB3DF6E2415399A427B4E05D7BF9842FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205522, "uuid": "2aeea6c3-0409-4fa1-9f73-6737b1ae8228", "value": "83a3c60ad854520e9c527a40183c0877", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205522, "uuid": "674f4986-9e0b-4806-85cf-88b156109dc6", "value": "12288:fCNSuCwFkI7F8UP2c2FTGcnwLH8+w9bejb:6NJJFkI76W2c2N/nuc+0sb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205522, "uuid": "19185d34-c1b7-4a1e-9b65-b53bd72cafeb", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205522, "uuid": "61cd3cb5-fe13-43ae-a675-6c56574a19bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205522, "uuid": "aaf9d46a-7c1b-42a4-940d-7dccdc48e02c", "value": "69fcf7b7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce23d8e-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209104, "uuid": "cf038f1e-299d-4fbd-b766-a7859e413491", "comment": "Malware payload", "value": "679fb94ca94a536b84f76d427ba090da", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209104, "uuid": "b2db762c-c8ca-4032-b02d-6c8844872049", "comment": "Malware payload", "value": "2d19aa18a842755ff00ca3266e749f869223599144eb9d43f25d94201a65fa44", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209104, "uuid": "80d136d1-abc4-4af8-87a6-5cae12bf32e7", "comment": "Malware payload", "value": "2d8c1350645f4ca4b0f57d7d2aae4cbe4c475dd8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209104, "uuid": "8715c625-9ae8-4e4d-b8d5-62d53d451c90", "comment": "Malware payload", "value": "e1dfb7cf4eee7df5ea4114c0fe99ac7ccd59481a99bb47f9d87b2617faa5df30af8ff7b0d450a261750661c3a7f9e2d0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209104, "uuid": "3ef61340-19db-4f99-85b5-f344f7df2a3c", "value": "77D4AD8797E62C50F474EFF21FFE82C20D4E785A05A52B4C0AC64DF24695B2BD19B18B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209104, "uuid": "3a6d433d-9538-485c-a641-05d56c8a794c", "value": "b0f08bb900cdf86ebb6578db862f47bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209104, "uuid": "d6723b3b-64ab-40cc-b07d-058734a238ef", "value": "12288:7YOFjj/yClbdRfaBnkYw2OBvkdyQwu+ZVhK9PNO4OoizUn6YTm:7FMClbdZxDBvkdyVuam9PNxdiAn6YTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209104, "uuid": "1568c61f-7cfb-49be-8764-e6dd59f1d432", "value": 640000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209104, "uuid": "ea8bbc8b-59a8-4cd8-b9ec-0b103c773cd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209104, "uuid": "c106447e-3075-4ddf-b776-efed90c93b82", "value": "679fb94c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096038f9-ad81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205528, "uuid": "0a6f0368-aea6-4b58-bcf0-39bbf3f8bdda", "comment": "Malware payload", "value": "737deac1d01e9717fdfe002d7b871d79", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205528, "uuid": "574971a3-a0da-49dc-af8d-0ae3038241b6", "comment": "Malware payload", "value": "2d3c066ee91a9c4658f7603cb679b93adf8a1b03a0f5cd449b0a4dc9c6c70032", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205528, "uuid": "bc74db02-11e9-415d-8f15-eff0d85c5331", "comment": "Malware payload", "value": "5365ab6c10bb38dbf68299c3c2e760eb0ee7a2be", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205528, "uuid": "9d76c6cc-dab3-4c92-913f-8a6313b9d53b", "comment": "Malware payload", "value": "1e30ffd3bd751af6b4c4417ae3a52297f1d80d44236ef8083d6abffd875d2bc669c2803937d4ec3ea483b8c7f565f8af", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205528, "uuid": "ad4c65fa-09b0-4905-80d9-576d6203c299", "value": "3AF4CFBA667C0691CBDA00BF49704ADED655C8BE96EF8C441FD07A16473BBADB061C0C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205528, "uuid": "8305f57e-9ef9-4e9a-bfbf-10d2befe8e0f", "value": "2ada65e11daac44c27eb12837f5a76f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205528, "uuid": "0851178d-233d-4307-9bdb-f09f6c45a1cd", "value": "12288:ebTK3s1nRcA8RtfOMVXNsU6JZezP3ipPTmmoxC7/4uCQre5LrdJ2jWuNTTm:eiGR/S16xmmiA/4uCQrepqjnTTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205528, "uuid": "1706e960-4821-4dc8-8b2e-0968215902cf", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205528, "uuid": "59d4ad6d-6de2-4aa5-82a4-03877b6c5f9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205528, "uuid": "1c9a5c7a-78cd-49de-b4af-c8ee8efa8a36", "value": "737deac1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0059e74d-adc4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234289, "uuid": "c5fbf2db-1dba-4fd7-b4e7-5b04358815b5", "comment": "Malware payload (Dridex)", "value": "576fa8f79682e8ec1ffd08a813c38d63", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234289, "uuid": "6643fe3e-301c-492b-ae98-cef3032ae672", "comment": "Malware payload (Dridex)", "value": "2dab1b68edcb4c9fd7444996429aa659416f5f7356875d810a325ee4131e0334", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234289, "uuid": "49a4d391-9277-4e7f-ab68-aed8b0e258e0", "comment": "Malware payload (Dridex)", "value": "2c56cc068a3900201b269d82c4994de987789b1b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234289, "uuid": "413c1100-108a-4958-b4b6-1ac81a111407", "comment": "Malware payload (Dridex)", "value": "8372159eedb9a8a6e2f6a497cd1cf4fd2e3a152295bdff3c33fca78376909cfd4080985aef1644fc8b31737f2a6e3958", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234289, "uuid": "768b6afc-f6b9-432c-800c-9c60d4656249", "value": "47F3C085DBABE87FC44A35399072DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234289, "uuid": "46858ac7-96c0-42d6-a647-d58bddb6f224", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234289, "uuid": "990f4389-8958-4ce7-aed4-83f0b8738f64", "value": "3072:/z45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:r4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234289, "uuid": "5298a57e-2e90-4fe5-8841-5d2924af7823", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234289, "uuid": "c027cc73-f2cf-4b16-9644-0dd870b9b857", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234289, "uuid": "d9c054b1-aa23-4888-bcf7-163054c9737f", "value": "576fa8f7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4edcf0-ad97-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620215197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620215197, "uuid": "b267e9a5-19bf-413d-bc2c-93c79600ca77", "comment": "Malware payload (Formbook)", "value": "72014c837d630e0eb8b79d0995166d47", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620215197, "uuid": "4531fd0d-67da-4b26-a063-79c2a7150765", "comment": "Malware payload (Formbook)", "value": "2deb22be02f4464416048e124a39c1a8df4f29ba90d783d27bfcefa29ddce161", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620215197, "uuid": "29fdc598-35a2-458b-b2b7-1d3dabd647ca", "comment": "Malware payload (Formbook)", "value": "57ea4b26a34c0779ae9767cc957452883475cadc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620215197, "uuid": "94e17a36-233f-4ba7-98c8-94442f1158ed", "comment": "Malware payload (Formbook)", "value": "61180771d41c831bb78663828a9c37b3420d898f36197e72c09b922460e7bc960ddf0ded061ed4042d49fd3a261d0575", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620215197, "uuid": "959e69e1-5482-4bb2-8714-20b0d160c704", "value": "28358FA7D349ECDDE5077C324C7D94210067FE8D98A6C66ABC09396494F338236ABD4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620215197, "uuid": "2cc4ce8b-040e-44ef-88c4-2fb8c4671342", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620215197, "uuid": "f8abb23f-4938-4259-857b-f05736bb9a96", "value": "24576:4NXBQfytIslZRxRtGlXwaeXCoociczxtrB9zztzzK:4N6dsPVt5yovBbrB9zztzzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620215197, "uuid": "02445d77-df53-4aa8-a41e-7fea5856104d", "value": 1137664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620215197, "uuid": "7be03651-e397-4f47-b978-9ed3512cee3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620215197, "uuid": "8d73e9be-51ed-4041-971f-46cf034054f6", "value": "Booking Declined.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c39e2d5a-ada5-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1620221302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221302, "uuid": "79804176-16a3-4d25-934c-f1102b5555b9", "comment": "Malware payload (njrat)", "value": "34a167ec71dea14960f86c20713cd07d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221302, "uuid": "4daae805-627d-4222-8b98-e6629fb5d727", "comment": "Malware payload (njrat)", "value": "2e47f47065a13a48ae86ee76059ec4060e397f94cc25aa51ec6177f837314fe1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221302, "uuid": "01991f08-3ef9-4968-8585-0aa8a0c39873", "comment": "Malware payload (njrat)", "value": "e6b55fbb3e8e315c42cbca81b9175d09f8a94b71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221302, "uuid": "286ba27b-5580-4032-8b12-276d47e90f59", "comment": "Malware payload (njrat)", "value": "e984a725903707a54d983b9f002df9dd9b3464cb719769a0ca8b822f0f4ace10a56d415fa5a8e149a1464843006e30fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221302, "uuid": "68d5e2aa-3117-4c99-bec4-a98dd3b77351", "value": "0F545ACD76A78DC3CA5605B07863D12C4373EDABA1B3E34A38B1636EDA612E713605C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221302, "uuid": "83133fb2-e0cf-49c0-8107-2751dd9092c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221302, "uuid": "6a874644-d4b6-444d-bd7b-744162dc8a07", "value": "3072:jrxHkXLxmNfUzNchbaYj3Z4kfhJUvohix4F4az3/xr+VBFaI1YIYiheeeeeeeees:ffZZJthixIZrMBgkSOG9iO2RK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620221302, "uuid": "77f9e5af-1e0f-4b57-bffd-c7cf372f8dbc", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620221302, "uuid": "82db96e4-995a-467b-925f-9481e65cb46e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221302, "uuid": "2550365f-46d0-4dcc-9a9d-9c9975af5e9c", "value": "34a167ec71dea14960f86c20713cd07d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82f1bc31-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload (Urelas)", "timestamp": 1620209168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209168, "uuid": "3557a488-84a0-4e04-96d7-78e6efc2fb48", "comment": "Malware payload (Urelas)", "value": "f5387739c5a34f584e1b5848d8c97150", "object_relation": "md5", "Tag": [ { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209168, "uuid": "b159d55b-6bfd-4e1f-8e18-0d964b8a8360", "comment": "Malware payload (Urelas)", "value": "2e87e5ff2a2cb3922dc5ee250ade39b445ef66ce73c0b36b0948f262ca1164db", "object_relation": "sha256", "Tag": [ { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209168, "uuid": "ca5f8ef3-3c02-475b-9bae-74565d4ef5bc", "comment": "Malware payload (Urelas)", "value": "91b81a47c7766d4308f1303083af3a3a7040f524", "object_relation": "sha1", "Tag": [ { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209168, "uuid": "d892afa4-fa60-4d16-985b-dac6f580045e", "comment": "Malware payload (Urelas)", "value": "7ee5ee62670a533ed2624e642796752c3c4cd7098f7a3218075a979c8a175c9e6d667bcfa5dcedbb3d217fa01c32611e", "object_relation": "sha3-384", "Tag": [ { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209168, "uuid": "f3d93179-331e-44b1-b924-4eb5f51a01ce", "value": "9864DF167600C5A8F7284B32AE56F9D848456E3D98D8E51FF178BF3E293218356B318F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209168, "uuid": "a84c5c82-d008-4ab0-aa8c-2ef405553d9d", "value": "213fb3261acb3f76e42ce8d438d013f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209168, "uuid": "25e9268f-aeb5-43ca-a292-08555d0252e1", "value": "6144:OVt3e7IGxPYznDw3dmy/EBB6q1gBFJV6AvRqsf6YU+FM+3Yn/fCXjQGDqrL:OVtWI6PYznWd1/Tq+Xxvo0U+d3s/fCXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209168, "uuid": "30dd97bd-e0d4-484e-bebb-56c58e313d8c", "value": 332595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209168, "uuid": "1663fb6f-61ec-4061-8b6d-72d7064580d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209168, "uuid": "f9ed8c67-0727-49f0-97b4-890c2c5fdb14", "value": "f5387739_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b595fbf-ad80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205317, "uuid": "0dcfea3d-6a4b-4f97-97cd-6250272abdb2", "comment": "Malware payload", "value": "21c52e1ff3df0dfc4fa44d6928df83a4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205317, "uuid": "54f5a343-e103-49ac-9b5b-de5a000942a1", "comment": "Malware payload", "value": "2e949fd381c6fe57dd97fa241bbc8c530cbc0e85891074056ff4085f0dbd9484", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205317, "uuid": "b5171a2e-6f35-4c21-9147-0a7705d24f4a", "comment": "Malware payload", "value": "dbb31b03170f9b0e0646e6e629470a17fce7e0d2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205317, "uuid": "300221de-d97c-419d-9f16-39c1d4ebd484", "comment": "Malware payload", "value": "590c4f3ba5acb4fcf89270dd36a22ea1c850175bd16062d783aef22d3e50052fca3825b59c6950a2883f69c2f7e4f86a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205317, "uuid": "6664c567-34a2-4ce6-ae97-a20eac28c5d9", "value": "05F4BDEB335B2F58F02B7B71CFD6065415E3BF1446A094613B99CE8A3C891859F24AB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205317, "uuid": "41aab5d1-5f4f-49d8-9db4-f1a6c0b7118d", "value": "7357724455631ec5fb68269972baf1dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205317, "uuid": "75b511ef-f637-499f-80aa-a4f52e4778e3", "value": "12288:OLBBN/DvvD6DS0lQfbfs6FFywBO9v5Hz/qR89GA1qtPMHubstTYmCc4+Nn9WTm:CHwgtFF3yTSRRm09cNngTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205317, "uuid": "989c8dee-5d1d-4bbc-8030-e658b15b7eb5", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205317, "uuid": "fa3ae963-9a8a-4afb-aebd-ca1eea2673e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205317, "uuid": "337b5471-f597-4ca2-b23d-e6249ad1e2aa", "value": "21c52e1f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53799335-ada4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620220685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620220685, "uuid": "1c1cd302-150e-4bd9-87bd-5e8717d2cd7a", "comment": "Malware payload", "value": "5f076314713566765b2b601f9177b15f", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620220685, "uuid": "62eac89f-2f0b-4e4e-bfab-5833f3c67b2f", "comment": "Malware payload", "value": "2ea848d4c401122503219e51e1029a66c3d84f2d4036490adf86ed67078c459a", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620220685, "uuid": "64a533ac-b53a-4487-9c1f-c742fa347acc", "comment": "Malware payload", "value": "c6468d1a92aba7826c78cc65ebc6b511c825e2a7", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620220685, "uuid": "b72b6dd9-e775-4598-8df7-4d9339e7a547", "comment": "Malware payload", "value": "bad073f67026cb5789e689311af9afbba5ec038a3207008e8b5b616d03fecbd836ced976e07090bb3fc18fa69aede329", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620220685, "uuid": "5da09c31-189d-4ee5-a0b9-fe91f34c3663", "value": "0C51971AF947D15C9B75235BEC978962FF1B401B5DA3104C71DCC2455F20809A66CF8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620220685, "uuid": "cd1f2c93-cf5d-4fbe-ba1b-e618e695dad9", "value": "48:AWjQ4+iLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBozf:3gGhrffvIypvK0elkEYZ85zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620220685, "uuid": "afa4a244-7cc3-42b6-9580-03c645eeda1d", "value": 3145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620220685, "uuid": "c8f17107-13ac-46e4-bf82-3d653d17c910", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620220685, "uuid": "885a4a5b-5653-43a3-b9d7-a0c1cd0b24ef", "value": "6Bh75Rs9.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "472cf7d5-ada6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620221523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221523, "uuid": "d62e2791-0878-4d9c-9649-8432a715f5b2", "comment": "Malware payload (Quakbot)", "value": "56b6151dbe9687b3cfdbebd6f841779f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221523, "uuid": "f064ed93-0ba4-48c8-afab-ee11d9084993", "comment": "Malware payload (Quakbot)", "value": "2ee8543b75bdab6cdc192a5a91e1bd8dfe6906b2e13bc4406c3d05f86d6ecedb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221523, "uuid": "5b5fcedc-3bd2-44b5-9e94-3b877213862e", "comment": "Malware payload (Quakbot)", "value": "222ac87b71d663c6c6680e677caa7d108ae3c08f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221523, "uuid": "24ddb8b9-1ceb-4964-a4f8-0e4c10b9cf99", "comment": "Malware payload (Quakbot)", "value": "db804bad6fedbebfc7ebdfa7aa6cb5badc6cee0ab7fd48ab4a0445830526bcd2292de0ed729a3312454b7a9eb7c80e44", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221523, "uuid": "f03e943d-11e4-43a6-8f9b-148c88132876", "value": "91359F73F2E24837D4372A796C7B5758AC39BE106A28B8463FE91D4C5F396803D25293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221523, "uuid": "bf4bdaec-67c4-4bbd-a907-9ce7246e6985", "value": "c9aa71f9d0787376868231a1c3f50927", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221523, "uuid": "e91a8afc-f2f3-4f19-b13e-e37ff8ace5f1", "value": "24576:4Z9vIZJjL3ILLHIxKe075d0ecmDnaSXH6NcLVXrzICEh:4ZUgLHIoj+0rz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620221523, "uuid": "b97fb156-b720-44e1-94f0-4a07690349b0", "value": 1102684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620221523, "uuid": "adbf64dd-2f36-4674-98d5-49230ea68914", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221523, "uuid": "90fa89ef-9c6b-411e-b72f-31420bc478ed", "value": "56b6151dbe9687b3cfdbebd6f841779f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9fceaf-adc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234122, "uuid": "64f1c84a-ede3-4a31-b236-9cfeb69f622f", "comment": "Malware payload (Dridex)", "value": "c6235f1098ef30d7e6de78f41306e5d6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234122, "uuid": "9df3b91b-015f-4c6c-8606-5faf1eb76995", "comment": "Malware payload (Dridex)", "value": "2f588572f7606bfe52355b30cba357436faa146146018bf3a4adda5c08dd3655", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234122, "uuid": "a74b78f3-abce-4c3c-822c-1fc1f8b2e08a", "comment": "Malware payload (Dridex)", "value": "e2a630e00cf395a6910f1f1d020c6afc747c7f6c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234122, "uuid": "fcfd340c-2397-402e-9537-88d797c9eb2f", "comment": "Malware payload (Dridex)", "value": "4059b0966ac8ff957037e10f898b040a54e42987d3fe0afe84440fb7cd0a478664f4169fa5334f30e43c2866baeec5b7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234122, "uuid": "b0e39d9d-acbe-496e-9366-86be88a86acf", "value": "76F3C085DBABE8BFC45A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234122, "uuid": "f0d31e38-7b90-4eae-b0df-7d3e792fff5b", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234122, "uuid": "b79a5a34-ea84-426c-bc3c-060cfa25193e", "value": "3072:lk45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:i4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234122, "uuid": "cc38428e-19ab-4f17-bca7-7ebabb3023e4", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234122, "uuid": "9fe39d35-df6c-4c4e-b9a6-a19735ac19d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234122, "uuid": "1913c074-ac79-4c8f-a1a1-b56ca7be0222", "value": "c6235f10_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f2636a-addc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620244950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244950, "uuid": "d20f4c20-a9bd-4870-a253-7df01756dbba", "comment": "Malware payload (Dridex)", "value": "06c4f827d0c20563cb74add848366eab", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244950, "uuid": "94b1fdac-80ef-4b50-bfc3-1c7f545d1ced", "comment": "Malware payload (Dridex)", "value": "2f5901c95c3a30b834868dc9e3f969ce1238facb02d986e80305a075dd17a2cb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244950, "uuid": "128c19df-2d24-45d3-8506-3f9f365a6001", "comment": "Malware payload (Dridex)", "value": "935b98ee2e601c1ff09914a0e6e1a52ad7170fca", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244950, "uuid": "5a2f872d-4633-4942-987b-d5b889a4f733", "comment": "Malware payload (Dridex)", "value": "3216ed3fe2a6ec7bc6aa746f4c740569296b264836cdbb1ff643df1e6239fb5e845788a27f0b494c244a4dddf58b498a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244950, "uuid": "16f3716a-9add-4c66-9c07-af3ee748eeca", "value": "5EF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244950, "uuid": "03170a56-148f-4d13-80cc-28ee92311b33", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244950, "uuid": "1789f412-f9ac-41c7-93f6-57499c311510", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620244950, "uuid": "6384afd8-5254-4da4-bc0c-adf390515a5c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620244950, "uuid": "5d311e7e-a018-42ae-9aeb-10dc633064eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244950, "uuid": "c02f4014-1a8f-4d92-8425-053468ded5d9", "value": "06c4f827_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded7db1e-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252701, "uuid": "e4951cd9-c10a-4c50-ac3a-f1cc1f08c99a", "comment": "Malware payload", "value": "0e79b9fef07ca46387bfe1d538965a08", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252701, "uuid": "aa87dbf7-b8d3-496f-8559-96a6bb56fe1b", "comment": "Malware payload", "value": "2f5eae03b4cce24b40c28992a2c455c4231391f255b98254f47282c2b2d1de19", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252701, "uuid": "c4269fc0-f667-43b6-a8ad-60c4e868fcca", "comment": "Malware payload", "value": "661b35f2cef054f5b134abed3577f6c35af639b2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252701, "uuid": "af0801a8-7bf6-47e3-a691-827dc95b1349", "comment": "Malware payload", "value": "405257a32d398ee0c25c7e3921977545d461c71dc7be13308d4d54a774346e11738f3af37f93f0dc9228214073cbaa19", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252701, "uuid": "aa97d9bd-0379-4107-b162-13e4f54dde98", "value": "F9F3C085DBABE87FC44A35399472DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252701, "uuid": "cd682e3b-7b02-489b-99da-cf5739e5513b", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252701, "uuid": "5274217f-c3d9-416f-82ab-dfaf99d12560", "value": "3072:PL45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:D4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252701, "uuid": "0a5ba7da-52c1-431c-951c-721a055b0766", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252701, "uuid": "8ef7b8c9-9b18-4aa8-9ec8-c0fcf5cfdadd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252701, "uuid": "83d426f9-8b66-4e2b-b53f-4fea1f2594db", "value": "0e79b9fe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ddd8c61-ada6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620221561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221561, "uuid": "ddceaf43-d79a-47fe-95f5-f8d2b3ea5ab3", "comment": "Malware payload (Quakbot)", "value": "fda4160ad61026ee43643c07542be6d7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221561, "uuid": "6fc88552-d3dd-434a-a949-8cd0f4a30b54", "comment": "Malware payload (Quakbot)", "value": "2f7d29be2d877a68803d29ca5ca64d84d5f0e49705c1ff84f0bd5dfc91fbced9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221561, "uuid": "7e6ac83f-774e-4d84-a28a-fa7a48ffc733", "comment": "Malware payload (Quakbot)", "value": "beca4b1b2da1dbc222705a24a514c8bdf78aaeb5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221561, "uuid": "bd36f482-e4f3-4df5-ae99-ccc4ba4cb376", "comment": "Malware payload (Quakbot)", "value": "a37b0502cd001dcef8afa81a5eb90c0e142b2cd103e31c8b5f0f706450f62b7b9430eaef52b0f5b9a30922ae970a81ef", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221561, "uuid": "91d5f8c7-6e07-414e-8990-2df5cc34eb79", "value": "57B4BF7CFF668973E1142FF1A3C35F940A53A9D175A0610E42B11F6E3DA93D5383AA88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221561, "uuid": "5dd0776a-9e15-4dba-947f-1242c173457c", "value": "d4b10803acf444b49f2549bbf867a9f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221561, "uuid": "35287ef7-6437-4c87-8f1a-6dfcc2285768", "value": "6144:U0LcdcjuQ/9zoaV3EeVHq/Ca6VbrdRNXh:njuS9zoadEYHq/CjtNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620221561, "uuid": "d3c26244-ee85-4acf-92dc-d8dbb1df6c30", "value": 498589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620221561, "uuid": "4a66f520-817b-49f7-885f-5225debb918d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221561, "uuid": "9e8461c1-bb11-461f-a62c-88a9bbcb93f2", "value": "fda4160ad61026ee43643c07542be6d7.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0102f4d-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252730, "uuid": "63b95456-0c84-4b7b-874d-29549e9443d8", "comment": "Malware payload", "value": "f45dfe1d1385f1e578bde04adb932908", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252730, "uuid": "dbd81203-d72c-47c1-a07c-2b34575dd873", "comment": "Malware payload", "value": "2f9b78e93257634b12ce66128c1fea53da27ed7bf508a4c12ca90feec7c4279d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252730, "uuid": "b2e891b4-3603-4147-a429-29beba8ce0e8", "comment": "Malware payload", "value": "d68a008d4753f3b5cbfa7bae02c8bf251343bdd8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252730, "uuid": "60e73af2-0477-4201-9295-4bdde40edf08", "comment": "Malware payload", "value": "4d23e901463a9f72f3e213d22f80721f3e0f50be18f4d5271ff3c7b84c6b8ed0dabccf314193b1c43735555c4d3255bd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252730, "uuid": "8b8edd0b-d502-4975-9271-f7fb798864fc", "value": "DAF3CFE89A9FC097E663583055FF3BB6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252730, "uuid": "242d98ba-8c46-4d51-b1b4-282600ab168a", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252730, "uuid": "7cd58dde-fc8e-4d7a-a636-ef4c661800f1", "value": "3072:yf4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:VDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252730, "uuid": "df660e6f-5206-4cb0-8df5-580bc6042709", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252730, "uuid": "b4eda22a-faca-4682-bf4e-3ba89bfca5e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252730, "uuid": "990a1cd8-7afe-4f17-90fd-0c754cde5827", "value": "f45dfe1d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b7549a5-adc4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234361, "uuid": "0e96c3f8-0231-4b1c-858a-da5c17cab0f0", "comment": "Malware payload (Dridex)", "value": "af37bbd8d563b5284f40bd2ec1a5a4cf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234361, "uuid": "e66fb601-a907-43b9-b484-329611afb2d2", "comment": "Malware payload (Dridex)", "value": "2fa9d2802209c6734ea3903dd2c0736d4f3e62ca809908561885a3ee36ac221d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234361, "uuid": "e4158b89-f14f-40cc-8877-fe2fffe86891", "comment": "Malware payload (Dridex)", "value": "9d2d1d06b1313127c26a2c8a446f99c3538a11f2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234361, "uuid": "3abd6872-cdfe-4fe2-b2f8-8600b5590514", "comment": "Malware payload (Dridex)", "value": "c5ac3f2331393402faf9eb3a44534277908c1409870ec5e9a2d7d0373d1fe96b93eac9b580b7268afad74760945a240c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234361, "uuid": "952388a4-f11a-4a38-b75b-5a90b90489c8", "value": "05F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234361, "uuid": "07c69b67-a484-4b20-bdde-f11248470b6e", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234361, "uuid": "00720ff6-9e9f-494d-af23-7a2e328f3384", "value": "3072:MiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:veAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234361, "uuid": "45d14083-ee60-4e9d-9809-b530d6f94cdc", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234361, "uuid": "0842e109-bebe-474d-8efd-e115a84fa208", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234361, "uuid": "9ee3dc51-fd27-4a5b-8bd4-5697a64990ce", "value": "af37bbd8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba9bd4ff-adbb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Stop)", "timestamp": 1620230736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230736, "uuid": "04bd9f22-3453-41b5-962b-86a50706f7b6", "comment": "Malware payload (Stop)", "value": "3273348793ce07669029002d75dd8537", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230736, "uuid": "5595b3ab-b690-407c-a40d-25fd009fe78a", "comment": "Malware payload (Stop)", "value": "2fb3d980507741c8bbe5ddaa3ccee423d774bb9ec2f1c21c74b2eef05a5c62c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230736, "uuid": "e4a894ac-f522-4e2e-b4fc-390d257d4801", "comment": "Malware payload (Stop)", "value": "569b75917dba0c6e8c3b45cae6f66e1258316b57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230736, "uuid": "366806aa-c450-46a0-864d-e78cb1d6d85d", "comment": "Malware payload (Stop)", "value": "dbde70cecd4ec8672666d5a667c976b97cd98a1bfc574c3dc2445388a34f111f62c5834390044f13b27983defa5ba746", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230736, "uuid": "3f50ab9f-c307-4a15-9b31-acb45cc1a7ab", "value": "A305F130B680C035EAF715F88DBA927C653C7DA25B2550CF22D42AFE56347E9AC3125B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230736, "uuid": "e3ad6aa8-7d6f-46a1-a7a4-b4aa01a94f52", "value": "a1c88b13accb8a974af32f5b576dfc92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230736, "uuid": "e8b12de1-9c79-4303-b55d-a0ad81171795", "value": "24576:nRguPthdB32a+di3WqdaTbftfm6Wy+RBE:qCuBY/a/fI69kBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620230736, "uuid": "0992cc7f-306b-42f3-9c78-3b5f35685e25", "value": 850432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620230736, "uuid": "61098a1a-8d74-4b84-bb11-cc26e9e3590f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230736, "uuid": "698ca410-d2d0-46e4-bdc4-eb6890bc7d00", "value": "3273348793ce07669029002d75dd8537.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb53216-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241638, "uuid": "e827a61e-714c-432b-95c0-accaea449217", "comment": "Malware payload", "value": "60f3690c11c1506bc9fbd410ab70b77e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241638, "uuid": "9f05d4d7-a9c7-4b9a-9db1-3685d04e24ec", "comment": "Malware payload", "value": "2fc261dac9cb67ef37e1073c42b3c7f6cc4478575e83836e4bbf34fb17e6ca39", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241638, "uuid": "4d4f4038-b637-45ce-b05d-c5ba99fd1873", "comment": "Malware payload", "value": "6d76600f37a798dc8bd520c1c23a5ec8d2428d94", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241638, "uuid": "4a461dd9-b47e-4e87-82c4-b99b3beb5df8", "comment": "Malware payload", "value": "f615f1ac587114e097af7796b834f9d3fc86e294e13bad83079cfaac63702b22ebfee7b60b93d7fefc2d72d0205938a1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241638, "uuid": "a999cedc-e767-47d7-a303-df1aff4423ce", "value": "B8F3C085DBABE87FC44A35399072DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241638, "uuid": "83f4b181-9932-4634-adb0-506b6411c49d", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241638, "uuid": "2eea047e-6cdb-4c46-a114-bf8a3a2b0cb7", "value": "3072:Ui45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:x4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241638, "uuid": "8b6a7def-235d-46de-98bb-42e49f5beff7", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241638, "uuid": "bf885c2c-ebc0-4bf5-b371-f15097b158dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241638, "uuid": "d8186424-38cf-4a7f-9781-5cec89b3d190", "value": "60f3690c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a602f6-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252745, "uuid": "df34d889-6ada-49ac-a7ae-9e4df14105b3", "comment": "Malware payload", "value": "51c09538cad5be7ded31cef71879b5eb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252745, "uuid": "7cc6d8ab-4439-4e88-99dc-5f80c286f7d1", "comment": "Malware payload", "value": "2fe632b88efb89c4f7e73184829083212104f27240bc7ad35de3b4ec3e404b6f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252745, "uuid": "80d817ae-4860-453c-905d-cd20da966d37", "comment": "Malware payload", "value": "6017cc070fc5affddf3f393d7f29a8f8604ab97c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252745, "uuid": "361404c1-39ab-4269-81be-7d28661d8527", "comment": "Malware payload", "value": "6b79da369c5ccf2743fded6f6fd2a09e91091c7eff499ba591935e2b2d827b718be7d30160af0fef508e3031d34ee4c3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252745, "uuid": "3256c55a-4537-491a-bdc7-4139e6a6c990", "value": "03F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252745, "uuid": "0d004826-3ed8-46df-a1cc-17b9a988ddb2", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252745, "uuid": "607031ae-e6fe-4e9b-aba0-d0fbe1d6db18", "value": "3072:Klpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Klo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252745, "uuid": "037543e0-e29b-4167-8ec9-c49d1d6950df", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252745, "uuid": "a92a6cc4-afd5-44a3-9dd2-d62a212a9237", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252745, "uuid": "b589f4a9-36f2-425c-9d91-d182a9898d26", "value": "51c09538_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e57532-adc4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234329, "uuid": "aedf2c24-2499-4cf5-8fdc-42e52433f700", "comment": "Malware payload (Dridex)", "value": "943ff57ea130d94cf8d841d0347e17dc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234329, "uuid": "818aeb0b-9a27-43e9-be33-d59e1cad630c", "comment": "Malware payload (Dridex)", "value": "2fef99edb88c6edce2b775afe1db1fe243fb5782d0f9fe87ec21c82f54eac3c4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234329, "uuid": "b92c3ba8-46e8-4126-a278-c0f4c1a5cb36", "comment": "Malware payload (Dridex)", "value": "df2ee2478eedf68355f6f45ec94344f31ec31c9d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234329, "uuid": "881cfe0e-9086-4a78-bbd7-92de17dc561b", "comment": "Malware payload (Dridex)", "value": "07411473a512e31a56c12dded8dd42175b323816720ffbaa8974a9ecab4cbf1ab97b27743ae2f529788b9f956bfbbeaa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234329, "uuid": "30bd1c63-0dad-46cc-ad0a-f6ca7cc5a842", "value": "E1F3C085DBABE8BFC45A35399471DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234329, "uuid": "15b51982-f8af-4588-b478-f27364fa069f", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234329, "uuid": "14ff249d-c802-47d2-9425-bdf532f555a0", "value": "3072:cO45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:F4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234329, "uuid": "6647d130-9a93-4f4e-820a-43c16fbe9256", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234329, "uuid": "52610a0d-4490-4afb-a164-a490bc081f47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234329, "uuid": "e821b2d5-b2c8-4ae2-a27f-537598ad0698", "value": "943ff57e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b4bb464-add4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241394, "uuid": "9e03506f-b657-4a7d-b535-641492f0ca52", "comment": "Malware payload", "value": "a153b203daa5a19710c476dea39d548f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241394, "uuid": "8069f7cb-b05f-4eba-9586-f7c064e9f6d1", "comment": "Malware payload", "value": "30825ed21a6982660de7685934092e3deb9d6c2e545e6e5cbb429be3eea4a988", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241394, "uuid": "7987ad63-2e8f-4144-88c9-74cccfc33d65", "comment": "Malware payload", "value": "38b86551bc530bb127dbda2f98411c797e5185dc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241394, "uuid": "2c5fc90e-8cd4-4b7c-aab5-fb19425719fc", "comment": "Malware payload", "value": "4d9068c6e2bff1e4d7cbc3f7571ea2ec4581d840eaeb597569a3aac2f8864ccdb29765d579f0e8ae36eff51481f9f541", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241394, "uuid": "68730302-8864-440c-b0f6-627329fcbadd", "value": "D1F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241394, "uuid": "1d60ef04-f32d-481e-9c9a-50877a0a4030", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241394, "uuid": "f30b224d-b1fb-4534-98e0-f479a096a475", "value": "3072:ViFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:+eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241394, "uuid": "710e4d8b-7ab0-4588-92f0-bef3dd193b16", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241394, "uuid": "35be3d3d-f0ce-4feb-bf25-59efb0e0f6d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241394, "uuid": "1413b172-957f-41f0-b935-1620a9578e29", "value": "a153b203_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22fab9b9-adf6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255822, "uuid": "759ee19f-aac2-4c24-bcee-fc14aedf5b0c", "comment": "Malware payload", "value": "68b0c80c15bcbb44e89c29605146f634", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255822, "uuid": "7d68b787-9f87-4346-94dd-91a294cb4b7a", "comment": "Malware payload", "value": "3089d06e7b30f29bceb372e3c4c33f5a2ab5e4d8ff598014453b3c6fc232e628", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255822, "uuid": "b70233a8-366c-4a38-b9d1-87ab8160d0cf", "comment": "Malware payload", "value": "e4da5dfd1257482fcffcde04abef8c57114adb36", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255822, "uuid": "92787f89-9214-4000-b4ca-0db0905f15bf", "comment": "Malware payload", "value": "c609e179c87866b092625ded1722b90f71dc95e828224eef34ab7933b216a2e129df653355155163223a8bb474b21b38", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255822, "uuid": "b9ea3fc9-d061-454c-a746-6aeb8118b31e", "value": "0BF3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255822, "uuid": "43e42ee8-9019-44e6-8812-1efc73606189", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255822, "uuid": "ce2defd6-e9ba-4915-accd-a6aad1ac4797", "value": "3072:I84Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:sDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255822, "uuid": "d4b07dc0-36e0-4a8d-815b-fb2ed7c35a16", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255822, "uuid": "b0464393-fc58-4d2d-8df5-1c344d21e861", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255822, "uuid": "091741f2-fe89-48a0-8ce6-2a344392d392", "value": "68b0c80c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd882f6e-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620202072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202072, "uuid": "41063e28-104e-4cc9-8ee2-7726040a5245", "comment": "Malware payload", "value": "639a06151b0ae8984026cf1c44860587", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202072, "uuid": "f10b62f1-e266-46d3-b37a-c1286f292ba7", "comment": "Malware payload", "value": "30a028001a68cdf37581ab6f3ce9a246ace357589a0f01105f432c09746e317d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202072, "uuid": "c9f67847-5ffc-4407-8c37-d88bc33bdf8b", "comment": "Malware payload", "value": "5d350944358d02ae36c40fd539e944b7aac901c8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202072, "uuid": "06cee5de-465f-446a-8e4c-767b5fb2f4c5", "comment": "Malware payload", "value": "ad03da4eb7fdebfca20b1c1604862bff947cc8b18d9496e7a4909a0758a72d3f398d933a9b100b2e4db9a130ac0343c1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202072, "uuid": "cfe2b276-08e0-49bc-8813-cdeb8ab5142a", "value": "1DE4E1CBBBB5568CCCBD4AF6DA0A92A4F9CA8641CE81409DC739FEDA9704591CC543CC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202072, "uuid": "c952691c-326e-41ce-97d9-b89220888d16", "value": "1dfdfc74a9b7676c1576b0d959d36f3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202072, "uuid": "914ca8d6-f334-4606-aa21-536e6ad07c62", "value": "12288:KIYm74HHRmpTDZRrl9uLoVaHorG2iyg5u+eCWGuq0LKHoPc5ahlhYlsF:Ktm74nkBDj6eakniyZ5CWGR0uH4ly6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620202072, "uuid": "a4f3e63b-d132-4cc8-953b-3fec7acec41d", "value": 672768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620202072, "uuid": "f457f761-b541-4c75-8fc9-87b710fdbb4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202072, "uuid": "0cd8572b-146a-4aad-9739-3be1811c505f", "value": "639a0615_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec7b6236-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212781, "uuid": "848923ec-0816-4733-a3a2-0dec92f91880", "comment": "Malware payload", "value": "b546cedcb4435270fc5d6deba093ee84", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212781, "uuid": "9e95996c-9852-4c96-9229-8e73d220c7a1", "comment": "Malware payload", "value": "30a6f22e80823e7cf9e472d687f4621bc1e9b3cadb9e21db665e15bc43ebafe1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212781, "uuid": "244af0b1-d075-4dad-9c84-a67466206ac6", "comment": "Malware payload", "value": "c477284f3a5c23df842a76d475ce998c149ac1bd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212781, "uuid": "b2fca776-efbd-4506-93a2-c7e4f057284c", "comment": "Malware payload", "value": "ee83a6d082059547372d4cf38c740e0e4b6908b87bd148e5caaa1c8b97f4010305d1b55d446418e0738e1c31bacc6d8b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212781, "uuid": "625c1cc7-0d30-429b-aef8-f32413020359", "value": "69E28F8AB603A8F7D95732B000DE96B7DF7FA9218D71883ED670E9706F57890BC24215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212781, "uuid": "92749de7-b535-4bf8-a7f3-e1a14e376469", "value": "bada59b09f06f9c01c84b065a341cf6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212781, "uuid": "0165e52e-a17d-4597-9281-e7f0aeba4a07", "value": "384:tPpOMLnVCiL5WTdCSIww/2AynSTXZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxl:tku5AmOwNQGPL4vzZq2o9W7GsxBbPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212781, "uuid": "d210758f-aefa-4c19-8906-a7d545fbdf5f", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212781, "uuid": "c38f8966-808b-47b2-8931-c81e76425120", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212781, "uuid": "6dfdd308-dce5-4d2f-8311-ab62f610a5a4", "value": "b546cedc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86e2b85-addc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620245013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620245013, "uuid": "addc842c-b224-458d-976b-eadec136e527", "comment": "Malware payload (Dridex)", "value": "3ced355add46f79c315d379822fccea5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620245013, "uuid": "3f9054fd-e93b-4f17-a335-2e8d9b6b0a99", "comment": "Malware payload (Dridex)", "value": "30a77ea833b490a46a89857d7eb08c85134a24f36f76cf2e53be74d2ce94c46f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620245013, "uuid": "80e59cf7-05d6-4e39-9832-098adc2e806d", "comment": "Malware payload (Dridex)", "value": "1f49bcdbc5e62dff8ae1b4d23fb87ad6d6c60c1c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620245013, "uuid": "5f7a407e-f960-4eeb-97ef-458b2f711827", "comment": "Malware payload (Dridex)", "value": "6d4372be3ca6e2027c7e1433bd3bf0ef88db911970a74cf963d7e903210b88f93e9b41c36a38e01eda31a9efb56729ff", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620245013, "uuid": "814d8ef3-6573-4c5f-931c-cdbc3cb430f7", "value": "DCF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620245013, "uuid": "9ece8f7a-2b6f-47f8-ab0d-a6e59728265b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620245013, "uuid": "b592b107-4197-42c0-8a36-9917fb6dd384", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620245013, "uuid": "d1e3941d-f341-4eb4-88eb-9070ca913c8f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620245013, "uuid": "5dbb8db2-e2c7-496a-a6d5-6dccb7ff1d4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620245013, "uuid": "a16f68c3-aba3-48c3-a9b3-2c31c815be79", "value": "3ced355a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82649649-ad80-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1620205301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205301, "uuid": "48e0f031-f619-4e0b-a69b-efd5ba0e4ab3", "comment": "Malware payload (njrat)", "value": "d41137ea5c3598d8c7d4f111de0b2110", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205301, "uuid": "5397cf32-452f-48c6-90d5-074f66882c3c", "comment": "Malware payload (njrat)", "value": "30b32245e60aa287c9db02fd22cac3ebd64b78c51c9fa38fb4191678b3a71405", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205301, "uuid": "2706d4a1-fd39-40ee-b6a1-4a7379fcb138", "comment": "Malware payload (njrat)", "value": "97fbde4e3f19911cad767e4e3fbc305669316b6f", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205301, "uuid": "787e0b76-2545-4ae4-80f1-5f594a0bda56", "comment": "Malware payload (njrat)", "value": "6b8e86c8666966cab85a051d5ae6aeba948c993c2f789ccb74c4d1cba7023fa28f5668e05c1293fef74e97d09513b702", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205301, "uuid": "732091ca-60a6-44b0-82b8-01180e0ad9d6", "value": "FB558C03739D9026FEAA927F5B55B20156BC7D2401E3872F12983D6DA9F03B11E3DE62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205301, "uuid": "3289bedc-0fec-4cac-866a-6c04b913fc83", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205301, "uuid": "784df3ac-e1ca-4bcd-88bf-2033b73d1b0d", "value": "24576:4AHnh+eWsN3skA4RV1Hom2KXSmdabxrhteX+57:/h+ZkldoPKi2abxrHR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205301, "uuid": "2e60059a-b8e8-46d6-9a3f-e5fcf80078e0", "value": 1328936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205301, "uuid": "3241b487-9479-439c-9729-d59cffe1e27c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205301, "uuid": "98da5aa0-da95-4d19-a172-67ade465d662", "value": "d41137ea_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b395a0d2-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252629, "uuid": "1efc88f7-fc10-490c-975b-3d93eb96181b", "comment": "Malware payload", "value": "79816e5a757b5aa6b196fbd5e3238b5f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252629, "uuid": "f1d949b7-e989-4fb0-9659-ebee2b196b4e", "comment": "Malware payload", "value": "3107c2337d6ebe28ddc33899b084ed24ffcd6ce2a8a8bd167328466359ee9e7c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252629, "uuid": "da6db400-7ed7-4631-a5a9-07c637b8f979", "comment": "Malware payload", "value": "5b9db20598cadfbc9af618a2f0e4eeff6d156a26", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252629, "uuid": "cd66d144-21a0-4278-acd3-df5aeafcf7a1", "comment": "Malware payload", "value": "b5daa83bfd38d90b1a749c802af5394c7916bf0279a9ff83126ae0d0859ceda43a2289f951f2b5b4ebcbf4def9b78d93", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252629, "uuid": "e05ca143-bc13-42a5-bdc5-a54c7a164c11", "value": "64F3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252629, "uuid": "8ad7d30d-733b-44ab-9522-0debc3490fae", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252629, "uuid": "013345c8-3594-491d-abcc-c4368638574c", "value": "3072:Sx45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:Q4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252629, "uuid": "d33ed08e-84dd-4df0-918f-c8550abc0171", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252629, "uuid": "d2a48a61-8a4d-4d62-8da1-656b20377644", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252629, "uuid": "9af0892b-1aac-4e0b-a537-858e6ef104fe", "value": "79816e5a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d328523-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241666, "uuid": "7c981fd6-76a9-4e68-88a7-f344207816e2", "comment": "Malware payload", "value": "8da874a32b139b8afcbb2361e3e98aae", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241666, "uuid": "8ff4cfab-a74f-45c1-81ff-c6ccfeaaa8ee", "comment": "Malware payload", "value": "310c9aed586389fa1a88941db432a0e47e48ff41e0e72794d855c6a475a391eb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241666, "uuid": "a6170baf-de24-46ac-b810-99851cea03aa", "comment": "Malware payload", "value": "4b4672d1c48e647238ecedf02c2c12e866973d55", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241666, "uuid": "5e359155-0b2a-4929-ba09-fa8da813d6da", "comment": "Malware payload", "value": "eecc7510d03f174072bec71935f728dcb8a0211b63f1e416ae0deb7fc90a40754fd6a1dfed1eb1de33387134e78fd3b2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241666, "uuid": "74c9ee2c-f314-4089-a9d3-77a9d65988d9", "value": "ECF3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241666, "uuid": "aac2fafe-f85c-422e-b323-5592016d8e22", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241666, "uuid": "5cc95a50-9b00-417b-8a2e-1dd92b6a0ac6", "value": "3072:ri45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:24KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241666, "uuid": "ec7a4827-22ee-4aa6-81f5-1699af8c8021", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241666, "uuid": "91f047e4-ffcc-492f-b181-565da1243d60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241666, "uuid": "ad491e2b-d721-4b3d-aac0-99b80bc6e7f8", "value": "8da874a3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f9df2d3-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252380, "uuid": "2fbb1569-dc7b-4da3-a096-a3688bad86f6", "comment": "Malware payload", "value": "8ba91e2a1b0ffbd281c8abe26cc8cb13", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252380, "uuid": "85f27567-2fc3-409c-9451-187e2823a5f4", "comment": "Malware payload", "value": "313819eb9b21d7cc9e9ac8263feb63820c3809d383a2e1f058f91f2aca622bc4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252380, "uuid": "4993b1e8-a543-4c18-9acc-867432317e1e", "comment": "Malware payload", "value": "590b2a4f36670af43956030d4633c0f8a09c356f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252380, "uuid": "fff0b140-b7f0-4be0-9ded-0103598abfcf", "comment": "Malware payload", "value": "b950312877043d5693408a0b9cac5bd8112a05a4c1e28b6944229dca0c6b2c19a320f757a485d6792539a8d663e263c0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252380, "uuid": "9d3e4c64-af7b-4da0-b26f-ef19e6b4a2a6", "value": "CBF3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252380, "uuid": "33b276ab-2a48-418d-8ced-2e1aa4c161f2", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252380, "uuid": "5468707c-2280-44f7-889a-e4f04c7f9b0b", "value": "3072:Xc4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:jDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252380, "uuid": "d94ed901-224e-437b-8289-bd6d6b97ccfb", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252380, "uuid": "1036264c-8be0-4f30-b77d-7cb42e833ceb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252380, "uuid": "edaaa5f2-7b07-41db-b0eb-9ef3c46a1396", "value": "8ba91e2a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c4a6259-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241772, "uuid": "de02d092-49aa-4706-b2eb-54274deafd7d", "comment": "Malware payload", "value": "94a9ce4d5b0568238329994d4d5739d2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241772, "uuid": "07c367f0-7df9-499f-9465-936849ddf6b6", "comment": "Malware payload", "value": "319d804c7df7eec59c3fe9d733c6248ee861955d445da5595f525eb1e69b5b7f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241772, "uuid": "83efa0fd-8580-43e7-bdb4-b81ac4f5eb2f", "comment": "Malware payload", "value": "e5d4ecf4dcc641b4a310f99a95cedd03d81fbe96", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241772, "uuid": "f50ef2db-2c37-4eb3-a82b-ce6ae347bb66", "comment": "Malware payload", "value": "aebb0fd6b4f377a7829b64ff7c676e506d7a69b023ef94ee82fae979b5bf06ba5c35d5fc4b8ffc47dc0b5e08ecfede6c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241772, "uuid": "5b728560-e795-47be-94e8-0b648df69910", "value": "B4F3C085DBABE87FC44A35399472DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241772, "uuid": "0ab710ad-f173-43e6-bb86-6b0bc3c92586", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241772, "uuid": "3870d6f4-b4a9-437b-9e2c-232ce02cd5f3", "value": "3072:TX45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:z4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241772, "uuid": "7ef10364-bbe9-402e-8343-e6d24352f048", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241772, "uuid": "3cc67ddf-9ae2-4b25-9cad-688d6137c666", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241772, "uuid": "9b6a0452-3644-468e-b121-b3ff3e1f8973", "value": "94a9ce4d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58fbccb8-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241739, "uuid": "be0a2bef-d07d-4253-a8bf-6c74f08f985b", "comment": "Malware payload (Dridex)", "value": "16f0c7e867734ef7979b73b8f821acf5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241739, "uuid": "d814d0d2-6b6c-469a-937e-5a5445dfe1c7", "comment": "Malware payload (Dridex)", "value": "31a9bf014f419c07c45115526f4a7bd45bcd1213e6472c2c0a4df8ef904123b4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241739, "uuid": "8df1c5e0-71e9-4262-93ed-00aa0334228e", "comment": "Malware payload (Dridex)", "value": "75a5108a429ba4b81526a4b44011dd70c9447bb7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241739, "uuid": "4c5180fb-5ba2-4661-9271-01148675206d", "comment": "Malware payload (Dridex)", "value": "78f5fcc7dd1e3406d49a887557bf2f7d437df3a46136e840d60f090179011865c887390480063bf134ab1f2ddd230daa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241739, "uuid": "801226bc-9462-46cd-ac9d-02c847f71dbb", "value": "F3F3C085DBABE87FC45A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241739, "uuid": "cb64c9bb-5888-43fc-9fcc-6add16cd33f6", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241739, "uuid": "8c82648a-9892-470a-b9da-89f16269a09f", "value": "3072:/945bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:V4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241739, "uuid": "d239d9b6-2ec1-41e7-89f7-f63171efb61c", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241739, "uuid": "f68fd5a5-491b-4fa5-b71b-0af12607ad45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241739, "uuid": "046cfe4f-7c4e-45f6-bae9-b2458ea67389", "value": "16f0c7e8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1822724e-adef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252797, "uuid": "b54f1417-1369-4e28-b046-067646cd5dd4", "comment": "Malware payload", "value": "fc2bf5b6fb54a5dcbfeb2b3ceefe7847", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252797, "uuid": "51a93242-e326-40ea-8d32-4bf6461c987a", "comment": "Malware payload", "value": "31bdeab1debb88a0419fb96a4c8c416808b73b8aba27f71f00d91c72223e867c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252797, "uuid": "d6e0db77-5742-4aef-8c8d-0858565509d5", "comment": "Malware payload", "value": "9960d31da5b9142b6f3ead33d197065f013d50a3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252797, "uuid": "1da10e30-061a-4e6e-b036-078bb0507e68", "comment": "Malware payload", "value": "e36245e12cc2bb64f7b5687cce786e556a296dd20d4c601e6427d9edc2bd1ffa493cb74c2ce1e8513468cc4a49d25a88", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252797, "uuid": "f246d021-61bc-4690-90a2-bd54aa4f2437", "value": "EED423896DF62D6148CB1D281EA3FD284A1E1B5B717791200D4ADD8B94CCE2CECD7E89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252797, "uuid": "0cb12177-2fab-4b28-82a6-d76a10cb1062", "value": "12288:1Zd0WDTc0khcSS9utlfxaiYpue7fW/YJIz9/dSMmEbexp7Dc96:m+c0khK9ukaeCQc94MhexpHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252797, "uuid": "60d6b7ad-16b1-4d25-a2ed-b5d38831ca4c", "value": 653983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252797, "uuid": "721dd57c-afc6-4439-a2e4-7cd79cb00814", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252797, "uuid": "a073ec36-9a48-453a-b3b5-401ba09916c0", "value": "fc2bf5b6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a885fe3-add4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241366, "uuid": "6037530d-cd23-4b4a-bbe9-8c565748ea5d", "comment": "Malware payload (Dridex)", "value": "7c6b73c64010905eeb86a8e4a4c7b9bb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241366, "uuid": "953b6d79-457c-4770-bb4e-f3bfe1d0684d", "comment": "Malware payload (Dridex)", "value": "31c8ffd05e98607680181f861f2b41fed32dc3d575fe5259dc21126c7bdada10", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241366, "uuid": "e677219c-a808-4819-9365-91ccd22a982b", "comment": "Malware payload (Dridex)", "value": "ed8c91f25ccaf1e3af1f53f45d6dcf551a3dee9d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241366, "uuid": "7879cf7c-b960-4c3d-b35f-90b7738b84a4", "comment": "Malware payload (Dridex)", "value": "2853830bab94959cf5fb95476761b8ec9053a58401540cc1e1dd9a576b459dc4a0bbd18836b47719634a6801e34906f9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241366, "uuid": "847a811d-bec2-4b57-b753-14a2637a9136", "value": "3BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241366, "uuid": "08fd0103-4924-47f4-86dc-d5a365b416c2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241366, "uuid": "f8cb3792-5c87-4553-8f9e-1c25f60f2b68", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241366, "uuid": "fb95c37c-5133-4061-b4aa-03d98bc3959a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241366, "uuid": "d54f3f15-98d5-41c9-9827-4b2d90fa473f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241366, "uuid": "453d2ce0-898e-41c1-bd4d-24b25c316755", "value": "7c6b73c6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aede96fb-ad9c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Stop)", "timestamp": 1620217402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217402, "uuid": "c71fdab5-2db4-4ca7-a542-b55972912b73", "comment": "Malware payload (Stop)", "value": "d6194deeb56ba1418c6a758b67cf150f", "object_relation": "md5", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217402, "uuid": "9ac2a861-c514-4ab5-a2b2-f833791cac5e", "comment": "Malware payload (Stop)", "value": "31e991e037ef5ee29b3921a8ed21fe3c1284914efb88a12e8bdda2e094a41b18", "object_relation": "sha256", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217402, "uuid": "68434329-f046-4c99-80a0-b818d4b2415a", "comment": "Malware payload (Stop)", "value": "1f638f08508916f11c2c5f3220ba2f86a4f06549", "object_relation": "sha1", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217402, "uuid": "9dee5999-68cf-4b44-97a3-d5dfee5349c1", "comment": "Malware payload (Stop)", "value": "5133621619de05b791c9dfc7750a3957f672fc8280f143178e4100016aeb710e5a4f46a5ead43734da8d9e91dde7e58c", "object_relation": "sha3-384", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217402, "uuid": "df3c4548-7f38-4a0c-9e52-4ac97e85ba4f", "value": "5B05F130B680C034E9FF15F849BA827C653D7DA19B2550EB62D83AEE16346E5AC3135F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217402, "uuid": "2fe82b7e-ef9f-49a4-a5d9-cf7ae2afa416", "value": "9ab3c560e142af9dc63cb09246cc57b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217402, "uuid": "5a4dc510-5f95-41d2-bffe-91acb964e789", "value": "24576:bItrM9cjLdhElxPwRkVmRjXcnGllyKtMlHQdeOUhUEihU:cdhgYRkojsnWLaFefU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620217402, "uuid": "4874ed41-6166-4324-9bfb-d6485b1807fc", "value": 850432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620217402, "uuid": "67654424-e6a5-463d-a418-b49e3a9cb94b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217402, "uuid": "fb22384f-f708-4470-aab3-2b62cbff003a", "value": "build.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c9c881-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dharma)", "timestamp": 1620202059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202059, "uuid": "d834ee03-32b6-4669-a6a5-4fe2b477d888", "comment": "Malware payload (Dharma)", "value": "26a879b25708d951e9056ba81bb5a6e5", "object_relation": "md5", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202059, "uuid": "e9937db0-e68e-4f6a-b8f4-dca8aea277b6", "comment": "Malware payload (Dharma)", "value": "324cb383fd7f47c079b162b725215bb4badfd4c0b2e41d330fa38344e59e77ce", "object_relation": "sha256", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202059, "uuid": "87e03b0f-95fe-47f5-af2d-843d665a72bd", "comment": "Malware payload (Dharma)", "value": "97994d75c3f30cb61295f9c02b0ce15105ae556f", "object_relation": "sha1", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202059, "uuid": "1cb4a80f-24b0-4f97-9525-80e69124e662", "comment": "Malware payload (Dharma)", "value": "a89bcfbf71b65c65acd7dbcd02db88e19ce673f7c6100cb9544bfcd1bf7a5cca3df91edb1be5b41d8b5d4828896e2626", "object_relation": "sha3-384", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202059, "uuid": "116d2643-3357-453c-bca9-276d3f9905fc", "value": "14939D25D861D035F8A350FFCBFA96FDAD644B20130384D79BC01E89AB959D5FC32A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202059, "uuid": "fc5135f9-7a45-4fc0-8d90-6875bb7af662", "value": "f86dec4a80961955a89e7ed62046cc0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202059, "uuid": "45536f7a-4fd3-4a73-9e99-3cbad59a1e5a", "value": "1536:mBwl+KXpsqN5vlwWYyhY9S4AkvbI5rNF2XYQNr/0BOLRhhwKSTGwqXbF:Qw+asqN5aW/hLvrNFcRr/lRiTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620202059, "uuid": "f82db476-2392-4737-81d0-9d3a6b4f9d4f", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620202059, "uuid": "8ca65bd6-a4b9-4fb0-af69-ee91465f4957", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202059, "uuid": "20256871-e841-44ce-9559-bccf35ac4f21", "value": "26a879b2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f06abe-adce-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620238999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238999, "uuid": "dc4ed959-26b5-4ec4-be71-b2e87a89b539", "comment": "Malware payload (AgentTesla)", "value": "cfc5742bf88684ace8bf60024e4812d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238999, "uuid": "0b9a24cb-795c-4d65-8912-6ebdb466bdd2", "comment": "Malware payload (AgentTesla)", "value": "329fe39db0fd030030088f642763f27fee4d2bb7ec1521d69ea4c89e9e429c25", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238999, "uuid": "18900557-10ae-46e4-9ae3-194822743081", "comment": "Malware payload (AgentTesla)", "value": "e13ffa86dc472dc1bc6ed9230a08200bb0c58fe6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238999, "uuid": "eb81bdc4-2843-4efb-a80e-c97fc6676a9b", "comment": "Malware payload (AgentTesla)", "value": "e14b072e6d89f021f3aecf1568bfc41cfa350e645883cd81f83561c31b5a1b0a81a693677fa8e2387cd7e6780bc5eaf5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238999, "uuid": "e8083bde-210e-4342-9dae-334f9963a822", "value": "B205127C26889766D93F4B3C3978C0011BF0FA2AD663E70A6FC061F75BA3B614761A51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238999, "uuid": "7d4f0f61-9e51-4aeb-973c-24480f43a8fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238999, "uuid": "00ac4ee0-9795-4134-9393-4cbd9c24adb1", "value": "24576:D2Q4fnnlOuyC0JcEd4VBma2agNILPweBw:DkI3CQcHVBmalg+zwYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620238999, "uuid": "04be22bb-2d96-4383-940d-aa6dc3e0ff7a", "value": 828416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620238999, "uuid": "1cd559c8-7985-4333-8023-4b841c6b2c39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238999, "uuid": "b43b8421-ec07-404a-91ad-e4be4be3a905", "value": "DHL 46773482551423.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5d7d26-ad90-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620212188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212188, "uuid": "af543402-8c34-4b34-b0cc-cfd83c35f5d1", "comment": "Malware payload (Dridex)", "value": "6e2e296510376dff1da3fb8e7433068d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212188, "uuid": "31d377c8-514c-4e95-a49b-d12743a0c60a", "comment": "Malware payload (Dridex)", "value": "32d0dd70e673d5a4f4d3683ac2a787f240f1fc2b6e35463a32a5d1a78034710e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212188, "uuid": "f4986ac2-9c63-498a-814e-3febfaaa3c3d", "comment": "Malware payload (Dridex)", "value": "1e59165a86f2f2b258d74de2a0daa586d888322b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212188, "uuid": "7c3ccc28-5075-4c14-9f0f-09b71a059a81", "comment": "Malware payload (Dridex)", "value": "d7c6b1660587e4a4b1f65a66a8eec111a87b52b6610fccbac74b8a1957fbcb05aa165bc08aff83bd4d1bd4582b02c9e3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212188, "uuid": "3fdb5a65-800c-4d14-b0c3-482a737b5f72", "value": "52F3CF82D702C1ADFE212C7A28E677753D5833905E54CA69E2088F3D5BD35C60DED2AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212188, "uuid": "44459735-4f9f-466b-8c93-9b50e0308d09", "value": "ba4e0256194238dc7d8ad773f3a0bf13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212188, "uuid": "ddbb736a-a624-420b-a0f0-d8b30cfaddbd", "value": "3072:+95RgjZh7gpk57/MbVelsxoNTen1v/HuxbIXU89J3WgMh84H6:452j4pk5zMbVO6/HUIXU8KgMy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212188, "uuid": "bb0f33d8-1473-4d01-a9d5-f4a51a78a231", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212188, "uuid": "c7077261-e16b-4717-9294-100dce41e875", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212188, "uuid": "f608b40b-0d28-45aa-b12e-d503535b8e6c", "value": "6E2E296510376DFF1DA3FB8E7433068D.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab48c117-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208806, "uuid": "e9af530f-0019-4f8e-97ea-08441c7309ef", "comment": "Malware payload", "value": "a44c12710c0d7ec6074abaa3cac93b0b", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208806, "uuid": "18eaf361-88d3-4fed-b9fc-daaa1465c448", "comment": "Malware payload", "value": "32fc517e463317840e1ea9d7390cb3790e3af05dc19bf59c14c45176655e0b80", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208806, "uuid": "873fc511-e885-46eb-9fc9-83bb929acc90", "comment": "Malware payload", "value": "aec6134875c406ecbf5113d319e71b17618257a4", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208806, "uuid": "794cd4c6-6542-4ce6-8459-7bd107ccead5", "comment": "Malware payload", "value": "cc7e08b55e83d5892229f81d607ca04aefcf8b2d5de765f1f8b38797c365fafbb68872fa7d4c321bc6323eff68e7f2e1", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208806, "uuid": "f8bb698d-fe84-48bd-8e04-d9520961b532", "value": "E3A1E850112C1AB17346597AD26FFB52B50EC81B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208806, "uuid": "6e1fb9fe-1b89-48da-b123-8bdda032f214", "value": "96:5RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:5RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208806, "uuid": "ff295e05-3876-4e9f-a470-2455c45b66e9", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208806, "uuid": "d522fe57-0af4-4c92-bd18-f3bbbca71038", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208806, "uuid": "e2fd3c8d-fe1c-474b-80a1-62095a749966", "value": "32fc517e463317840e1ea9d7390cb3790e3af05dc19bf59c14c45176655e0b80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dedbcbe-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209025, "uuid": "4e0ca15e-1249-48a5-9196-8a91cdd86369", "comment": "Malware payload", "value": "4b2063d68de42688bafce08bc297edf0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209025, "uuid": "2969f971-1e28-41b7-aec9-0d81ee5cc79b", "comment": "Malware payload", "value": "3319e00d89109493094f5874a9d8bd9c12e48f26cea20ed88bf525db49cfc916", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209025, "uuid": "fedb3a6b-0719-41a4-b490-2b839d12e57d", "comment": "Malware payload", "value": "dd34bac897f404e18dd1ec3133fb76963e95fc89", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209025, "uuid": "a847e159-704f-4786-94f7-8dc4b8a4e57d", "comment": "Malware payload", "value": "3103dae6d4a4b220082f0cc13446d274f1e7209ad409485f1031925db65d82faa52f488769c90b3db920e8b8c3afe7c2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209025, "uuid": "cb2d5d25-b34e-42d7-8ccc-c16a0fd0d9df", "value": "06D4E1251A53934AE7C3043EE8B473D1E08C1C854289ABEF12CE4B7ADB6DC4574EC67A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209025, "uuid": "6b62c365-50a6-4a5e-b14f-8f8e6f3fadf4", "value": "3f26c4553ca6fb9cbbf12b84e825a1b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209025, "uuid": "a6ae411f-c32a-4898-bdea-6ce0f5a36621", "value": "12288:bbKtPNvZftfDYz7ta8aBvMzy0AQGJBNFCuEYngPc1L7/DzIuu5Wcuc6Whzgl:bcPjftgar0zyGkBN0uETPcd7b0F5WcuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209025, "uuid": "9880ca89-c48a-403c-aeb5-32682a89405e", "value": 653824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209025, "uuid": "517c1cc7-5665-4dee-ba5c-44cbd4f54c40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209025, "uuid": "992e6ef1-0e9d-466f-8499-c0a0d97a42c5", "value": "4b2063d6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22332e36-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208576, "uuid": "b61b2162-0194-49d3-8e58-94dd2218dd9f", "comment": "Malware payload", "value": "4d1396e224121f4e8cf4d9187ef733fa", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208576, "uuid": "efa9bfe1-241c-4ae0-8316-e94d55d1e54f", "comment": "Malware payload", "value": "337e2a3eac90b6aa59f8366ddc4a5ee1cc1273ab99ce37fec7513e41412d887c", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208576, "uuid": "f3826805-36c2-41c5-8046-9f618c4c2045", "comment": "Malware payload", "value": "00bda38aa52668debd028ab13f452f3a80483c96", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208576, "uuid": "9ab442b1-d153-4788-bef3-b7a967bf894d", "comment": "Malware payload", "value": "5107ce6f5eddb9c784248e5065fa140d10bfb7c71b8749d0db57061defc88953020083db2e6176f2818897c93db80ecf", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208576, "uuid": "58ee7697-32f3-4419-b077-7546156c83e4", "value": "2BA1F750112C1AB07346697AD26FFA52B80ECC1B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208576, "uuid": "a98b9157-4109-4b2a-8be7-499f5062aa58", "value": "96:lRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:lRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208576, "uuid": "e62374d0-6733-4d45-8a9f-80151b1b02ee", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208576, "uuid": "efe783f7-79b7-4626-ac0b-4afc99169e62", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208576, "uuid": "dc0def7f-3b2a-4ba7-a237-0c8c44391adf", "value": "337e2a3eac90b6aa59f8366ddc4a5ee1cc1273ab99ce37fec7513e41412d887c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84541ccc-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201869, "uuid": "0ccbf239-4e35-479a-b89a-72da47da9e18", "comment": "Malware payload", "value": "2937fcc64228f95ad6efe3761641aade", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201869, "uuid": "b8fbf244-49c3-4686-bbe3-77ad76760791", "comment": "Malware payload", "value": "33bb4dab15cff97cf1588ef605d766e489381e4f00c384c9efe01637e2c9ca3d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201869, "uuid": "494ed39a-f7fd-44cb-be28-2dfc54f6a96c", "comment": "Malware payload", "value": "8429f2cbde72edf86c0fa101c824b9a6dd649d99", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201869, "uuid": "d65712f9-4e99-4927-ae2c-84b6c969ba99", "comment": "Malware payload", "value": "15d9ffecf86782caa9d6fc1061990cf5e728ae904c96ed1b3f610ef82611bdd236d652f165a9a1a5667010d4cbb54ad4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201869, "uuid": "60d1a696-ced0-4ac0-ba5f-26a901ab0695", "value": "79D4BFF5F54C881CC5CACEF2A257964C90D701EA8CAE648B6B7627F13CD1B201977B98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201869, "uuid": "09dec12b-8107-4327-90c9-09dd18a81c98", "value": "70d1c9731c0d2f7ae416fd05038e0194", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201869, "uuid": "61c668ea-e704-4154-a4be-28857f036614", "value": "12288:9jLDDM6ZQ83osyz6olRELZ4ldpW5er0/MZNKTm:98uQW7HYRIkpW5N/GKTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201869, "uuid": "fe31ff4d-aedf-4411-99c7-2161943333a9", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201869, "uuid": "268d1378-924c-4cc6-9744-542ad8d33903", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201869, "uuid": "80ccd6c5-0a2a-4e62-b9db-da4b5f0eda89", "value": "2937fcc6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d4ce28-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1620201759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201759, "uuid": "f299944f-14ec-4eb9-b4d4-1af327299846", "comment": "Malware payload (AveMariaRAT)", "value": "b9e4fdb4f1d1e50fb2b1bc6f8e648e91", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201759, "uuid": "4fccba7b-70ab-467a-8e88-b9357f707519", "comment": "Malware payload (AveMariaRAT)", "value": "33be12e4978d894da637959e06d3d125923816ccdf52c644b5ebf24ab8ea06d5", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201759, "uuid": "28a2b14c-90fd-4f3e-a925-490c424c5756", "comment": "Malware payload (AveMariaRAT)", "value": "afe3e9370a5fb240ae917a9089fc07b6a54a7bd6", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201759, "uuid": "dbefc330-d497-4a8e-a1b2-7726adcb272a", "comment": "Malware payload (AveMariaRAT)", "value": "906a6024ebd9da4fdcde2eab617ed59bd048cdc19e7d20be1d0e5f2198d744a7f6ac0a651bfdff0056ba188db4f6b523", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201759, "uuid": "5d4ed29a-14dc-4d8d-afed-972d00afe6b8", "value": "77957D5077B104A7E23B3A70740FC178F16EFD5A5B14AB6F2B3ABD5D89632801993683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201759, "uuid": "3aa3c82f-d787-4825-86a0-1c391f76c309", "value": "7be4c98eebb39d282cdffc1cea8fb470", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201759, "uuid": "a13c1976-c8df-49fb-b2de-9d24eeab9a9e", "value": "12288:t99Vbpgx4OuE+aCpBPY0PkI686WNUfWO6yuXzT5SPlSGN/A7W2FeDSIGVH/KIDg2:X1gg4CppEI6GGfWDkCQDbGV6eH81kv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201759, "uuid": "27abb3cb-e2d7-4424-838d-6ccdb53e1170", "value": 1930926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201759, "uuid": "70c6e86d-ade3-4bd0-92b3-82a96d4b9cfa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201759, "uuid": "7974dfb0-27f2-4b7d-988e-870575dccca4", "value": "b9e4fdb4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956b6cd0-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620209199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209199, "uuid": "25b222dd-f256-4a6e-99b5-8654ee528f6f", "comment": "Malware payload (Dridex)", "value": "a2be4867643e98bde3713904633a0c9a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209199, "uuid": "11857a36-2dd6-4dae-96a0-2f3e6459dbec", "comment": "Malware payload (Dridex)", "value": "33f5d45186d2a1c29bc7b38c748e3e032d258ce4b7dce2cbb6235e5c42414f03", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209199, "uuid": "926ced80-3020-42cb-a312-d79e280c5b1a", "comment": "Malware payload (Dridex)", "value": "0ecd382a3662738be4508934c40b5bfd3ba15ea6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209199, "uuid": "7bce6afb-8534-470e-991c-d6491b54c165", "comment": "Malware payload (Dridex)", "value": "06cbac2da09baf542f0211586afa36bdbb718814d8a227eac57e60d765dbfd7ace86aabff045d48879dbbb0d7d816f41", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209199, "uuid": "1e61faf7-ae82-49b8-bace-35bd85c75597", "value": "19F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209199, "uuid": "343858e1-1ea9-4dba-8e25-fa7e3f271aa5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209199, "uuid": "af8b2683-1823-4a3a-896c-5f0a9140233b", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209199, "uuid": "ca8f4990-b341-4e9e-9cc5-0cd93cf46d6c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209199, "uuid": "c56b8361-00fb-463e-a010-978b31f0f691", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209199, "uuid": "b1baae74-fe5b-4f40-aa2c-0bb6a5ebbb00", "value": "a2be4867_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9edd3407-ad6e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620197618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620197618, "uuid": "14069711-792f-4ea3-9c82-322bb9b44890", "comment": "Malware payload", "value": "190384675bc5d1adf450e8f3fb4a5a6f", "object_relation": "md5", "Tag": [ { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620197618, "uuid": "ce95c2b5-51d0-4718-a0b8-cc389ec3a341", "comment": "Malware payload", "value": "34190a94604fcc985c6c35aeab8281ff8135cbccd37fe864efbc9112de213309", "object_relation": "sha256", "Tag": [ { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620197618, "uuid": "8fc5aa9b-9e6c-4234-a6e2-e7418d7b0a56", "comment": "Malware payload", "value": "ceba0160958dc840f4eea2d25f449fafeb772995", "object_relation": "sha1", "Tag": [ { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620197618, "uuid": "7db3540a-5e57-4065-9e08-38668e5a697a", "comment": "Malware payload", "value": "76465bb372eaee3aef895243791ef75d5c35da1833481c424dad27cfd4e14d2fa78b54b7cd34895f01cd9cf4c12975b9", "object_relation": "sha3-384", "Tag": [ { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620197618, "uuid": "ef61558d-1e62-40fc-9739-4b3ee000a9ba", "value": "9F62475054F998A70057C0C23571AF1A2FE0E617DA278E0436FD5BA0AF92DB7ED43398", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620197618, "uuid": "aab22638-be43-42f4-bde2-0a02a3fa7908", "value": "192:NvukSQzJdwhYF8gnfq3eq3eq3eq3eI7qh2UawdM08BDf:EkSKUZZZbAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620197618, "uuid": "937bbb37-bb16-4eb4-9aeb-5f137d42d181", "value": 15316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620197618, "uuid": "10015a28-9ff1-43b4-8126-9c32f0e4d98b", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620197618, "uuid": "f9b63626-3ed6-4522-a546-c7a314209d43", "value": "Pay Report (Wed, 05 May 2021).hTMl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bcc9eba-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241717, "uuid": "42c4e87a-8761-40d7-9bf5-0b2f68546366", "comment": "Malware payload", "value": "5bf33f7645a3671c031ffa5c306d8a6d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241717, "uuid": "229f37cf-4af6-411d-8c13-fc796f2275bd", "comment": "Malware payload", "value": "341e2056de27f0ff341abb06b3a70ce071d9bc914c3a11806b6334c569b770b1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241717, "uuid": "229e9473-955c-447d-a40c-93d261c0ec78", "comment": "Malware payload", "value": "50618e3a8fdaa77d4d8903225e79b3a3e45ee656", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241717, "uuid": "a0693855-2893-4f83-b7af-35863b7d0691", "comment": "Malware payload", "value": "7725a244a4d8f68a5add50c772df0d966e6a4004775c9f15281284ceebfa93fe8bd95e84cdd776e28da5a30fb33cf865", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241717, "uuid": "d9d75675-9c43-4507-b8ab-82c778d32f15", "value": "CAF3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241717, "uuid": "f28bbb30-495a-429c-9cb8-2115dc13a8b9", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241717, "uuid": "64212a9c-65f9-45ff-bf93-d1a8b54c1366", "value": "3072:3x45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:B4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241717, "uuid": "ad37e04b-035e-4516-9e36-87ccbfb45773", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241717, "uuid": "26d26a03-5219-4d8a-b5b9-283e1d39b580", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241717, "uuid": "bd75533c-6810-490d-983c-a9f11e785cf3", "value": "5bf33f76_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f3b6ce5-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1620212651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212651, "uuid": "ba8de22c-7f9f-4b2e-88b9-a5b9ff5d03f4", "comment": "Malware payload (Gozi)", "value": "f465c89ba2a62f916cc5f72c23d73b46", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212651, "uuid": "7738114d-377c-4b14-b274-689b28ae3385", "comment": "Malware payload (Gozi)", "value": "34b5104cdaacdedc1bc930061e31355da40dc5071bcc77c188aac7f2734cc337", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212651, "uuid": "1842f110-1335-462d-89b8-426a0d61b4be", "comment": "Malware payload (Gozi)", "value": "f4d510f20de9bfc09b891936af6d83fd5d993389", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212651, "uuid": "5d6b5115-928b-4cde-9129-a7d5946b62ca", "comment": "Malware payload (Gozi)", "value": "a1947f820ffa6392355ac87776f09023020c78609b27dd7405005486eac5b81d7eaf6d7d1e4eff8cd3d0025a7ff9c87d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212651, "uuid": "748ffef4-2dd6-4822-978e-ecd858149b89", "value": "22642370810E09F0C22ADDBB7991D4505E64F07157E4FF06A446BC7FE59CAFB00DAA5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212651, "uuid": "7d51c9e8-09c7-4fd5-b805-69f51f809e42", "value": "6144:gg0qhQ5QQ9NZHu7koS3ZXltJWKmduXP6Xu2V/e:DW5Q4NZO7kr3Z1voR+28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212651, "uuid": "a0063a88-8e15-47c3-871b-176cf2ded9a1", "value": 318366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212651, "uuid": "d9fdd21a-5662-402e-b719-552d0324ac38", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212651, "uuid": "5030791c-ded1-4f5f-9600-bcb712853b26", "value": "f465c89b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7e5e671-ad80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205391, "uuid": "5db55340-68d3-45c2-bdb0-47f3b766b1c2", "comment": "Malware payload", "value": "c83070a1787063f82498abde76d10dbf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205391, "uuid": "7d145ceb-6e60-47db-b5a9-8bd5ee60ad7c", "comment": "Malware payload", "value": "34b7745433c223627207c50f435b1fcbdf796206c64a77fe9f28dba094f28d66", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205391, "uuid": "b3c17637-a76f-4e1a-af96-59169e9694f6", "comment": "Malware payload", "value": "6d5f993ffbe02686bb4f3779dc9d6e011e3b55ff", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205391, "uuid": "65a880c6-09d4-47c6-bc95-0914ab705d44", "comment": "Malware payload", "value": "7aa65fb8eb033491f53deebeee33fb77f2d41aadc67c94aae9e2fe1fa22a6beafbccce419c435c03ca9a092af6a92e8e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205391, "uuid": "27735c94-0440-4623-852a-8a4c88d8525c", "value": "0F65F183A38E1F92E897E337C6FADEF0DB94151909030B671D75E0D8018BDA1776A5A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205391, "uuid": "618f74ad-d0d9-4a3a-9018-6f98f4e2a4b6", "value": "e098bc1cbf523a0f22304d21d265b929", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205391, "uuid": "d12aaf86-1afc-48ec-98f5-5b988b8b4704", "value": "24576:4EZ1AUj24dPIXtkA6t4I48krSCV6GvKDGSUAE2ZQFF9/k2k/AvRhJ:4EfvjPPItX6y8krHV67iSUIQFTsRwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205391, "uuid": "5b9e1e09-ee9e-4b6f-af0d-5ac41dc54ae0", "value": 1465344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205391, "uuid": "7ca523a3-2058-4b5a-b7d8-402d40f6f5d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205391, "uuid": "aff7fae8-c7c9-49a6-9bd8-a194ecfdcba2", "value": "c83070a1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "998fb19f-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252156, "uuid": "a65158b4-09f8-46d0-9eb5-dcfd700ee9ea", "comment": "Malware payload", "value": "f692f49358451188e3a33211bea15010", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252156, "uuid": "1dcd6c2b-19f1-4b2d-a8b3-242edc2b53a3", "comment": "Malware payload", "value": "34db9beed001a3078d208074de06ee94036793a627c9c9919881f13624e0e547", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252156, "uuid": "45345e38-e32d-486e-a851-992f90cecf39", "comment": "Malware payload", "value": "93180899e1e6356392ef43649e3f69b20985b3be", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252156, "uuid": "87eb7901-bcf0-4c37-ae4b-ab1d06cc2e2c", "comment": "Malware payload", "value": "da183243aabdff28cb324687ee01d1b43654ce13089f4b23545ecfc681c34aa2d51c7de9f8ca8acfccedb9a9f21cf27d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252156, "uuid": "f55ce6ec-efde-4853-8b94-738aa0d95641", "value": "A3F3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252156, "uuid": "3a1cd646-950e-433e-ad00-dc6a9ba7f760", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252156, "uuid": "5693466c-2551-4db4-82ed-80ff12042e6c", "value": "3072:9v4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:iDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252156, "uuid": "57ae3235-7774-43c5-8e25-85eddf00f426", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252156, "uuid": "96283532-c027-438d-aad2-4592155953bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252156, "uuid": "4ae96985-afc7-4240-80a9-ccdbbd87e0a2", "value": "f692f493_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "949617cc-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241839, "uuid": "f24c4740-a67a-46d7-aa7b-9790d6ebf13a", "comment": "Malware payload", "value": "b23eb5b96ced27dacbee5981404d8068", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241839, "uuid": "2670d7ee-16cf-4f82-be09-5f8e4349b145", "comment": "Malware payload", "value": "34e8c3fd6429773a235b980a6033b83ef9697d2e8e6166bb7eb81a0f937b8587", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241839, "uuid": "51f7a483-c596-49a7-851f-11ee189ff803", "comment": "Malware payload", "value": "6118985cfa749aee6b2e11ada07541193a4f88dc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241839, "uuid": "c4a367db-d4ee-4adb-98c1-7e92030c138d", "comment": "Malware payload", "value": "35ed57e9c61f5181d9273d3b96febe98024fcde8bd2b59ff4b3828d2b632981f60c5badc79c84179d7eb494f214982ca", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241839, "uuid": "0605e1d4-de6b-4e8b-b9db-ea1ced63bd3a", "value": "0FF3C085DBABE87FC45A35399071DFFB5B388B145250C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241839, "uuid": "212f00ba-7aa9-428b-9d69-5f62d73b63d3", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241839, "uuid": "65437a57-dcae-4dd7-a76e-581df40ac200", "value": "3072:Ly45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:e4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241839, "uuid": "65f10ded-9776-407b-9857-27fa77569a33", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241839, "uuid": "93c0b605-cf64-4afc-b189-051dfade301e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241839, "uuid": "65e72d13-e7d3-424d-b5ba-215b96e5f91b", "value": "b23eb5b9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf5f3d52-adc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234207, "uuid": "875d4900-290f-474f-a8f2-d01d97189753", "comment": "Malware payload (Dridex)", "value": "f9605d3a68ede287968e4873f90af5fd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234207, "uuid": "e7723235-395a-4433-8977-09beb39a1619", "comment": "Malware payload (Dridex)", "value": "352d14997fccc340bd8721b1fd9fc5389d1e0e39410d362332a8f26fc3d6196a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234207, "uuid": "2d596d32-41d5-4cb3-9354-efd66c021c01", "comment": "Malware payload (Dridex)", "value": "74ff299316fa49c0b9f5de7e644f5f3c8a10f54b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234207, "uuid": "a578a70c-6628-4fb2-bd0d-8e0f87d381f0", "comment": "Malware payload (Dridex)", "value": "39ef728d15ecc385e2d0de3aa4f77ed3df3eb89ae33740f962af8f35fb71c11e971a02f47bd082c76b38c13b23521b2f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234207, "uuid": "5b4b9713-e763-4824-abd3-15461ff86d59", "value": "D2F3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234207, "uuid": "6d21010f-cd48-4c64-aaed-5cd02147347d", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234207, "uuid": "b444931a-e724-4356-998d-5eaab0eb35fb", "value": "3072:8i45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:J4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234207, "uuid": "1f866da1-2229-4c59-a0ea-ea680f553f24", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234207, "uuid": "31733c85-5162-476b-bd03-6f9284924922", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234207, "uuid": "7f2ca45a-3d3f-47d6-b602-7a55c1eb95ab", "value": "f9605d3a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84510226-adc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234081, "uuid": "b0866fde-b23c-4eba-9260-253da911aef5", "comment": "Malware payload (Dridex)", "value": "4a2066617a89ff21b8a5b9f0dd06d1bc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234081, "uuid": "708ca818-e497-403f-8117-e662bf031856", "comment": "Malware payload (Dridex)", "value": "354a144c04227941d3302b632d3d25e7c3e87e85d97db57ba5eca25ffec78568", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234081, "uuid": "41970516-e2c4-45ec-99bf-73978b25712e", "comment": "Malware payload (Dridex)", "value": "4009370a9192cb30cd7c88a6d753c90930b767e2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234081, "uuid": "0d06be86-5a67-4b6b-8d7a-a7959e6a6b9b", "comment": "Malware payload (Dridex)", "value": "fabe3a06d7c1a52cce1b82cfbe68a439f8a082edc75f788591d0e97780368b387975c21249f115e009c9f4c41aa2987f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234081, "uuid": "9e6fa027-2a49-4fc3-b9ba-21380b250346", "value": "9FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234081, "uuid": "74a790cf-b6c4-4c09-b2b3-67d689711d60", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234081, "uuid": "b88095cd-061a-46c0-a43b-28bdcd08b7ba", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234081, "uuid": "36f43d19-71d4-4983-89ee-f9893c6cb8da", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234081, "uuid": "75799e56-d201-4751-a60e-1c1afac65855", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234081, "uuid": "b3cf816f-5209-4ac0-9e92-1fd6cce02f82", "value": "4a206661_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c94062-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212797, "uuid": "c7f386ba-53a6-4436-a0a1-73bec89e8d94", "comment": "Malware payload", "value": "b1e13ac67f1595460a6bb752c57d1763", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212797, "uuid": "a5cf6e64-0005-47d1-856f-37985c33efc3", "comment": "Malware payload", "value": "357bb9f6a7f23022ae20ce04a376add44d82bfacc358e6364a91c11d3cbef5af", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212797, "uuid": "fc78016e-59b1-48a1-9058-55a0b7c395ae", "comment": "Malware payload", "value": "abc71788fd8e7ba7c9d8693bd64fdc8503b0cfd4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212797, "uuid": "92c28442-d92f-4f7a-9cca-a3a9d3788bb7", "comment": "Malware payload", "value": "bf185cf98f2d11aac2a5eea7011aadeff18e1acc129579512bd90095c5992d17334b0305453e4e099b10f17a986a74de", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212797, "uuid": "e88ea1a2-a626-41ad-ae60-dc474b7769b5", "value": "9DD49C4A6C9D1CC6EBD6A2310C6669A4185E7EA70704C3F1BC70E496FABB4530C5F2BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212797, "uuid": "2b1ec601-cb2b-477d-a089-078eee27f2d2", "value": "e0c0e4b4ddb98e7e71d2c5b2c8001ef9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212797, "uuid": "8a69bff9-e071-4e0d-b27f-b1973e817a90", "value": "12288:JAXthY0/nxYXfj3Pagi5qu/MHK8/7t1n+q93fHEH11L9h1Tm:JAXthYygjSgiT78/R1C7NTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212797, "uuid": "0c401068-6644-4a84-a4ee-371231523993", "value": 639488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212797, "uuid": "cb550ec5-72d6-4f7a-b741-f977372522e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212797, "uuid": "9ae9c8e1-0c45-4bb4-9083-f6b00fa2c851", "value": "b1e13ac6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65dc82dc-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252498, "uuid": "d0335e9e-18fc-4dc8-8d40-9b879b4d0d5f", "comment": "Malware payload", "value": "76796e7bbbbce751a99b0d97288a7241", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252498, "uuid": "459e1550-045d-48a8-9a86-9e6d7cf3c4cc", "comment": "Malware payload", "value": "35b87a1fe9145c265706418a456814896fe602500ef6a7ebe50d9d17e5197c03", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252498, "uuid": "68a60680-e463-49fd-b843-dc31a7ec8bb3", "comment": "Malware payload", "value": "b947a797e42128d218207b18a543ca57cb3a4364", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252498, "uuid": "9ef3e804-a49a-4519-a703-0588c4a9845f", "comment": "Malware payload", "value": "db5086506cea9af1bf1162563af3edc464d3e166b6829f7f4706844ee910752d40cc27877c070f5c14de953afda9c26f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252498, "uuid": "3296fe5d-4da0-4b45-b82e-d3743fa0de5b", "value": "41F3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252498, "uuid": "9aef76cf-5452-4d7f-a4cc-28567e437205", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252498, "uuid": "3e5f3fe4-afeb-4363-9826-7fd3b5cf6512", "value": "3072:ud4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:HDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252498, "uuid": "7548e877-b8cc-4019-85db-fbcd32c9650f", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252498, "uuid": "b975b817-44ac-4734-8426-0b91d2e959a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252498, "uuid": "8cf01817-ea87-4e9e-9861-88654666ab30", "value": "76796e7b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f00978-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208936, "uuid": "4d09793e-7a44-494a-a854-ca7b1fcf15b1", "comment": "Malware payload", "value": "ce48b8b20d0b6a83bd1fba30744c037a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208936, "uuid": "11b34c57-463d-420f-9c0f-b913f80bd01b", "comment": "Malware payload", "value": "3623652ae3611e0f87c4bd3ebf768c0c97f250bf53e2522b2d099e8d59be9e0b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208936, "uuid": "faefcf86-854b-4fa4-8ae2-443e5d4d1099", "comment": "Malware payload", "value": "9ee59ed62ca390fcf2e2d118ffc22e79133f4ee6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208936, "uuid": "990aec59-f2af-43bd-b3c7-b86b4fd14c82", "comment": "Malware payload", "value": "2dc21eb92d7ba8c867f054a21f2015b89dfe7917e28f8ee0a490b845d5cbeb33032400f507d4f4f51c105aa3aa638a0b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208936, "uuid": "801e5bdb-f3bd-4314-a44b-0f1b3d82caea", "value": "50E4E156DFA63A16FD719E33050EC70687A2734E9C124B2FC20687E84F5F9C521A7E29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208936, "uuid": "30221539-aeae-4ea0-9c31-045e51d7ac2f", "value": "dc63c0b405653a86fd0ec5ceba4ef425", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208936, "uuid": "8f594ae5-259e-4fb1-8c12-aa71f559ded8", "value": "12288:SItxXWApoBUUh0Q71ZOvNAkZlJdsIdZiqoDzlvh8+uggeD9Jb:LXWAp7MhP0/ZR8BDzlvhXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208936, "uuid": "effa677c-efaa-49ea-bcdf-6a158ed7a67e", "value": 670208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208936, "uuid": "43274be1-305e-4e3c-ab2d-733f095e8755", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208936, "uuid": "23c11edc-6c7a-4d75-868d-aad42af45675", "value": "ce48b8b2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e85a72c1-adc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234249, "uuid": "19539b7e-bc59-4003-bd54-abd3fb6b1445", "comment": "Malware payload (Dridex)", "value": "0f8d4145badf1fa5979125739bf4b077", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234249, "uuid": "75f0c6ce-ec25-4531-9016-03942e82b212", "comment": "Malware payload (Dridex)", "value": "362ac4bde4d3401dc7e12a2a6986bd8ec145784c7911b52ec3640abce042be1d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234249, "uuid": "bc61da1d-0ea4-43e3-b2c7-4175c2d2ce95", "comment": "Malware payload (Dridex)", "value": "f449dc8156243dd78f4a6c8b694660cc7ed64032", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234249, "uuid": "250ee20f-8929-4fe3-86a2-7aafe34c97d4", "comment": "Malware payload (Dridex)", "value": "644b0d16bc02140302921ef81768ca18f940e56fb0606112ae29c6e0d725f28a00964bab77d8998908a85b7e066070c6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234249, "uuid": "8a88b5fe-ca5a-447d-bb74-4a8818e8eb6f", "value": "0EF3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234249, "uuid": "bfc15b0f-7fe9-4a2f-a5ef-98a96cc3d53d", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234249, "uuid": "0a48c08d-8452-4c44-9c58-21954a9b173f", "value": "3072:xP45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:14KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234249, "uuid": "29a824c9-1372-4939-8c0e-e89af4840618", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234249, "uuid": "75524355-b4e9-48c5-baa6-58c60875c93e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234249, "uuid": "d1e5cdab-3c80-440d-94d1-db5848fb6641", "value": "0f8d4145_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b0e0a3-adbb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620230642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230642, "uuid": "2dd1b0ba-0564-41a0-a0d2-53d8d5d3f88b", "comment": "Malware payload (Dridex)", "value": "8419135ec27bf5e7577770cf393f60bd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230642, "uuid": "e26d713d-7a3f-4f6c-9ad4-96e7f4ce6fed", "comment": "Malware payload (Dridex)", "value": "365032ab06ae3ad6e22fab6d8e4b0fdb46c5199a62498222e5fa8d596d8e5809", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230642, "uuid": "be28b146-cd95-4d38-90d7-a3a0098accc0", "comment": "Malware payload (Dridex)", "value": "03361e8588bee8fbd746fa72fa7722092d0f75f2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230642, "uuid": "3d4c2dc6-d1f6-46cc-8ae8-0eeecf3550a3", "comment": "Malware payload (Dridex)", "value": "126feade2acff9dc4c67f5637de44c427a1ca6f6bc3e0c937d2f4e6ab80db9d7bf44d9554dfb176fee8b9cf18940c1a2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230642, "uuid": "0fc00e24-4b55-44f4-8e12-6a71be0bb074", "value": "CCF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230642, "uuid": "beaee8bb-d33e-4ab9-ac17-915ec6e53022", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230642, "uuid": "797278ab-b211-42a8-a5b8-a9fd9298a7c7", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620230642, "uuid": "f0069886-b77a-427d-a01e-1c5f07059e99", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620230642, "uuid": "aa306778-2406-469b-a93d-0c3ca817d316", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230642, "uuid": "db08dbf6-8ce1-45db-bd04-6f547818b5c8", "value": "8419135e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b74d8358-ad99-11eb-abe1-42010a9c0039", "comment": "Malware payload (Snatch)", "timestamp": 1620216128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216128, "uuid": "3a207284-63c4-41af-8cd3-ca7400c28bd2", "comment": "Malware payload (Snatch)", "value": "32de66a467db22cf0f5b65d1a9f4e19c", "object_relation": "md5", "Tag": [ { "name": "Snatch", "colour": "#E3EBA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216128, "uuid": "93af8108-ce80-47d1-8439-a155c97882f9", "comment": "Malware payload (Snatch)", "value": "36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4", "object_relation": "sha256", "Tag": [ { "name": "Snatch", "colour": "#E3EBA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216128, "uuid": "b545b158-e2f2-4423-ad09-8369da389703", "comment": "Malware payload (Snatch)", "value": "cdb5c200cba7da3f6e80e868ef7df380ac1259c2", "object_relation": "sha1", "Tag": [ { "name": "Snatch", "colour": "#E3EBA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216128, "uuid": "7002b587-bcbe-4544-8f95-7480a448aa20", "comment": "Malware payload (Snatch)", "value": "892b0dabb33359bd549333e73a8aa593014bf6ca1af16244ac24ce482c08f7a6a5cb17ba8675e494045cb7766b6545c0", "object_relation": "sha3-384", "Tag": [ { "name": "Snatch", "colour": "#E3EBA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216128, "uuid": "40d56945-ec48-4154-91c3-1c55a1bcef5f", "value": "4A167C50F9AB14F6DB82797148B7426F3B346209433AEEC7CA041EB7F9476D11A332A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216128, "uuid": "9445dcca-bbb0-4307-987b-9769b62d122d", "value": "f0070935b15a909b9dc00be7997e6112", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216128, "uuid": "5423107a-6f74-47c7-845f-b5545c13ed7c", "value": "49152:fgZNPqLGVfMmq1d1MRGM8Fvg9fR5HMXF9W9HrAbluBUMNk+cqG2UtBpStPvC/9f+:fgXsMfql+9G9+B+tBpEPvCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620216128, "uuid": "abdc5807-c459-4294-b7b6-764cd877bccc", "value": 4365824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620216128, "uuid": "0397692e-824a-40df-8ab2-5a8f7b17b051", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216128, "uuid": "66d06408-350f-4d3c-bdc5-dab066e2052f", "value": "32de66a4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ebb15ad-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209000, "uuid": "9356fbb4-d7c8-48b6-bffe-32fc8484f6e0", "comment": "Malware payload", "value": "df0b0acadc86635c25b0eee39e187e61", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209000, "uuid": "132243b7-8094-4e8c-bcb3-547622890963", "comment": "Malware payload", "value": "36e82b36f8921f2c87d1b688fcfc34f349ce8e2fe87fd6ff13ec72a45ff4ac7b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209000, "uuid": "e57de65a-e2ed-4e05-aeac-cac271b045cf", "comment": "Malware payload", "value": "957c44b0b8ad8c4b62076d99aa6da5c7e9d99bfe", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209000, "uuid": "8f175933-a0e9-42a1-a7c4-4a515f949e3b", "comment": "Malware payload", "value": "2cc96d48b7bd100ff23e5e0c2a794e921f5edb926cab1c115859a76804f38d0e6e8ca19252df2f956d163b990362e0ca", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209000, "uuid": "d3c9dad9-6792-417c-90f3-0fd40cafec9d", "value": "D2769DEA3CF4A95F6FC944A28B704D79AF51E34C0461B50229149ACBFB0F659B3C239D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209000, "uuid": "8a165ca2-d796-4bff-b37f-bca4f324900e", "value": "335c27f3b77dca391119223af4d589f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209000, "uuid": "a8b726c6-fc28-4e2b-b435-c5c05deb3268", "value": "98304:knAbYqjCm+CmvCm5CmtCmMCmJCmkCm2Cmn2fJxNHnfNUV2K3P2/Q:HkNf3NHnfNUV2K3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209000, "uuid": "978e034b-be63-4cda-850b-d55a3df154f8", "value": 7373824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209000, "uuid": "2ce488fe-b0c9-423f-b96b-9f90513d6029", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209000, "uuid": "815104fb-8aa7-4ce4-a245-d884aec9f753", "value": "df0b0aca_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93de5a7b-ad80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205331, "uuid": "1b1a9853-75f2-43d5-84ba-d1d246268085", "comment": "Malware payload", "value": "596b9d37f0c58dc7358425145feec15b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205331, "uuid": "9e9ff885-0668-4451-9804-97cc1ae0d74f", "comment": "Malware payload", "value": "36f5b30256119951b473fb8afb278276aa4a246188cc49d52f13c134f3845661", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205331, "uuid": "9bf07b1f-25f0-491f-8eaa-c7d1ee4ae2c4", "comment": "Malware payload", "value": "c3a75d18afcd5529878a87224d1490878a1fbec3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205331, "uuid": "a558bbe7-6a29-4d32-9e61-e1a3478dc147", "comment": "Malware payload", "value": "a2ed048831f56b45deff51f5980f79212eef86ed4dd48af401dc759a0a1d2f4b41b1a2a3df7e41b6fb015a05ea52f2ac", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205331, "uuid": "caf775ca-de76-494b-a9f5-e318fe2b726f", "value": "B535BE7B957F83B0D8A4016A8C064976698AC22DF24174F83F62E754BF83113B4DEAF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205331, "uuid": "8bd49d22-3e21-427b-b7a3-45ba445c2cd0", "value": "3d461b17c0213650930ae22ed89204b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205331, "uuid": "e0649247-4815-43b6-ac61-0b9a1573836c", "value": "24576:6D/+gA9Dac1eJVec2GttqN6niWmfnZu7oKeIJQFXXOnBYZQBD1KP1EumjFsVucPY:u/lA99voiWmfnY7oKeIPGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205331, "uuid": "b14f481c-a474-49eb-ba9a-83a685afc157", "value": 1089024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205331, "uuid": "cf63d97a-a3dc-4fff-a8c1-7f3cb4047c9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205331, "uuid": "110720c7-eb7a-4d48-a791-8ed28ac5aec2", "value": "596b9d37_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f320f66d-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241998, "uuid": "0289cbc0-584c-4d80-9852-b0d33c65cbf1", "comment": "Malware payload", "value": "cc37a123385e9ddad512caae6728f7db", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241998, "uuid": "f60e1d33-8f35-4f9f-9c1a-460c54e0bd8a", "comment": "Malware payload", "value": "36f945c2561bdb1b3336aabec197dfa152604a4ae3eef815958aceeeafe6ac40", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241998, "uuid": "e790c672-dadf-4be9-a947-0a7d1536dc6a", "comment": "Malware payload", "value": "c5cd71a7e75e100b84d38dbb975b1090dad0a621", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241998, "uuid": "4381f1b9-f992-448c-a06d-75d92494a821", "comment": "Malware payload", "value": "cf9e5f9ad732bda7b877e3c2455222a83cb7491c56459c94b26a6f35b50abd9cdabfc7546c4994817bc282a8744bf08a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241998, "uuid": "46c04f46-913c-47bd-8e1a-efc125d374b2", "value": "E3F3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241998, "uuid": "38a41cdd-dad5-4385-834c-d7c382cf2c0d", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241998, "uuid": "0eede08e-bb69-417a-b09a-a180f606c02e", "value": "3072:/i45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:K4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241998, "uuid": "7668318a-6c1d-47da-a07e-4f80c9df5c05", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241998, "uuid": "5361e0e0-7b01-43e7-a0a7-7026108479f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241998, "uuid": "df459959-a0cb-4757-94a5-100ad440ba40", "value": "cc37a123_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e80488f-ad81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205671, "uuid": "486fb8e7-3041-41f9-abaa-63879291941d", "comment": "Malware payload", "value": "18129c1a44fd3cc177fffc42d435d2c6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205671, "uuid": "dcf72a8c-6b3e-4655-9eed-9f243e3d084d", "comment": "Malware payload", "value": "36f9c0f35dead818894b727aeac1ab47da7c1f290e8fb284183027537bfa759f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205671, "uuid": "b4562c10-29d1-4bec-bea2-e6faefe4906a", "comment": "Malware payload", "value": "102d5db437a4b4a252f17331132a91bfb2d71881", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205671, "uuid": "b930266f-0e94-4782-bbe2-e91014b196b8", "comment": "Malware payload", "value": "adc26e97bae14fe64f1767cbc54ca3b67f8388cc04f239a22c44d4e1316c226414ce69f9c1d1afc3d5607b540c571521", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205671, "uuid": "b1f00ab2-ea5f-47da-b21b-2bf834fe9200", "value": "C8550238DB81886FECE156711CCA92BC201885817797193FA877BA7F46B42B5E3DC41B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205671, "uuid": "97804fb0-b03d-4360-a0eb-213f66b14e76", "value": "b015d87810dee83a59ce4e4097512a09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205671, "uuid": "edcd2b58-d073-4cd1-ab70-0c69294182e5", "value": "24576:IHEmtn6/SW8NTLzLTHFJs6pxMdxVSrX5P/WOOGmDRJP50cwwzrITNGriCprJCNE4:IHEm96/SW8NTLzLTH5pxExUrX5XyGmzk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205671, "uuid": "43af2209-4283-4f1b-ac3b-6f738aea8905", "value": 1331200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205671, "uuid": "b14a6bd6-cda8-4862-8d07-904f723f3c99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205671, "uuid": "5b422bd9-3fba-4a60-98a7-77fdbff4a41b", "value": "18129c1a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11675836-ade5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620248491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248491, "uuid": "0b30a082-395e-471d-82f7-e436d79b7279", "comment": "Malware payload (Dridex)", "value": "a9d71564fe7ed84137cb13ef5c51594b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248491, "uuid": "f1fdacf2-e48a-4ae7-8da2-8840cbe748ca", "comment": "Malware payload (Dridex)", "value": "370b77ea93a9a059f639292b0b33f348179b1c1cec585bf6b09b35d7e32a17fe", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248491, "uuid": "0757daa7-9da1-44d7-83cc-7092b5bf958e", "comment": "Malware payload (Dridex)", "value": "9e25f1c564388277966bdf4bc0f336a54bf9fbff", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248491, "uuid": "fb3df2f9-542c-40c6-8cf1-e275a81a364b", "comment": "Malware payload (Dridex)", "value": "f632967c101d405ca3b9bf119571b33e16ad9deca94469751ecad91bd9789b134520582418a7fcfe1da2131a6a972aec", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248491, "uuid": "5f086ba7-e0ad-4f5b-ae8b-8fe329a8968a", "value": "1EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248491, "uuid": "6f668ef9-83fa-4bf9-acdf-8f5c62c73acd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248491, "uuid": "3c31888c-c1ff-485e-8174-47d69a47f862", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620248491, "uuid": "91cbbf60-b701-4daa-9def-6a966ff69d4b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620248491, "uuid": "04558ee8-794a-47e5-923d-eab7dc8ccc2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248491, "uuid": "af765475-50cc-46bb-a292-042a8f14a09d", "value": "a9d71564_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f92142f8-adcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620237713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237713, "uuid": "eaf45546-6b85-489b-b8e5-72a8e6670425", "comment": "Malware payload (Dridex)", "value": "aa72f94f2efbb88c3ca39e27407550d3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237713, "uuid": "fbf9b6cf-10ff-457b-a446-c576b161fac9", "comment": "Malware payload (Dridex)", "value": "37301b2b5170b29542f2d1601b766ac1f48d5a9fdc3cd018d3aba2c4343b1dc9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237713, "uuid": "ab4756a4-e524-49de-8ec6-6a66300e93f7", "comment": "Malware payload (Dridex)", "value": "29a144656fb19d1305f0a2faee85768ffd58f5e8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237713, "uuid": "154f84f6-909d-4951-a1bf-3b1d3143e56e", "comment": "Malware payload (Dridex)", "value": "f815490d322fe7a07b8779b677d53eb257bda91e61d5125ae04354f256f93e6fb9bab064e160a580b79edcfd59a136ee", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237713, "uuid": "32a63893-01ca-4d84-841a-05c777691f40", "value": "09F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237713, "uuid": "a4bdc6fe-cff3-449e-bae3-063b8f26ed01", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237713, "uuid": "c231d69c-1730-46ce-8264-5ce57d8eec5e", "value": "3072:WiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:NeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620237713, "uuid": "15a1f13d-71a9-4036-96a9-2598f82ed5f6", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620237713, "uuid": "097e5ccd-7fd6-4adc-aeba-58d50e23caa2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237713, "uuid": "76dab0eb-281c-4976-9c62-b2c9c518a90a", "value": "aa72f94f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c221b96-ada9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Stop)", "timestamp": 1620222847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620222847, "uuid": "695e3e59-3953-4258-bc22-4c67a1ef74e9", "comment": "Malware payload (Stop)", "value": "06cc2c58b35393afd830c6d37d22f4e2", "object_relation": "md5", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620222847, "uuid": "aae3e995-d40f-4ba4-8c35-8e3735d863ea", "comment": "Malware payload (Stop)", "value": "3763170476b8a4c3cb592cbea6c4471ba2ea2463db9f7839fda502ef0a06b092", "object_relation": "sha256", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620222847, "uuid": "8b1fdb61-7de7-45a5-ad63-f7f6408cf6d6", "comment": "Malware payload (Stop)", "value": "f4abeeb4441b7842101c5f907881179cc938f9c7", "object_relation": "sha1", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620222847, "uuid": "616dde0c-ddc7-4362-b88d-9db4ca539e2f", "comment": "Malware payload (Stop)", "value": "d55d0637f99a877ce05ad83881f8ad468968efcfc1593cb48b8c7b52c3bf307f33abeaae14117b0469fd3283767e6e9e", "object_relation": "sha3-384", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620222847, "uuid": "6def98c5-77a7-4b82-9ed4-1fa0df96f92f", "value": "8E05F130B680CC35E9F621F849B9427C65297EA25B6450CF62D93BFE52386E5AC33743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620222847, "uuid": "ab856528-96e7-4b8b-a16c-f34403c0f8ef", "value": "9ab3c560e142af9dc63cb09246cc57b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620222847, "uuid": "e667f7d8-4efd-4974-b550-08f3ef145d90", "value": "12288:aw1CY4ZqwXfGMjsuTVr4Tyj0j2tVTmK0biPL5Gl4UoxLlmMCvbGu3XHMPm:CYuqwXTj/rky1tCiPL5GElmMwHsu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620222847, "uuid": "464902f5-f65a-47e9-a36d-d98c152b2ea2", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620222847, "uuid": "0fa15723-50fa-4cf8-99b2-bb61e1e3bfa7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620222847, "uuid": "b6880198-d010-42ac-87af-4b922c426da5", "value": "build.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0e42b39-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241860, "uuid": "8a74ddb6-fc22-4fd0-8c4c-1bcc36743a33", "comment": "Malware payload (Dridex)", "value": "e725be9892b37cdd5eca4d1c875cae36", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241860, "uuid": "2937461b-e61c-41b2-bfeb-4d7cf096622c", "comment": "Malware payload (Dridex)", "value": "3768dae2ed94eab8d47d8e663b28ff58575415506ce835d175f758a469f664ce", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241860, "uuid": "92df9e3b-e03a-4d8c-89af-f085be2ad318", "comment": "Malware payload (Dridex)", "value": "de505f57e4070b9ca0b0adfe1fcfcbb0788dfe65", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241860, "uuid": "bcfcb02b-cf06-4d0c-809b-875a2582e876", "comment": "Malware payload (Dridex)", "value": "c4dc53cb8a2adbcf72fc888c95e337d56fce583e9971264cd8e97113d25dfbeb9c52da0616ba2831b1b5cf1c1f835f57", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241860, "uuid": "fed7a724-d212-4833-b8c0-ab34cc95386a", "value": "00F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241860, "uuid": "c6faac39-7dd9-4762-929c-8d6f595b83b8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241860, "uuid": "208c6207-303e-4114-b853-53c21fce821c", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241860, "uuid": "62b98fab-9372-4426-8592-bfadaa9e7a21", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241860, "uuid": "f153836c-7773-4981-8a1f-3477a0f3e6fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241860, "uuid": "e3953ed5-a52d-4b4f-a31b-36d6553a0311", "value": "e725be98_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa853e7c-adaa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620223542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223542, "uuid": "c3c51170-032b-4668-9460-49b6e47facf3", "comment": "Malware payload (Dridex)", "value": "282f9fa3a724410060a08eafb38123b4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223542, "uuid": "ff8e143c-89d0-4ee9-9adf-a33966f9ebe0", "comment": "Malware payload (Dridex)", "value": "37695e84a6b0772f68b72b8eadfb2129b0b40555e1b8bffc807694996716c304", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223542, "uuid": "4eb96721-6cd5-43cd-a7c9-ff8ee34049ba", "comment": "Malware payload (Dridex)", "value": "a7815f6fc5a77da9876d1d54442141846b42668f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223542, "uuid": "072d07a6-98df-43c8-a79a-8f133b1c6dad", "comment": "Malware payload (Dridex)", "value": "0e70914fc23e271712914539de5d9a70cabc4af8f74a7902f36188ed5fa018973bb2a526ea89f95b8d8637fad99f44c8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223542, "uuid": "6ce8f138-4947-4702-8a88-9b17ed859fbf", "value": "A3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223542, "uuid": "fcff0272-9b40-412a-8769-91610427a90c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223542, "uuid": "2097a755-7f66-40f9-b012-2f7e27b967da", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620223542, "uuid": "cff49ed3-6497-493a-9a3c-3ddc85e5789f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620223542, "uuid": "a4959523-dece-4486-bba1-b3a3e3eec90a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223542, "uuid": "a6ce66da-fbb5-4707-9b54-1dba6f88e63d", "value": "282f9fa3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42821d2e-add6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620242131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242131, "uuid": "cfd7639c-8cfb-4042-ae8e-1512ebea5da2", "comment": "Malware payload (Dridex)", "value": "f01b7254e502ab1c25c19cac47f46d0e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242131, "uuid": "e68e3921-03f1-4d7e-ae6a-665a9d4c89a3", "comment": "Malware payload (Dridex)", "value": "377b2393d4c68ce7438eb2a73a89feeabe6059215ad8520ca1381846233c1b6c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242131, "uuid": "91cea86d-4169-4e86-bb30-63b6732e4009", "comment": "Malware payload (Dridex)", "value": "457c0c0e2411998eb7884c77996da7668798370a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242131, "uuid": "5abee18a-4bfe-472b-87dc-cc35ab107f9f", "comment": "Malware payload (Dridex)", "value": "80f49b63362fbaade1055c611d98968d56d62663577d9df445b8dee88359dd5d77ae235c581840454c52a7d5ce4d35f1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242131, "uuid": "7fad0232-774a-4e0f-a924-c05cef3d7e51", "value": "5BF3C085DBABE87FC45A35399071DFFB5B388B145250C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242131, "uuid": "66a5fda6-886b-47f6-8f23-87f417eb3141", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242131, "uuid": "5d084b28-9caf-4424-a3e6-eed16517cefe", "value": "3072:QB45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:e4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242131, "uuid": "26b30a58-9478-45f5-8e07-b2370479f6f9", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242131, "uuid": "5c1823bf-4e11-4933-a570-c788e1421999", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242131, "uuid": "a17bcb2c-6e0b-4ad7-88aa-6e875c551c48", "value": "f01b7254_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb847c4c-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620209263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209263, "uuid": "9af16bc9-7993-48dc-b818-f07a9fcd3f75", "comment": "Malware payload (Dridex)", "value": "9db63180f600cf23979823dadfb23b20", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209263, "uuid": "60c09255-0d7b-4d60-840a-aeb89fc3ce07", "comment": "Malware payload (Dridex)", "value": "37be392b2c871c71abed53d7057a5f8e19ef5f7a1bcbac78a3a23afa4e81251a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209263, "uuid": "4ee6dcac-87fd-48b8-b40f-bf565dcda9b9", "comment": "Malware payload (Dridex)", "value": "000d91311a5610331eb7ed2dc84a865a5ceb586b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209263, "uuid": "470f304f-40c5-4471-ba4d-ecea8c9611bb", "comment": "Malware payload (Dridex)", "value": "fd7bd7c38960cf00c965c2bd72b19cd4e83b3d1b77769de9c4c100a2e109e56da564f8de618071c812d3ea6aa49462d6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209263, "uuid": "ca21512d-4d15-49a4-ab0a-17d4bb623bb0", "value": "C8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209263, "uuid": "d512c3f6-af4c-492c-aa3f-ecd49c39b8fb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209263, "uuid": "84c87773-6bef-4cb1-b2a3-46ecba5be1b2", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209263, "uuid": "6751deb9-5aac-4114-9fa9-a2eb6f605e47", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209263, "uuid": "ad92e890-12e8-4405-8568-ec20b4f1a04a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209263, "uuid": "ebe02f5b-303b-44ec-aed0-2caba972acce", "value": "9db63180_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ddff9c-adf6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255850, "uuid": "adea5a73-a839-4e44-ae7f-585cf651eb36", "comment": "Malware payload", "value": "8dc2d06488946d2a9116ff039af14632", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255850, "uuid": "24284028-e30f-4a93-9176-b6a614a79eca", "comment": "Malware payload", "value": "37c6e9040e6aabc4b692971a9e904f7d0b029d2f2a5a312fba5d248132eca33d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255850, "uuid": "9cbe39d5-553f-4b6c-9e4c-2bd978a90416", "comment": "Malware payload", "value": "2e4668ee0b1dacdf3958e9b22a3540bad34f18f2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255850, "uuid": "e694d35a-c21e-42af-ab8f-f9b64a577120", "comment": "Malware payload", "value": "c8822858237642e15edab1c50d8826e494a1e0f60fe86f45771bad9d48df36b7c22734b3d01157ba74341b66c8cab65e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255850, "uuid": "536af802-21db-4e41-ac1c-01ae1ff284be", "value": "D2F3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255850, "uuid": "5905ae24-a2f6-4591-97fa-27e8b651e653", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255850, "uuid": "f659413d-e6ad-462c-b516-b80ec9d84bc0", "value": "3072:vd4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:eDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255850, "uuid": "4bdd5d50-c0ed-4cd6-820d-d5ce4d0c9fe5", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255850, "uuid": "5a0f5cd6-7633-4446-a3e6-11cab9d796fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255850, "uuid": "d6d518c3-0d18-4996-9531-b44258a4b724", "value": "8dc2d064_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f88b9308-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252315, "uuid": "7e0df214-c707-4bc2-9fb7-535246215703", "comment": "Malware payload", "value": "9e6fbf7877b7278fc8308daebaea2661", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252315, "uuid": "053c1722-9b34-42f4-a5ca-704b715c0d56", "comment": "Malware payload", "value": "37ccc390d429269d06d658f0b63d7dd9251f5381fe42af470ee059b087f14a3a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252315, "uuid": "9760ba75-1e30-4980-9039-188ddc382443", "comment": "Malware payload", "value": "383192eef4a7aacce03f8295763e9af39d08edef", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252315, "uuid": "1d6990ba-5d1e-46a0-91ad-8c1e084cb1b8", "comment": "Malware payload", "value": "285e33f059eaebdcccecd12a278d088ddf83c0a12f8e1d68b82185fbe573df4bf44b471b092d8dc738f731af2c6497af", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252315, "uuid": "13113961-e3b0-4a61-a844-a982106fa8c8", "value": "87F3C085DBABE87FC44A35399072DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252315, "uuid": "dd059c00-625b-47f7-8005-f55273b54345", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252315, "uuid": "086706a3-fbda-4627-bc07-ca9511ec7c96", "value": "3072:AF45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:S4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252315, "uuid": "36bbef6a-3e7a-49dc-b315-9dd9e66d56f1", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252315, "uuid": "8ee28232-5494-4898-871c-5aea9460e322", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252315, "uuid": "e44a706e-4a6a-47ea-8e93-852317133dae", "value": "9e6fbf78_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f11cdf1-adb6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620228462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228462, "uuid": "0dfda86a-74ba-49be-9156-e95ac35e046a", "comment": "Malware payload", "value": "0f9a52111f8c63b86a08421f2fe42786", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228462, "uuid": "4bbe62fd-fec3-493b-ab35-506a7ce62ae9", "comment": "Malware payload", "value": "37e98fef85aeb5097a5091d11fc844487642873e9e06a8d0734785dbe1ad1315", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228462, "uuid": "433d7a10-97e7-410e-b4a7-144e76a4d2d2", "comment": "Malware payload", "value": "b3b277e8f9d73636a87c6b09f50f63dcfb25b7dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228462, "uuid": "bee66583-d5e9-4c7f-aad2-f26f6f3324a9", "comment": "Malware payload", "value": "e8ab6f3d39e7c1c5705f6684dd42908f3b855ea944135d2d3e0094aeef8959b25e84a0a3b778907736d40429a11e5c29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228462, "uuid": "9a288fc9-439f-4527-9d1d-f2eff9e17af3", "value": "E454E01BBA5C479FE3998BB2393A43318798EF5315503846FBE4FD2E253224D29171D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228462, "uuid": "83565be7-0ddf-4b6f-99cf-a9333916e33c", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228462, "uuid": "f4f5e7a7-e643-4205-b83d-004d8833c1b5", "value": "6144:DPX8q6ZiRRzqEOY3oK/tHj44KJfUZyqI/DOh4:LZRRzqEO6oejZzSbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620228462, "uuid": "ad7c18ea-213c-4408-b255-e1581627b210", "value": 286506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620228462, "uuid": "8b877bc5-578b-43dc-bac9-eb67b2f5fee3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228462, "uuid": "ff5d1681-aeb0-4ee5-9435-04abbce8d405", "value": "original documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc460b2c-ad99-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620216136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216136, "uuid": "02cfb289-99f2-43c8-8d92-ee002716b86b", "comment": "Malware payload (Dridex)", "value": "4229dedc8fef952733eefcf08b499bd2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216136, "uuid": "612647c6-edc9-498b-9060-96a5718dede2", "comment": "Malware payload (Dridex)", "value": "382250d48fdad3786f9365fe75176a4e1c93f0bb2c3deee006c8a3afa0dd6704", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216136, "uuid": "272bad94-ae2d-4d98-bda2-7c5c653e2ae7", "comment": "Malware payload (Dridex)", "value": "4fced644b37bbdfd9536309c0b1b6d5fe615f5ab", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216136, "uuid": "664941ed-309f-4a32-9843-70e9610106c8", "comment": "Malware payload (Dridex)", "value": "629b6b21a2a69383ca6d47254350247cf78c0fdda64c615d4e81e9b24b18b70ad14cdb4d320ff45841898775658cbe83", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216136, "uuid": "49ce98b5-04e0-4d68-b70a-f3d5740f423f", "value": "AFF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216136, "uuid": "2e5230af-0ceb-4731-b88d-92d8332e01cd", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216136, "uuid": "ed2b9a41-9d48-4ad4-99a7-86ce7b1df493", "value": "3072:oA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:o3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620216136, "uuid": "883d6968-e04c-4291-a919-92c058ab53eb", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620216136, "uuid": "8947c10e-7d83-4fcb-9704-39983fb2f925", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216136, "uuid": "b6480163-b354-4fb6-9c7d-78cfa45074b1", "value": "4229dedc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "995a23d3-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201904, "uuid": "d2dcc386-ea40-4fae-ac43-11008ca9c9db", "comment": "Malware payload", "value": "d77f8499ef59d862f9929cf124521ec6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201904, "uuid": "3c9dd00e-f967-45d8-a6ba-0c494756672a", "comment": "Malware payload", "value": "3842211ffe244d76b9bc18bcee9ebe93dfe24e39f796c1e8b76d01a851513cc7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201904, "uuid": "8dadccb9-e500-418a-b0b4-bb3033230b80", "comment": "Malware payload", "value": "e6e634c60e3f602ae3f901f398d7bc79794f0f0f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201904, "uuid": "97caac08-438b-4f8c-889c-ec94642fbc63", "comment": "Malware payload", "value": "5302f2c05cef44a8d8f507929b587b44a4ae744e541cf227dec7268e4ae6ffc232ec69ec8dfc1a12dc3138d1e92978d3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201904, "uuid": "22a62cfe-5c0b-4b15-b008-740d44162a90", "value": "6EF4AE7C7C2175E8FBB92BF1FA860EE445390BDD2494E41322A4FD1F029B56BB8950B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201904, "uuid": "5cb636d3-756a-4e29-9a91-acf61e217a3a", "value": "698d2328e2af0ab747f724e5dc15fef1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201904, "uuid": "19c4f5ec-a947-4c1d-bb58-5db5c696b23c", "value": "12288:UigS7Njj8qBEBmcCdKVINyeJT9wBmETH4WKB3ZrEkSLnQEC8XLno/X4ZolTm:ES7p8aamcKD1JT9wBmE8xpxECGZolTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201904, "uuid": "80d3219b-2303-4db7-ad31-821b81eb18b5", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201904, "uuid": "06b0aaf9-b969-43ed-81f1-9b7cf35a97b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201904, "uuid": "7691bcfd-8403-4c6b-ba03-6ad43ca690ea", "value": "d77f8499_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "731e3b57-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241783, "uuid": "68ab7104-82b4-4f55-a530-79011b30a08d", "comment": "Malware payload", "value": "b82734c22651fd3083db6626b9f546d5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241783, "uuid": "ee0cd113-deaa-4017-85ed-294f327e4743", "comment": "Malware payload", "value": "38b035afdd5c8ea6d96ec10a919f6cd03581fbf510667a53bab59d71819d594f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241783, "uuid": "3569e1e1-b488-4502-b57a-9a4315be319d", "comment": "Malware payload", "value": "3a20b0f347da799e307358e6ab94a4fd67d2ed23", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241783, "uuid": "7e537d3a-f3f6-4cd8-890d-1843b4790ef4", "comment": "Malware payload", "value": "2d23f5f72d4df6745abd2a877f3d3fb8431fa70477663480fc51e7f1105f5284c9e202c16200eac806c0de1e6c432657", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241783, "uuid": "ea36f1e3-e9f7-43cd-8569-1b05609be204", "value": "E4F3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241783, "uuid": "374683da-7228-40f0-b9dc-16c36b702406", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241783, "uuid": "501512ee-b2ab-4c6d-b0ff-5078e0a6d258", "value": "3072:Sx45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:s4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241783, "uuid": "7c126c7b-5735-43c4-9460-0967bad08f4e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241783, "uuid": "2df45b27-bd22-45ea-b69d-68874f511bd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241783, "uuid": "03f89176-f20c-44a0-ac27-a180f0e4aaaa", "value": "b82734c2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f68767b-add4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241374, "uuid": "1e5e30f7-a2aa-4314-9a61-8a7875f596c2", "comment": "Malware payload (Dridex)", "value": "3b15083abe2a41edae9e405fcd6337c1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241374, "uuid": "1b646b79-01bf-41d5-92ca-a6a513d1a0a3", "comment": "Malware payload (Dridex)", "value": "38b8837ccf08350f163b060d63430961896d7cd341e576de28f47ac83d3d35d4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241374, "uuid": "9b146a3a-b212-48c2-85ea-24d56f3d0944", "comment": "Malware payload (Dridex)", "value": "de05ba334fc2a4d45c9f7fcb028288e2e76d0407", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241374, "uuid": "35dadf7a-ea3a-4e9c-9a48-d8836fa7714b", "comment": "Malware payload (Dridex)", "value": "603dc8d8fa433aa7f6ef0763b4347014eec2f18a24920071ca5d2d5357ee53df098dcae80a40edd644896058e679025c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241374, "uuid": "019fc24c-2bb8-499f-8b2b-f7481ac3b10d", "value": "DBF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241374, "uuid": "516631a5-0cbe-4b69-879b-399f1fb1ba35", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241374, "uuid": "233f9e44-51c2-4efe-b6fc-2f60aae21616", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241374, "uuid": "f30fb3de-bc15-4c67-ab6d-90125afd5bf1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241374, "uuid": "fa2c81d0-8c5a-436f-bf8c-189dafeb1620", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241374, "uuid": "30866fe1-b5c4-4e72-abe6-3f601647f5cb", "value": "3b15083a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b0994c-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212775, "uuid": "0b971d3c-2e42-4196-81fc-0afd7b21cbbf", "comment": "Malware payload", "value": "7992f099c86bdfff34cb9db59c6677e0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212775, "uuid": "2f775ea5-1dae-4662-aae0-b097be63f79b", "comment": "Malware payload", "value": "38dce48f9f469e10e6c15f6ce2fb345339d37b17aa037719754a3c02fee9a8cd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212775, "uuid": "78830658-3e51-4baf-a4d7-795eefbf15a1", "comment": "Malware payload", "value": "4f63d331cf4f95dc085dbaf95372964086102c08", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212775, "uuid": "33f93cfc-88b3-49e5-b6ee-fdcb89d65a36", "comment": "Malware payload", "value": "3e2c76581dcea1c4369a77824325b19614de095ac5afea4fd45da9d89744928c459e47410b1b3ce2622b3f8f89102ac0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212775, "uuid": "d78ad953-9f11-4719-9892-d539cba710c1", "value": "AE35CF705C521588ED0F7172AF5D45D98742D927323C8BFE4EC8C3AA978E101FF2AA96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212775, "uuid": "c419b677-1654-49e6-b45d-14a6b654ca16", "value": "307edf8a579bac9703e95b5c44a35725", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212775, "uuid": "9aac28a1-53ac-420c-be4f-ae19ace17010", "value": "24576:jd1n8rwMbGPWGwnbmp8QCKVOlkFEcQngUk/KYg4O8:jzn8rNGxw+VEkFmiHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212775, "uuid": "f36844b5-5541-4b12-bfa2-70797118e634", "value": 1091584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212775, "uuid": "10888a62-ff0c-490e-b2a3-740c64b9335e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212775, "uuid": "fea8424a-0669-4be1-ab27-09773553664b", "value": "7992f099_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d772c1-ad79-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620202110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202110, "uuid": "e5c9bb6a-f9f1-4273-9da4-29cabd8df52b", "comment": "Malware payload", "value": "73f8198db045b7ae6a5e71ab7f1e96cd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202110, "uuid": "472fd8f5-8a7a-4884-9420-3cddfec98ad0", "comment": "Malware payload", "value": "38ea0771a9037606de17efe07977a84d86dddee495250b50ffa3fa8879635f85", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202110, "uuid": "517fc73c-6250-462c-87b6-2676637c603c", "comment": "Malware payload", "value": "11928139bfa4833835f05cd9b2133e9afda7e069", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202110, "uuid": "77f15ef1-4555-4c2d-a1aa-95afa815339b", "comment": "Malware payload", "value": "972dccf25ffd7e4560a862238a78eaf84b576e1e97e891d6792f358e3dbfbee417ed3db967ad65fd31ea523bb639375c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202110, "uuid": "afe581f3-1cb3-4f0e-b704-589238052ad6", "value": "1D6512443C41B413FC069CB70DF6F0A43A6722B3BD9106F1FE1E2A29D799A187C5AD69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202110, "uuid": "a1710219-5ae9-4fcf-9d81-5188c41927d7", "value": "474a4602a9d1d2694f56ba8645fcb766", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202110, "uuid": "c8f8e027-9680-43a8-bf5f-1c7ecb881bf6", "value": "24576:dr5lEa05go59VcOgssCQKSoTHp2j64d4gfsuWCCHtOrlPCOYXTPSUcDu0nsrJ:dAgoDVcOqC/uj6498CCNOrlPijSUcS0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620202110, "uuid": "25732f9a-10e8-43c0-8a18-3d7d42f27de9", "value": 1460224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620202110, "uuid": "01a3c0c4-4947-4bb4-b025-9b5001d4449e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202110, "uuid": "3604dafd-e439-4d60-b7f4-3e69a1a4032f", "value": "73f8198d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b8547b-ad85-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620207297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620207297, "uuid": "6e6e74a5-5534-4f29-80d6-d4f5d1059e6f", "comment": "Malware payload (AgentTesla)", "value": "fe30bf6c058dd0bac8e3bd4e4e79da79", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620207297, "uuid": "3a6fcb89-0586-40b7-977f-f88e5b03a37e", "comment": "Malware payload (AgentTesla)", "value": "39425b86b32d4a5b150a24be0c75211479c69161a7b31f69202c2a1b3d88994c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620207297, "uuid": "fba551a1-0f3f-42ff-aad4-40b37345af67", "comment": "Malware payload (AgentTesla)", "value": "4eda1518519415ba7764fca46d38ef1db789fe33", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620207297, "uuid": "4f2bfec2-a190-4db5-a7fe-7964f409afdd", "comment": "Malware payload (AgentTesla)", "value": "cb509c9d077654a4ef579f707715e332356b6ea2fcb45dbc1af472dcd4e4f2082db24d95f7f41e1864678a28e911b5f2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620207297, "uuid": "4d7a2155-c255-4fda-a6c5-4354eb8a009e", "value": "C115CE277FA85716D0BA5F3958350300A7F1F11AD325C31F2DA8609DEEE2AC18E667D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620207297, "uuid": "c03e20bc-5099-4460-9551-9b454c325869", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620207297, "uuid": "68cd0827-6ecc-460d-8b2d-d155182bc9c4", "value": "24576:815PUxud7hTju3M/lLEG+g/ip+Ky5N75vB:4aC7hXuuEc/ip+KUN75v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620207297, "uuid": "baa9d884-07ee-4cb2-a8b3-bb9a5ffbcae1", "value": 879616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620207297, "uuid": "c6ba4a3a-62bf-4b5e-8a9a-3ebebf98a61e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620207297, "uuid": "b78db7af-bac9-442e-82ae-527f8ffafe43", "value": "ArrivalNotice-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b96d7dc6-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212695, "uuid": "4c566c72-92e3-46f4-a9a9-3c294717f87c", "comment": "Malware payload", "value": "9c6086194fefe039242ca4fb82fd6a66", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212695, "uuid": "88e10330-ce96-4478-b2b7-50b4a4c72aff", "comment": "Malware payload", "value": "3957a22a0bb097cf62db45786e19f27b956cc7bbbdb114803a88bc42725e2280", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212695, "uuid": "90735903-0bf2-4d13-a13b-6c048308f0a2", "comment": "Malware payload", "value": "7a727313e021de85e4c2a0a18ea6920c7b5130eb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212695, "uuid": "c68963fa-9bc5-4855-b5a8-7890b2cfa102", "comment": "Malware payload", "value": "2a27d99736dccfc6cf991ab90c9522836de0652180288b4230f6fe4b07756129ed29f9b79406ca6677cc4702e6aa0d9d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212695, "uuid": "ba4f69f0-9a52-4a46-9002-bc14076ca927", "value": "9BF4CF64932CA2F7F1AC63B396274A1CF4FE6B881BB3366E7F665158ADD4B5472C4000", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212695, "uuid": "5fa63f39-4a2f-4b4a-89b0-2c21b98b5a4b", "value": "c117e448ef7dc8e863052f748701e1f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212695, "uuid": "4614d483-abc6-4a45-8127-2eff36b25ce5", "value": "12288:Yufcpa0HbVfIWZRcGZOMyPcmX+3/BGTaBtiWEW+X+PLT9Tm:Ncp9fIW7cGZfspFTaB4+PLT9Tm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212695, "uuid": "496f8919-8822-462a-87f0-28e55909c397", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212695, "uuid": "67a2961f-8510-43dc-b23b-d9536637f6a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212695, "uuid": "39d6e295-8745-47f1-a2bc-3b43aa7429b0", "value": "9c608619_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "560703fb-ad81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205657, "uuid": "3ade1356-58d5-4ba7-8a0e-dc9022fa390e", "comment": "Malware payload", "value": "ed8f13d10c8e27143a385478b333d856", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205657, "uuid": "2f4cafb9-f2c7-4602-b4c2-175ef7e5b37c", "comment": "Malware payload", "value": "39917b97b330137a020c19ba7049cce5a7f580f7847b9ce9fbe1f137bf77dcfc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205657, "uuid": "f0178cc2-38ed-4f74-8608-74f443edf02b", "comment": "Malware payload", "value": "cd93aed53473367a57e17880f5406852a51e3ae8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205657, "uuid": "f3f45128-272c-4cb6-9a1a-d06e58096b00", "comment": "Malware payload", "value": "4168901e006b674e4d4a4941f7227015ba696b4d8bf381f12ec3f483d6556781cf27f2202e009918bd64339d458ac295", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205657, "uuid": "c6f2c7db-bb92-491a-8f4d-320e923a73e6", "value": "1765F1865EBDB48CD32A663573C9379E902F8FDBDB8336135219582574CCCB210EB668", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205657, "uuid": "a528f8de-a9bc-4884-8c0c-46d1c3bf5058", "value": "1e0eaaa52782f1629d70564205424e40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205657, "uuid": "b5736561-f08e-4b77-9494-ff746567b670", "value": "24576:g8AXaEZ7eHCmCq+YkXdAtOO9+UwQifBrLeCk7IPO2+lgnT4LRlN8/feYE1fNFg8J:gNLFK+YEe+UwvdaCLakkLOj+k8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205657, "uuid": "09533921-74b7-49b5-b77b-fc8d6f72bcb8", "value": 1462272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205657, "uuid": "240344bb-d5e9-4eb6-bcab-23bb9168b584", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205657, "uuid": "28f96f9e-2497-4ee9-b7b4-0f11bc062043", "value": "ed8f13d1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abcb4056-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252616, "uuid": "f9d7dd4b-7076-466d-b635-e7900b4412af", "comment": "Malware payload", "value": "1398a9622ad14375b76059d893ed7533", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252616, "uuid": "9dda1744-a0c5-4e1c-99f9-c2627724481d", "comment": "Malware payload", "value": "3a0ad1ac51a0b7df99dedf2bf5330d68d6f2442404966c54c1940a1b91b8bd32", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252616, "uuid": "a7a06449-f3fa-4a8b-b84a-1904a247e278", "comment": "Malware payload", "value": "27ed38561224943027ed86f1a2f904f1d5f5316d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252616, "uuid": "0ffa869b-cc04-415c-8039-8bbcaca4d6f6", "comment": "Malware payload", "value": "1d7a166df51afe0645214eab28d828016031e32a363bde4f1347aac3313261f849d9e673265d58e4195052315f81d88a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252616, "uuid": "bdd8bb84-37e3-43a7-a1f4-7484acee2124", "value": "C0F3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252616, "uuid": "176d9ee5-5abf-4f72-b428-916ee4efe47b", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252616, "uuid": "374cc69a-7ccd-46f7-8fec-912f2694901a", "value": "3072:6K4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:YDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252616, "uuid": "69b34a02-879e-49ab-967b-a61e8894bf38", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252616, "uuid": "ab4497ec-6008-4c5f-ae92-fdd6253d6056", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252616, "uuid": "740ed46c-6ba4-4ac6-b85a-cedc6b1d911c", "value": "1398a962_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7894461-ade4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620248448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248448, "uuid": "12cec43d-1bdd-45d2-b71a-b6738d989ff1", "comment": "Malware payload (Dridex)", "value": "50db14b210fc178842bf5de53fb1b541", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248448, "uuid": "52c834fb-d620-4ad5-aead-a40bf176004b", "comment": "Malware payload (Dridex)", "value": "3a2e48755bffdba6c10ef5972fc2869ad407b5d86d90f5d3591acc336e340ab9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248448, "uuid": "8dbb7439-6957-4fb9-87ac-677e1ee43d49", "comment": "Malware payload (Dridex)", "value": "524dbdf1a8d529174d1ce58926e729f564e705f1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248448, "uuid": "0e0583a6-d313-4b30-ae3e-4480c92b875e", "comment": "Malware payload (Dridex)", "value": "b1639f768801ac8ce55dcd93a478327c0f24a8245e2500d0f0071724982dac2d4e2778a4e724424c721a7216bb950269", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248448, "uuid": "7e2e7faf-0720-4286-96c7-a6498035e111", "value": "89F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248448, "uuid": "dd377bec-aff4-4772-8aaa-ec2c0c93907b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248448, "uuid": "3b15a0e5-a216-4362-a93d-2926763fd268", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620248448, "uuid": "3c5aec72-0e42-43c1-8654-99d6135c440f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620248448, "uuid": "1de3562f-fa5e-4d90-8a17-426d3d77792e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248448, "uuid": "1c02fe72-82b4-4594-8e05-55928edec48a", "value": "50db14b2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c18444-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241892, "uuid": "d8f2be85-7916-4192-8282-834eb7979833", "comment": "Malware payload", "value": "d1e3ad06c5188ac090bddd7cf309fdb1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241892, "uuid": "26c31b18-7f39-41c1-8a1f-5eef11b40d8c", "comment": "Malware payload", "value": "3a3509e6bf1e16255786742d0376ffa205a682bd6c56dcab55c067e6035997a0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241892, "uuid": "a8f51266-3581-4a3f-85ce-8b141faf390c", "comment": "Malware payload", "value": "d18209c18d7d710f8583d29f28ce633061954c56", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241892, "uuid": "c46676f0-c6f5-487f-b8f2-a8d2c4aaf49f", "comment": "Malware payload", "value": "65b7018809a9ed1c6249f5af8e21bbde97a7e08d0272228887f38567ccab7f97f12a8962d38f0d012cf4537497fa205c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241892, "uuid": "b5516fd8-39d0-4174-8c78-db8fb4e2efef", "value": "BBF3C085DBABE87FC45A35399071DFFB5B388B149640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241892, "uuid": "511bf403-fdb2-4838-b4c1-788cfe3df5b9", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241892, "uuid": "b2853a10-226d-46e3-8ce7-f4c6936d68ff", "value": "3072:+945bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:04KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241892, "uuid": "52560e89-247e-4494-a3c9-4e9919fb7d0d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241892, "uuid": "0ebbd175-368f-4ccc-8c67-fa7c3f131cc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241892, "uuid": "a130f5b0-a965-487d-8f2b-8074cf660ee0", "value": "d1e3ad06_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3246fca1-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201731, "uuid": "f13be553-c386-4747-b746-6573dfd6f350", "comment": "Malware payload", "value": "14a486559d91a7c1f33d48f295089e4f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201731, "uuid": "e129e11c-64d1-417e-ba38-30e7111a2c42", "comment": "Malware payload", "value": "3a66e1a9df774cad13d3251abf22ecbf59a000cb6ba838085b2d6816128fc988", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201731, "uuid": "d77d33e9-7cce-4070-b9ad-615470ca10ea", "comment": "Malware payload", "value": "c73b5078eb2994167eeee9825da11d666b01b454", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201731, "uuid": "c9bbe478-1115-4ed3-93c8-e7179df3bb0e", "comment": "Malware payload", "value": "4a8157f5306d841a4c7173be06d19e9bfcbeab85b2fbae8c3c17ec04cc88055fc1e19c5ade439313b08dd170163f02ea", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201731, "uuid": "360193f2-6fdd-41eb-9068-731e08747664", "value": "38B49D61F28DC1B1D44A1879B4AC936662B27D28173CABF3F7507F19A4732E0BC35A16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201731, "uuid": "9ef34513-aa09-4275-aacf-44d218cb3744", "value": "547cd05356c429dc57b17bf0fd6daf12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201731, "uuid": "5678a744-2bb5-4ed2-a862-fa3bd26a333c", "value": "3072:DFZ5qVGXvEQU+dXmEUy9rfe3kUdKSh7hKNjf7CwhqjEr8IcGN8yGBYPosqkxOqoo:JjqVG/pJZzfwsGX+LOOD8ddzZXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201731, "uuid": "65082854-630c-4b17-a1b2-80c40a6a21a7", "value": 536148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201731, "uuid": "9ce47f75-52ec-4121-9117-1393d8c4d16e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201731, "uuid": "d410a37b-1102-4019-978c-d9a613b9e09a", "value": "14a48655_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecfc1db6-adc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234257, "uuid": "b3e2b4b6-ea48-43ae-9326-117fd2ed1087", "comment": "Malware payload (Dridex)", "value": "7a161f93d5b80a31f497ed734352e857", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234257, "uuid": "d0238412-43c2-423b-bba3-b050058d93ad", "comment": "Malware payload (Dridex)", "value": "3a6ae42989cecbbe8140149259fe708f9bd55e6e2bedd9fb9ce0ebf50b74f808", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234257, "uuid": "9952d1f5-422a-4f6f-a92a-81f01c3682dc", "comment": "Malware payload (Dridex)", "value": "5af3df94f78cafa23dde80f29232ec2f36f41d8e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234257, "uuid": "19fb89f0-01e2-4c05-83e1-bda7568af29e", "comment": "Malware payload (Dridex)", "value": "58f7020fc16a56e7b3c60feaf33a223f6f7142cf57d7f7e6b5a5badce4aab6dae985c0c2f3e2fc923552cd2a3b14ee8f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234257, "uuid": "2ce692ec-0311-43c3-9ecd-997343d9e732", "value": "E1F3C085DBABE87FC45A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234257, "uuid": "bf39979e-5bfc-4b5b-8f78-e8956524b8bb", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234257, "uuid": "b510ebd7-5d5a-435d-badc-5d14820be655", "value": "3072:+P45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:O4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234257, "uuid": "951e508f-a209-4921-b880-29720bcad904", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234257, "uuid": "95073f6f-fdcf-45b8-975f-fd0dfd25bfd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234257, "uuid": "2cd9dd05-38ae-41d1-b2fd-296b1761535c", "value": "7a161f93_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd89f513-adf5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255759, "uuid": "6b4ccd11-aece-4019-85b9-aae1006ff10c", "comment": "Malware payload", "value": "57807c4087ad27a49d99748833cfd1ad", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255759, "uuid": "f979a311-d6c7-4be1-a363-cc7bbffcaf1f", "comment": "Malware payload", "value": "3a99fed622ba7f84b90524e604f0dc1f348922664e42eeada7919b77e51484c4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255759, "uuid": "6336d326-4c2a-437e-a501-2d094b73a39d", "comment": "Malware payload", "value": "821a68c527ca6c236b78b271edaa359e2592970a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255759, "uuid": "258efe33-2cdf-4d30-ba23-a9d3a64309c3", "comment": "Malware payload", "value": "6b132d9ef6277b2f7c05bbef368594e5723458f2cbab7add0d924c9b79ce16b74bd7f367fce89b8397f62144ea787b1a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255759, "uuid": "18b3d1e5-2393-48d2-aae9-c2c1dd1aa0d6", "value": "B1F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255759, "uuid": "2d499454-8085-4e72-892f-5ff4bb32dccb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255759, "uuid": "fcb78ef9-2315-43c7-af7a-7077a59c00d9", "value": "3072:MmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:VLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255759, "uuid": "817b4ff2-28d8-4698-9b70-ef0d99fafb9d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255759, "uuid": "d120a90d-a33c-41e2-a984-5cd3fc3027a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255759, "uuid": "dca7ef75-182e-4f3e-a212-bd072e389af2", "value": "57807c40_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b18477a4-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252625, "uuid": "d5074e40-88e0-4fac-913b-ad730027f46a", "comment": "Malware payload", "value": "5e0d0f965424f957b12d214e76a813b9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252625, "uuid": "d43332e6-77a2-433f-be2a-bb881e67fe27", "comment": "Malware payload", "value": "3ab6ac909e613460a1342864637159112c5fcef1128219a8a692ab67e6043ae7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252625, "uuid": "4cf069c3-05e4-4ea1-a52e-60641fe6350e", "comment": "Malware payload", "value": "d23035ad3b9733a1a5c5553a73c56e4fb6efe31d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252625, "uuid": "230464fb-00c2-439e-802e-0a3b1e1ed935", "comment": "Malware payload", "value": "ce646c265baa2679ce703cd4e9e53a63f44cb2fd5968b19afb76596d9df4b2955ae654630dfd2b2c6ee34ee411388efa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252625, "uuid": "cc0d909c-2875-4129-93bd-542ada3e9aad", "value": "D4F3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252625, "uuid": "8fb1825c-18e5-408d-9a0f-26a6fabae187", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252625, "uuid": "81b36068-2b64-44ab-ab9c-18b11f7d9da4", "value": "3072:S84Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:ODBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252625, "uuid": "1aeba3f7-73be-4528-bffb-2042e46b276d", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252625, "uuid": "31529467-d4a8-46c3-ae79-8452fb03ec82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252625, "uuid": "d77638cf-fa74-4feb-87e8-f8fc247a8b15", "value": "5e0d0f96_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf85c247-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201995, "uuid": "22f47cf2-fa25-4602-86e6-cbd46301d10c", "comment": "Malware payload", "value": "bb253f94475183a334c47ab9f1deae2f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201995, "uuid": "058b8061-0286-4539-8a88-c1261b43b301", "comment": "Malware payload", "value": "3b05e1dcf5c5972b511253ed9ea93d6ca20eef89095e15f8f55fbed4ab12a1d9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201995, "uuid": "4f210604-57ec-4991-a79c-fe98fdee6dd1", "comment": "Malware payload", "value": "5aade8487f0dadc0d02e0be4a35e552842164286", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201995, "uuid": "f4d52021-a476-45fb-b3ff-3ea76b1849e7", "comment": "Malware payload", "value": "14a82b2ee8e2753728228aff079391062f5c6c019e808a9b5fca815830846ff1f19200ca3ac423781681ac1d1ec94425", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201995, "uuid": "ce900ff6-ac2e-44bb-bf46-af8e544d5079", "value": "67F4F02CD5E1E6AADE449CBF3A346E5407950207C78448EDB92EC2AA6F05C4C5F9D8FC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201995, "uuid": "51280fe2-8be8-4abd-8346-0f39f5e34bf4", "value": "7338aa72178e087bf8c6b401791f2ee3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201995, "uuid": "e1f0de0f-3b4a-4c9c-bc34-fea72ce49a86", "value": "12288:OkZ3OJ112hiUAOe7BH3NMlyI4oWWW35LRJgXGH7g/TFQLS28HEc+4ONgbyrckRIu:OM3OJmiUw7BH9yyIPWp9Kd+OOsLa/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201995, "uuid": "34ee1bee-1ac2-4b22-89b3-37885dcac97c", "value": 750592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201995, "uuid": "20f6b15b-d9fb-47cb-9023-ff0718cefcb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201995, "uuid": "10d60743-ceef-44fb-a3e4-a7bb975ea112", "value": "bb253f94_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa9da79-add6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620242064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242064, "uuid": "d92e59b8-dfa2-4ec7-b27d-e7174e20ee01", "comment": "Malware payload", "value": "a3d7e702795aab93fac3bbe343a1bcab", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242064, "uuid": "42f988e6-cf96-4da9-a0e1-0887f4a75af5", "comment": "Malware payload", "value": "3b09f5ee2cf4378af259c777be6e41f5e1995cf7033e9c25f40e8ba1d268514b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242064, "uuid": "763d044b-94a4-439c-8d74-2604d766fe0f", "comment": "Malware payload", "value": "6b9c7e17099ea3f778a57696f0ac36f105a2b2cc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242064, "uuid": "30798e4c-7c06-4065-ae26-b04bbb64612e", "comment": "Malware payload", "value": "8ba8746c8e2dfe9654680c82a1a1639aa52dc1548532e4190ef2a9c2f6057078af22bd630b6aa46a504608d545559d93", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242064, "uuid": "c50c04f8-6c5d-4f56-9dc4-57ec66ce175c", "value": "1AF3C085DBABE87FC45A35399071DFFB5B388B145250C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242064, "uuid": "cb9455b0-15f8-4939-93ab-0df049d62b55", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242064, "uuid": "bb10a8b4-36a2-4a76-85fe-16a020c28914", "value": "3072:WB45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:Q4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242064, "uuid": "c17127f4-8999-46c3-9194-1edba172f09c", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242064, "uuid": "ee6cb8f6-45ca-4456-88e2-f62d4d331672", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242064, "uuid": "f87dcf1b-b567-45e3-b88a-d26dcafd8fc5", "value": "a3d7e702_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a789edd-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208590, "uuid": "b2d50432-7c7d-4a21-96f7-69aa9a12a66d", "comment": "Malware payload", "value": "c34a3fa8d2b270b6d2018982b2c83be4", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208590, "uuid": "1a5e0695-1e68-4ed4-a839-8dcf41de7ad3", "comment": "Malware payload", "value": "3b0fa02f2fa1dabd36c4135f6ed8e39f1e60fb4fa098c0364112b6d3d49994a6", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208590, "uuid": "7f493d80-2da6-49cb-9f66-409334824b2e", "comment": "Malware payload", "value": "89d9e090563212d25b0ef1d84e76c7f120b513a8", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208590, "uuid": "2d4a5266-4eba-4406-8613-95f04f76f9d3", "comment": "Malware payload", "value": "d9d7352f6ab72244723a5f4441810d35abb17dda5ff2472874c7b8d38036a6ab54fdc97246a1bede815efeb1c9245f1a", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208590, "uuid": "5d4e47b7-96f3-4658-86b3-8021de8cd0d8", "value": "94F5339CF1ED29FE43A46671A1EBFF303026AACDB06193515CF7E5890817260D4E9E2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208590, "uuid": "c2e43e3d-a771-48d5-8a39-4d44c8e4f5ba", "value": "49152:HT0+oOBiXLUNaRHKmjsbS21i2F/ecE+0n9aFctnpbbTruN3MKQexlwLE5Ig+M4hQ:Hos909Qg6ecEZHyEexmLaI9MY7bxTE8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208590, "uuid": "2de45faf-9e8b-44d4-8ae9-f974f1cb6aa6", "value": 3641344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208590, "uuid": "59d5b659-fa5c-4363-99f8-062083e09eb5", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208590, "uuid": "ddcc23db-7269-40ef-a79b-acb78c9b6d94", "value": "3b0fa02f2fa1dabd36c4135f6ed8e39f1e60fb4fa098c0364112b6d3d49994a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb7d05e8-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208941, "uuid": "f6839308-5b8c-4b77-a121-a0f33294b241", "comment": "Malware payload", "value": "41f99ff8f93b91f94ae6de9cd7dd6f0a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208941, "uuid": "a3f741a6-a426-4bcf-9a71-9c1b42d572d2", "comment": "Malware payload", "value": "3b6af6a21800d4ac05a93cc76ad7098740f063ae4efa486c530188f3d1b57adc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208941, "uuid": "95f1fa32-6aca-411a-bcb3-5dc9c233dc72", "comment": "Malware payload", "value": "e002288077a0fa67e92d3fceafa351f66e261767", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208941, "uuid": "4d6db3ea-5b93-4ba8-a394-5c6ad0eec61d", "comment": "Malware payload", "value": "af7e16eda1260b87a90127b5fb07c32be837426e014543c3f62cc2db0ebfab2ae151a2ef89e7a601ac345b34611d8620", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208941, "uuid": "2883050e-dbdf-4618-88d9-286a8eaf667d", "value": "3F15E11B38606758F9C0DD714D33A96F11E323D4E07DDAB9836A05BAB8DEB832B34558", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208941, "uuid": "8c34df86-7a66-4e9f-9d91-39041e66686c", "value": "933e8ab522335526a4014280bde4cfa8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208941, "uuid": "5838a1e7-00b5-423c-9644-17290dfb968a", "value": "12288:r08jWfqkRqoNeN+0G+0um5PY1NhCCidpRfKb7vSGmkiyksftHg:rwqkwoIt0ubN647vSbkiFs2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208941, "uuid": "3b952e51-0ca6-435f-8c89-e9f0d25cafdd", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208941, "uuid": "4f735707-659f-4849-9812-1df554d2b2e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208941, "uuid": "2816d531-f5ca-4a70-9744-2af70e5117fd", "value": "41f99ff8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d5924a-adf6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255907, "uuid": "f231f702-8fab-4aed-aa49-fb041711e5c2", "comment": "Malware payload", "value": "366ca81c2e7fb9a5f6d51a991a4bcf49", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255907, "uuid": "9890bc2a-c1e6-406d-8bdc-8fd9376ae860", "comment": "Malware payload", "value": "3bd3c64fcf25df24c69a07b9fa404f6c7b546889b1009b71240bb74d5a6bdeeb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255907, "uuid": "10e089d6-5d33-4c7c-9ecb-dff1cbe059aa", "comment": "Malware payload", "value": "35cb19db8ddd92a4d8a6871b447d3a24ba5bf3e3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255907, "uuid": "37e02d56-fc41-455c-9ceb-6c84341f1838", "comment": "Malware payload", "value": "28d53fe180d3a9d1fcc841cd0297aca6b27fd5ccca2bf107504958211fd132235e389dddc7cd9d398f3eabfe1b1d3815", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255907, "uuid": "3e616ac8-db2c-45df-bd9a-4beb80a3d1bf", "value": "8DF3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255907, "uuid": "0cbfc61c-a66e-4c00-acb3-0b03c80add08", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255907, "uuid": "4693ad49-0d69-48e4-8819-0fab02a270b5", "value": "3072:R84Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:lDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255907, "uuid": "a691fe60-b174-4bb0-886f-99bcbe5f6942", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255907, "uuid": "427a56a8-5ece-4bda-9589-ae11c9b15e00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255907, "uuid": "4c665115-a8ae-4156-8bf5-93cde3132b62", "value": "366ca81c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a529283-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201852, "uuid": "faf68b30-f42b-4e90-94f2-9db82a2c88ed", "comment": "Malware payload", "value": "a6000cfd981ee0b7618a874053dc7399", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201852, "uuid": "c602692f-b628-41fe-b060-90e139613e58", "comment": "Malware payload", "value": "3bd7dcf904cb67945b0393b17213877bcec87f8a0ddf2000033ad32a6ac06f8a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201852, "uuid": "0be01a83-9e0c-4661-8e95-bb27a82df065", "comment": "Malware payload", "value": "2dbdc8a9bf8a65813f0c21c70ae1523e1b3b7a0e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201852, "uuid": "98ddb133-160d-48b4-881c-3221acebab38", "comment": "Malware payload", "value": "6bf2b927e47355fa1880b2cd7486814da3df6cafce3d404d4894b86bdf810e70fde0c9dc43e78750b8ce756ae5fb308c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201852, "uuid": "cd168533-e460-4dd8-a22f-ecbe0c9a4839", "value": "28D4F1978953757FFFCC0878CE6B03C44EA4C281BA0AF2B6A1579B64047B5D6DC6E812", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201852, "uuid": "40452c77-afb1-4a82-afd5-30b0b7200a99", "value": "812f8f2966315a885fecba63ad9dcfb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201852, "uuid": "18a1a26b-e176-427e-87a6-0f97d488ccf8", "value": "12288:dSXoRj9/vKoe/Wr4mjy8BLPuMmOQb1931FexYbATEJ2CKWEk:GobSoe/WhxSMm3AnCKWr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201852, "uuid": "c4b6fbeb-dcfd-4e43-9064-c3480ceb7f13", "value": 654848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201852, "uuid": "4e27cae7-0402-46de-a668-22841683c57e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201852, "uuid": "73889bcf-b365-49f3-9228-b8ebcbffbd07", "value": "a6000cfd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870b292c-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241817, "uuid": "a67434f7-429d-4ccb-a736-6d50fed770b8", "comment": "Malware payload", "value": "68667c4db5f9b859443aeb6528cfc2e0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241817, "uuid": "2390e0f3-ed03-4876-b4c4-6739ae5498fd", "comment": "Malware payload", "value": "3befb95f13ea54658c763626a8d5f13758ad5edbb09e16a927f24a9d425e0612", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241817, "uuid": "0e188bf5-264a-4a06-8ede-3224c55bcd8a", "comment": "Malware payload", "value": "19fdf049603ab1e04c9efc46143b7fd0b4668089", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241817, "uuid": "10fb66b6-5f9f-4942-9dcd-1bc593a604d3", "comment": "Malware payload", "value": "83a698abd3fb5feea00138df6a625c4243f0f6d8908f4dd62bc3dd00edf31c236a35e2904a2c109d88732ffd68c708c8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241817, "uuid": "07d92bbb-22c7-4d49-9ee6-307882f77da0", "value": "98F3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241817, "uuid": "9704e06f-505f-421f-9492-d38f55f40232", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241817, "uuid": "c96de8d7-ef84-4823-85ff-750cecdb96c8", "value": "3072:fi45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:q4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241817, "uuid": "c919a714-8ed7-4c1f-9a6f-8b9bfa8e7d85", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241817, "uuid": "f204b596-73b3-46a5-a2c8-d103c9b13e64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241817, "uuid": "9aa57fc5-5bf7-41da-9227-83f07c63033c", "value": "68667c4d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "922b0149-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252143, "uuid": "4b6a46ba-4239-4378-986a-07a0b6e9cc30", "comment": "Malware payload", "value": "a12cc2986a2573647b5546f22aa1a6bd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252143, "uuid": "abee349e-6f43-48f3-bea5-2ec270898ee5", "comment": "Malware payload", "value": "3bfe2cb5ad43327a668b935cef86e42ef63d1c9c29540e8639c89ac63bbcb1bd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252143, "uuid": "282d5f6c-96b4-453a-a375-31a5898e3073", "comment": "Malware payload", "value": "d23380c45fb1e5e0069067347e994bb68c73e289", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252143, "uuid": "cc5a675a-2a0a-4d98-925d-08222f755cc7", "comment": "Malware payload", "value": "38b372b8fbd9df82148e60125dadca5faf92abe4e8da2ec6df728849b2c65b73334d22c2e7c3b8c1c324279ea6bfc26a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252143, "uuid": "956fdb5b-135d-467d-a151-9353082376d8", "value": "E1F3C085DBABE87FC44A35399072DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252143, "uuid": "1a5da8fe-074e-4e06-9440-07c02b94d5aa", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252143, "uuid": "676d6138-e115-4d44-b3a6-34580ce70784", "value": "3072:cB45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:S4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252143, "uuid": "d39847da-b83f-46ab-8dce-f42d31c2aaaa", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252143, "uuid": "f747fffb-98b2-4dce-a43e-a0bd0f32247e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252143, "uuid": "17da5fce-449e-499c-9fc1-83730885d2aa", "value": "a12cc298_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99676bd5-adae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620225097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620225097, "uuid": "a7b409f5-a568-49b4-86cb-89f28bba2b48", "comment": "Malware payload (Quakbot)", "value": "8fc3671cdee9e365d46bb0a1b6fc02c8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620225097, "uuid": "75014c61-477d-4d82-a5a7-5810c3cdc95d", "comment": "Malware payload (Quakbot)", "value": "3c40784862d5a82b93baaa62432b2903048c5fcfaa9d3d31cebb96ae4980ddd4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620225097, "uuid": "03e672e9-aec2-4dc3-813d-ab1bdaa1099a", "comment": "Malware payload (Quakbot)", "value": "5dc7710d25312ddf39250452478c6f03ec1734ac", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620225097, "uuid": "ec553fbc-cd0e-4cf2-b17f-fa24f1402988", "comment": "Malware payload (Quakbot)", "value": "06eac7385e292635924a8e2abcadbfa0883ebdabf5292316f75fa296fdba8459c07b598bfac97a92aa9563d8cb5ed8bb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620225097, "uuid": "861eccf6-f1c3-4070-b2d0-b38b3dbfcdd0", "value": "3B657C31B1D2C437D473267C9D7AA29D982A7D111E28985B7AE40F4CDF3A6803E2D2D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620225097, "uuid": "682f8edf-54d7-4896-8ef3-87b8e61c7c4a", "value": "413398ffac649594b2b53c025e6614ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620225097, "uuid": "c193846b-1aec-4d19-b043-70ad8d1c30e8", "value": "24576:LAboz/I6budWhdq9EROsB3OPh1tWVJFgQbpXLGmw5:sbeeGRuPPu7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620225097, "uuid": "e31493d6-f212-4617-b851-aecb0ef14a28", "value": 1496258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620225097, "uuid": "05733579-d23f-4918-8e08-cc6b3044dc6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620225097, "uuid": "fe844c63-f33b-470f-8d9c-4fb4e48241c9", "value": "8fc3671cdee9e365d46bb0a1b6fc02c8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b08a5fb-ad81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205665, "uuid": "183738d4-e2d5-4926-a713-4a036e8419e7", "comment": "Malware payload", "value": "cac6c3e3805a754576d536736cdbe6a0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205665, "uuid": "d6034239-4627-404b-965f-0844c6d1f919", "comment": "Malware payload", "value": "3c67ddfa09062c32c2b6492922b51fec31764b10e0dc1699986cf7aab2133ce3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205665, "uuid": "5c85177d-453e-4393-900c-a1eede94ec15", "comment": "Malware payload", "value": "e9240bc45d4c597adc0ff730de09edb62be08f43", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205665, "uuid": "c7be3c60-6b13-4407-b414-3dd7dfe497d1", "comment": "Malware payload", "value": "7503ccd907f09a8e5ebbd9b1c8f5506655e1876a52bf4c524a31a16e65000da5ea1df520295307f741a3a9d60625ce1d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205665, "uuid": "2686a27b-d353-4ce6-8852-0fa46ec0bf83", "value": "9A536C233740842AE3510D3423582B7467A6EF736216F567E3A5F91C3F329C6AE187A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205665, "uuid": "757a582c-f72b-48b5-9571-13653268695d", "value": "7568fd2720750e36a6992434b5b7efe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205665, "uuid": "57102d36-54db-4eef-afe1-a8e697a52a8d", "value": "768:b/5inm+cd5rHemPXkqUEphjVuvios1rPr4adL0NqlJMU60+ppQ1TTGfL7:bRsvcdcQjosnvnZ6LQ1E7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205665, "uuid": "50990014-56dc-4ade-954f-6da63de29dac", "value": 66599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205665, "uuid": "cecbb0df-5fa4-4b54-87ef-c659a15897f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205665, "uuid": "3064af06-fe43-4b58-ad38-978b90d514df", "value": "cac6c3e3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee3bc6d-adc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234126, "uuid": "9ca0720c-c543-4701-b767-68c64e8d0304", "comment": "Malware payload (Dridex)", "value": "0b05ca46fa808584b1c1222bc1104ae9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234126, "uuid": "60d5dc51-4388-4334-b448-517c22b73515", "comment": "Malware payload (Dridex)", "value": "3c75839fca4603d3e3a29bd72b95b81a02b795f6687661927862264232d96033", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234126, "uuid": "45f12466-10e6-440c-b4d9-5b03b8989bba", "comment": "Malware payload (Dridex)", "value": "00cd68f60995dc84ce591e8d154ab3f64cb8d5eb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234126, "uuid": "baebf37b-722b-4ce8-901c-8bf721746a50", "comment": "Malware payload (Dridex)", "value": "d045d28f26ba21abf2462e58caee4e74f9f922461d5497eaed499a0d350ac2ad9d10c78a2cacf1615233ad0adc3c49ec", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234126, "uuid": "4bee33ce-a4ea-4276-83ae-03d284e71560", "value": "1AF3C085DBABE8BFC45A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234126, "uuid": "33469c06-5b8a-4cd4-9f3d-2ba0b4baa78a", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234126, "uuid": "f1fb23b1-42be-4f13-b41a-bb022085055d", "value": "3072:Nk45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:K4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234126, "uuid": "6cfd8f33-b1fe-4f12-8574-cebe37c4860f", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234126, "uuid": "6d39d89d-8801-4d83-a8c6-ece8caef600b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234126, "uuid": "f30b5641-33c5-4936-b9f8-94918cbace8c", "value": "0b05ca46_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68979636-ad47-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620180777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180777, "uuid": "7d30d17f-47e1-4e9c-8964-e5a2d679397e", "comment": "Malware payload", "value": "1bdbd323670dea15f2144dab3d503e19", "object_relation": "md5", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180777, "uuid": "f10f7f83-6cc2-4a56-be91-8e029d74b1c1", "comment": "Malware payload", "value": "3c8035d3644330663cb3010cede534e06d81612c12e49101c41d6aef3b1f627a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180777, "uuid": "a9be58d4-56df-4fd8-9b51-a54100f0e3a7", "comment": "Malware payload", "value": "89037178f53751f686f82f456efa63aeb69132f4", "object_relation": "sha1", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180777, "uuid": "4ec47657-2d1b-4e6b-89ad-954e2730fd67", "comment": "Malware payload", "value": "031c5f91d5679b25c35e5b2ef6a8408c3a3d9efe9702a5b12488ee8750bb2d8698ff86701d3e319dc56ea6aee6cc5b54", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620180777, "uuid": "bedf1e2b-6bb0-4d93-a7a2-0ad20a25adf2", "value": "A3E3BD88878AD8E7D5E27EF02907B06A4653DD6D50E3E8D536DBFE2C3031591088DBA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620180777, "uuid": "08b9c009-c681-445a-bfd3-a096734be6b6", "value": "1536:+3icGgKEuISZ+SsxcWRMyEWr4S6NnM+3ltHxr1P5zdOjApjVSyz4V:aSCcWRMyEWr4S61M+CkpjoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620180777, "uuid": "0bd2c3f0-41aa-463f-bfe3-b06eb0fb5b91", "value": 155136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620180777, "uuid": "28b93f3f-d49b-4779-af16-a4148c7f496b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620180777, "uuid": "e6f22970-90b8-476d-aa86-004a0f86a20b", "value": "3c8035d3644330663cb3010cede534e06d81612c12e49101c41d6aef3b1f627a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac251a2f-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208808, "uuid": "0e931a88-ccf6-490b-b294-ece0b1e74ffc", "comment": "Malware payload", "value": "e7fef9d10d961acc9dd92def144307d9", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208808, "uuid": "d3a03f82-c3bf-480e-87f9-582c42f04d08", "comment": "Malware payload", "value": "3c9bd5a8fb1a6a386c272675d5256d4497927828609d460f40ffc1a5a6f24052", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208808, "uuid": "036e826b-0931-4bf2-8589-c64691090476", "comment": "Malware payload", "value": "74f021ff219929ba0acd2a3093aff17cacad8b6d", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208808, "uuid": "ebc9e01d-37be-469d-8c66-e3b08ab79214", "comment": "Malware payload", "value": "e0eeaec37f8b42c9349e596da4b0dcc01e5737d06a29e30f25292fb1426d392ed6d53f3d491ac77e259872016fa0e00f", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208808, "uuid": "a32763c0-efd5-4495-95f2-e93cffd9155d", "value": "2CA1E750112C1AB17346697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208808, "uuid": "271d7ca7-76f5-4299-9d7e-4cbf143a72a5", "value": "96:+RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:+RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208808, "uuid": "f490a09b-3d37-49cc-90e4-18711f3dea80", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208808, "uuid": "229cce20-29ba-449c-bf53-8e2716d296b0", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208808, "uuid": "1fc91ef4-c72c-4f5a-ac8a-a56827703d3d", "value": "3c9bd5a8fb1a6a386c272675d5256d4497927828609d460f40ffc1a5a6f24052", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc1c5ed-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252112, "uuid": "1e5bc461-6bfa-4124-a64b-914f9902a2e9", "comment": "Malware payload", "value": "1158913493d924ada95720e80447d0a1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252112, "uuid": "45e84cc5-e820-47b5-b4f2-610d996ba9e8", "comment": "Malware payload", "value": "3ce5e190e7246d25aabe9ca91324e3e9a1e6ee67fdcaf0d42008843942b1e0d6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252112, "uuid": "0ddfa068-c449-4f60-90c8-d0971e0efffb", "comment": "Malware payload", "value": "5a814550e53879c9597059ceb790d2ed62d6610e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252112, "uuid": "75ee382d-b972-4610-8587-a7e96b884fec", "comment": "Malware payload", "value": "7d0c62f804b5fdc4659f2f9b457fca0a59d8be04eb9b308ff656fed1fd8c6c67d1610d0e573da0d4bfbb459b51a57411", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252112, "uuid": "8c251af3-d161-4c2c-a1b9-3e01c352246c", "value": "FEF3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252112, "uuid": "5b4fef44-a51c-418e-ae9a-3d61306a8e5d", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252112, "uuid": "9453da87-4029-499c-a637-c54b46e7993a", "value": "3072:+f4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:BDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252112, "uuid": "794d1117-b98f-4bbf-9794-ede94d3837b6", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252112, "uuid": "3e7cb3de-7271-491f-8e7d-2780f7b732f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252112, "uuid": "a3e30d04-66dd-4593-877e-f03b6588d28e", "value": "11589134_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "def1640f-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620202021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202021, "uuid": "8c6081de-0078-4b49-810e-40f0a9bd062b", "comment": "Malware payload", "value": "c55e27166c79873913bd5d4b5f3787c4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202021, "uuid": "1a704756-1d34-490f-9c0d-f59e69f22080", "comment": "Malware payload", "value": "3d06f0bae062ee37b60b0a4ca25fe2a27f817c8d375f2a2721bd4b7951e23d31", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202021, "uuid": "57a60b58-12cc-4e81-9634-eb35409c8d70", "comment": "Malware payload", "value": "ae649c013079403c497f64119fe3aa127c56ef0a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202021, "uuid": "f2807816-32eb-4904-ad0c-ff651f466e06", "comment": "Malware payload", "value": "348276475350790aa0d48879a51a1d947e21cd19162b35b4dc1fe48a59e3bf0a56637a429ba1d7e7553f6b93234dd727", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202021, "uuid": "1297a825-29b5-4f89-8cad-91b6ece7917a", "value": "38758D23F3D14837D1731A748C1BD2B9A826BF512D28758A7BE82D0D9F396913C392D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202021, "uuid": "29195b33-b089-44ce-a832-84c00ff777ba", "value": "3c8577ca4bab2f95cc6fc73ef1895288", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202021, "uuid": "7a4fd76e-747f-434b-9c37-696f341574ee", "value": "24576:hxY3NtGUmJr+4Obxd+tPZSZciE6EhE9xY3NtGUmJr+4Obxd+tPZSZ4iE6EhE7:LY3buzMX0IY3buzMn0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620202021, "uuid": "56d8d8b1-85b7-494e-9b48-10a04bf03d6b", "value": 1663125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620202021, "uuid": "218e9764-9869-46d5-b771-a0c2207ca593", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202021, "uuid": "a6b299aa-3300-49ea-b086-2d57c206ed31", "value": "c55e2716_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d41a40fc-ad80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205439, "uuid": "b9fdabe3-1526-441f-8bbc-194ffe2a07fc", "comment": "Malware payload", "value": "ed16e50b2b1fdbd738554f67bc032eba", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205439, "uuid": "8942f1fb-2cf5-4a39-bc36-8170e0875af5", "comment": "Malware payload", "value": "3d1e70f5875d30d09fc5a397afe2eae8be99aff9cee0631a7be4fa4e6fa8d8b3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205439, "uuid": "38b14d3a-7e82-43de-9c41-923eaea526ee", "comment": "Malware payload", "value": "30ad159e1269c4591540013853b1e9faa2acde21", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205439, "uuid": "a8482d28-2260-4b1b-9a19-fa2b1ce54c51", "comment": "Malware payload", "value": "6672e15600a9dcb4b0581d6724166f96a3d230e8836a8bb83b4b648ea50d6a32592677562da95b6217db69529e2e123c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205439, "uuid": "b97c4931-227a-4060-9904-f384608b4fc1", "value": "95D4ACD8F5158B3DD0DB8437718F73CB2A903A02251ACE73CEEC2502DB4A6DFA6A9515", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205439, "uuid": "93250964-00db-4e4b-93b6-91a07ce88b5a", "value": "ede628158e8c6483a44b954f06677d89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205439, "uuid": "df32109a-43c0-4603-9f1b-4163ee860836", "value": "12288:zMX5sF/XLDiI+5WwycpIARoUwKOFy+Aub1QTUznUBTm:zMX5sF/Hx+ISRCKOUamUoBTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205439, "uuid": "c0e7db2e-91d0-4f9e-8a2e-4e94c40711bd", "value": 640512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205439, "uuid": "ceca3bb3-6a47-4bb6-bf87-c496a4ef8c9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205439, "uuid": "fc7c46fb-e01d-4938-9d8d-4ae5ebf5864e", "value": "ed16e50b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e562d7-add6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620242058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242058, "uuid": "471115e9-d5ae-4a60-9272-9789527376f5", "comment": "Malware payload", "value": "a4263ce1d8289275827f0550023573f7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242058, "uuid": "906a3e9e-6d78-4778-bfa8-ed251a0e6b9e", "comment": "Malware payload", "value": "3d21795b58dece95b0f22e082d51a18ed522a883305d36a116e52c1b46c268e7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242058, "uuid": "58113dbc-a13a-45e6-89c0-d85107518e32", "comment": "Malware payload", "value": "82c5f4d5873b816da3fdfacf9810ab4a8db350b2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242058, "uuid": "824766ad-ec3b-483c-aa9a-dad986ed5953", "comment": "Malware payload", "value": "3a7ed2400ec0369cec1d844965c7203ddba99c83ff2e5d46a62e79f0f33c5762c8202f012a4ac19a8940aa3bf4304309", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242058, "uuid": "e7a2d3c2-29c4-4a72-933b-795dbe75e5b1", "value": "45F3C085DBABE87FC44A35399071DFFB5B388B145250C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242058, "uuid": "268d9966-dc85-4dc9-a313-9770c5f3a0fd", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242058, "uuid": "61b4ff23-311d-46aa-b770-3afbfdd0a47f", "value": "3072:WA45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:l4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242058, "uuid": "1db5eb46-8320-4504-8317-fc4d868ceb03", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242058, "uuid": "574071cb-8839-495a-b6ae-7f3be9bda013", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242058, "uuid": "90346cdb-1fca-489e-81ee-9900994f999c", "value": "a4263ce1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc575cc0-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252643, "uuid": "b58f2901-3813-4fda-a7b2-5c60f5490cb4", "comment": "Malware payload", "value": "8e5b238f9a7d988fbf7747f1dc855b7f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252643, "uuid": "a138b8ec-82b7-406d-830a-a0d805abef0d", "comment": "Malware payload", "value": "3e03641c80cf0577ca0669aa888553bae78850f5f1dff976016600f1ede508d5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252643, "uuid": "02cc7cca-ba1d-4c9e-b515-bb508bf8fe2d", "comment": "Malware payload", "value": "48808a14ff1379f0d5fdc2a066f0cdec2aad8a57", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252643, "uuid": "7fae9e55-014e-4f9e-b8a2-a3bf3225c338", "comment": "Malware payload", "value": "a881a336f89dd19e4c451a253a80a0404eeec6c184286c7cdf98937a6de0f8aed6cf2f6f075a9ae96268154120b293e3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252643, "uuid": "c0be901b-0c02-45f1-bce5-b73afa848fd3", "value": "95F3CFE89A9FC097E663583055FF3BB6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252643, "uuid": "10503b70-740e-4215-9db1-8c123a802dda", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252643, "uuid": "9010227d-f2ab-4b0f-adce-945160609d49", "value": "3072:Xf4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:ADBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252643, "uuid": "1a811e2a-2e6c-4b15-80ec-645643fdadb8", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252643, "uuid": "f15e517e-4387-4424-9eaa-6e5e2994ae58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252643, "uuid": "cbbf58e4-005a-4626-8abc-37fe525122a5", "value": "8e5b238f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf91625-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620212567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212567, "uuid": "0d3b9fb6-bdce-447c-89ae-e8f4739d2f03", "comment": "Malware payload (Dridex)", "value": "5285324f94920bec9c7811e57a2fb4e2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212567, "uuid": "ea90c594-d295-40cb-b4ca-85137b5c709f", "comment": "Malware payload (Dridex)", "value": "3e2479aac81fe89df300071170b10423b33ec1e52fa7a3f3fb039040c440bc40", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212567, "uuid": "9d29bfd6-b8aa-44e7-9b27-2d50e41b2eca", "comment": "Malware payload (Dridex)", "value": "b030edbb1cddfefed4cc6107176698c5081b3b21", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212567, "uuid": "6fe34363-c2b5-4401-9e45-43915c006c65", "comment": "Malware payload (Dridex)", "value": "b98b90ce278b0bd3307b0a473e0ddb26c16fc6abe26bec3491088357414436146826ad59ca7ea44b9e4512688a46e968", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212567, "uuid": "2e4a73ea-33c4-4285-a1db-eef7fcc21752", "value": "00F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212567, "uuid": "193dd9be-076d-4db3-bbab-3ccf7b639916", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212567, "uuid": "7a36c984-b26e-478b-ada0-4d0417781697", "value": "3072:eIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Hc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212567, "uuid": "b5cc15be-3456-4d2d-9a56-e57025804a3c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212567, "uuid": "808ff068-8014-4e8f-b078-ccb23379ce3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212567, "uuid": "6ad9c3e2-b654-4057-986c-94c8d1cb51f5", "value": "5285324f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3c752d-ad81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205529, "uuid": "778a2f9c-3b20-44e1-bfa2-7f421cfd905f", "comment": "Malware payload", "value": "ccf453c11db257e4bea3832b57c03a76", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205529, "uuid": "eeeac284-0d25-44d6-b120-07aa8e6b7ade", "comment": "Malware payload", "value": "3e288df0aca51f3b7e4c59215d9a580865112c757c51333a1fe274c235a89a8f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205529, "uuid": "3b97d662-c418-4d98-88c3-261e53969a77", "comment": "Malware payload", "value": "88cde5a962bb8d50370765df7cff5a37d22d359a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205529, "uuid": "b788f2b8-60e8-4a4c-8042-6b305f4a81b2", "comment": "Malware payload", "value": "404a40b6eb4e2a64d0b8a98e177c7a1679e561158145f26e00c025f21f60edaf1080983b80be62e652e51c73d6902c81", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205529, "uuid": "9a18247d-d943-464a-b0ef-8cf82a937533", "value": "BC3449113640C471F3191B314916EAE04969AD3D1AE8E98FF7787E3A5E322C39A7714F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205529, "uuid": "ca0eae14-f6b5-42f2-89cc-6181fe04b2de", "value": "afd0acd5e00a1184feabd9241e36c59e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205529, "uuid": "45b011bf-0d18-4726-bef1-8020d07848f2", "value": "3072:TIG8RWrNcvXLM7u265wcQcfKAvTbcJDzoJ/Yi:EGwWrNcvLMPrcQcfKAvT4pEFYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205529, "uuid": "e70cdd1c-d2ad-410e-b904-3e4c76017c5d", "value": 239418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205529, "uuid": "8537ff96-69c2-44a0-b3d0-77471b31eb28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205529, "uuid": "b340ea68-49f8-42d3-83fb-44f97bbe20c0", "value": "ccf453c1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "000c7710-ad62-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620192198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192198, "uuid": "91622f5f-749f-4db3-9168-91c0a2e655fa", "comment": "Malware payload (AgentTesla)", "value": "f428ddb4537097b6879a2e9aba109a96", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192198, "uuid": "a72eb410-c29d-48f1-8835-5339d8e71e80", "comment": "Malware payload (AgentTesla)", "value": "3e64f5eda4ef09a85c23e63cd22d7aa3c066df59fb509dcafad4e1f8ab359a60", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192198, "uuid": "b20877a9-d40f-4171-91b0-f91a79e0df14", "comment": "Malware payload (AgentTesla)", "value": "be333591b4080a04a16369c5f95bba02aa04df8b", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192198, "uuid": "7e8a2d0e-94ed-45c9-9560-792a259efc1c", "comment": "Malware payload (AgentTesla)", "value": "4d607a5cf18539536ea6ec90a37808bbff20d9ae605e7fe5e8e3e31f213511df696debff9481dc2beb795271db5f2786", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192198, "uuid": "640d55c1-53e5-4b5d-808c-0b65409b1818", "value": "7DC4333F109102D86C748EDADE99F60F83AD146B25B9783E216D3FD7871ADA445F8B08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192198, "uuid": "84d2c3e2-111f-44cf-8c72-a4f563917010", "value": "12288:H9KHj7J/sxaRcs7C5L/rzv+rhesEP7de9PWtcQa4M1y:H+j72Zs7gLH87W7de9PW26Ms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620192198, "uuid": "1df7f453-fb01-4b04-a7e3-5e6b5dbd7fbf", "value": 557497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620192198, "uuid": "37ab3d61-ceac-48a4-bf7d-0cafb96ee742", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192198, "uuid": "4be21b6c-fc47-405d-add4-cde0d8c665c4", "value": "221121,pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f08ebd-adb6-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620228497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228497, "uuid": "7feef4c0-ad56-42ad-835c-833845db4e98", "comment": "Malware payload (AgentTesla)", "value": "50cb2071c02fb7d4bd692b1a1c2a4eba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228497, "uuid": "86670f49-d840-4e0d-b4b7-fac3fc3934e5", "comment": "Malware payload (AgentTesla)", "value": "3e73f4099c455a06d7ba34322a965bdbebf309d57b3b1566269af830b10e999f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228497, "uuid": "7ae3fdaf-4140-407c-a039-f6ba040c8768", "comment": "Malware payload (AgentTesla)", "value": "5369175eb8b96536d70cea1796512ac0ce9a7023", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228497, "uuid": "e865e706-b4f0-43f4-b250-7844a21e86c8", "comment": "Malware payload (AgentTesla)", "value": "cc80b0ac74f451b3a8efe27175ed53412176e4aac4568af36070d0491e0450a37cc8ae7775e0b0fb8a06445582ff2adf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228497, "uuid": "4be5cd29-349b-4ab6-972c-caa64d00d8a0", "value": "BE05123C66945766DE3E07BD2A68C0002BF4BB3AC363E71E6FC0257B5F62B418761664", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228497, "uuid": "e5ba2bc6-7138-4468-90ed-9d4735a0a7f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228497, "uuid": "95a63899-5d3d-40ca-bea6-902c62325350", "value": "24576:4dH16lnmLoIpEneKW2e/KxQSQmtMyGsJn0w:sFUIpEneKe/Kx+2nGsJ0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620228497, "uuid": "d928d6f6-78c0-4dcd-9a30-59412910a266", "value": 840704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620228497, "uuid": "3a537408-9131-4e4c-a196-10105b140c1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228497, "uuid": "245eda8f-4e85-4153-a26c-fd8f7b7b282d", "value": "Payment Advice.ace.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c745ca-ad81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205649, "uuid": "7d8cce51-ee19-4440-b25f-f7bdf9a1cea6", "comment": "Malware payload", "value": "b4aa91f6c93e3387087f4a0685ccd6a7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205649, "uuid": "e4bee3c3-f728-4ee1-99f0-b24c72168972", "comment": "Malware payload", "value": "3ea27d3f24e2f1b5e1f7a0a3cd7f592f5cb396a8b0ec0532fcb5cae852f08aaf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205649, "uuid": "92bbe7d1-d014-44dd-9b85-4135424ee637", "comment": "Malware payload", "value": "9086cf77e822bedaf944f23def44806489f5e56c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205649, "uuid": "15fdbf8c-b434-4911-9560-5bfe681cabad", "comment": "Malware payload", "value": "b4deaf6d629eb798dec5cff99093aebf68b1e67a756461a8be0428f4bc126096b6cdc7075325b2f36c33bf76cf3bd9b6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205649, "uuid": "7c5b8fbe-34fc-4f88-85c3-dfcf0c08b282", "value": "B564016372E1D862F4150A398C53C6FC5A65BEA1EAB0821B3AD83F5FED732445C23751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205649, "uuid": "4e5defd5-cdbe-4ee4-91c6-7c3d645d8935", "value": "b9e71013c0a99346768184c489480291", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205649, "uuid": "550538ad-f32f-407c-8321-62a8a2143dc5", "value": "6144:FuX1qoEd2v9B+kDHERyxENymABA4Rs/xN4QnQUkdn5RQxfbB:FwHBxDHEoxG0s/xMlxU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205649, "uuid": "074c88f9-d6a3-4f8c-a8ce-de456af0b59b", "value": 310552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205649, "uuid": "dee8bcef-8a69-4a6c-8dac-f366856a7ae8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205649, "uuid": "96f8251c-708a-4060-b442-2c0141b8cbb1", "value": "b4aa91f6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "271d05d7-ad68-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620194840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620194840, "uuid": "e7a33636-a90c-4a04-897c-ea59c0012f8b", "comment": "Malware payload (AgentTesla)", "value": "c121dc64ad04975148e0e9f6c00dae2c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620194840, "uuid": "eff2e931-3b9f-4895-9bb4-095604f55037", "comment": "Malware payload (AgentTesla)", "value": "3ef3019867fc829d59b65a986f05ff1fd21c10f88266d10344d92a738746bb50", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620194840, "uuid": "f33e39ba-51b3-4a24-9e13-171bbf0aa460", "comment": "Malware payload (AgentTesla)", "value": "52716680cce5e9b832d424c1f8d2248be438e64e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620194840, "uuid": "5cba98af-10c6-4025-bdcc-b45fc315cc06", "comment": "Malware payload (AgentTesla)", "value": "c6d02bc0cbf8a0efa7706530898b5e32ea9074444bfc8ea5fb61a770b7d57bef56d8f8d845bb8ea11cb1a22baeae69f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620194840, "uuid": "d32ba3df-6ca4-4c05-a4bf-6a8643383cf9", "value": "86E423652319BA74CF65D33B2626428503BEF122931DC72E2E5B80AD24EB1935F52B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620194840, "uuid": "3ad41b05-57b4-409f-a70d-9c8fbbf4210c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620194840, "uuid": "79699e55-f038-4779-86de-d3ac2e55247f", "value": "12288:HMJb8MEQch2bQnaKlOc8v2RsvOcJSV11z0MLz5pHdlJO0dHNbmeDRUrNvhkg8Dsh:Hyb2cQnaKuus5M/xLz5p5O0JNbDRENv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620194840, "uuid": "2f8bc5dd-991a-4081-9fa2-4747bf1ade26", "value": 706560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620194840, "uuid": "cb99b8d3-fbed-43e5-91fb-27ca2a15367c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620194840, "uuid": "c777c1a6-d5dd-4763-a151-bd6fb3381e36", "value": "Po_9046- PA118.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5789a544-ad7f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620204800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620204800, "uuid": "61f42d01-fca3-4d85-8035-acdae1016386", "comment": "Malware payload", "value": "98bd04ca5fb71ba249683cd17c47715d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620204800, "uuid": "10c3a4da-a710-4d48-91d2-f6d1b0c3c611", "comment": "Malware payload", "value": "3efb8d6a873c1553f95c6d20ef6a489530040080a837fbf7cf91108501e8fa49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620204800, "uuid": "c27cbe3f-8404-4d17-8d53-1f7e7a744859", "comment": "Malware payload", "value": "d654b5bb277ec31d92552824dbeb0bb09f13a66e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620204800, "uuid": "d57ccc3e-eba4-497b-8ad5-00447f98f63a", "comment": "Malware payload", "value": "3a8bf4040be61280fc2ef37f273b9c4bd0e1d69cd830e240f7835a9d4d6fff21df29bbc225ac1ce2691694985635026d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620204800, "uuid": "273cc893-26f7-4e45-85c2-6f9ac524d7de", "value": "26E45D0417E45B97C2AE03B9E198E63173F5DE05A25AAB8B690BFAF53F7339144009D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620204800, "uuid": "6c521af0-ff9a-4b6b-9802-06abbbdf1bc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620204800, "uuid": "62a26835-78f6-4f9f-adc0-e633599a5ea3", "value": "12288:+1fxhwL8mLAHefRIZtbVqrTwqEZa1Gz6sUurc:6ZyJAH/ZtxqEZaLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620204800, "uuid": "6951e3ad-79c6-413d-835e-ba9f3209ae9d", "value": 685368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620204800, "uuid": "ef640a3e-9e21-4807-8092-0022a12e24ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620204800, "uuid": "db2a566e-8c6a-42fe-9684-0089e15a11b4", "value": "IMG_601_223_458.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0960caec-ade5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620248478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248478, "uuid": "75f4da52-43f1-48f8-92a5-36523ec103b9", "comment": "Malware payload", "value": "8908795dce9093b6648e751f568865f0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248478, "uuid": "a31d6db8-1478-4715-8986-b3ffe159d2e3", "comment": "Malware payload", "value": "3f1829ffe8d571142f3bad7e6e48af0f1430d7ab3d8d09fb93fa5dda4a30f075", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248478, "uuid": "69030479-7390-4e73-a0aa-5d296a52f1aa", "comment": "Malware payload", "value": "40d8c0d4901116d489c70fa30f93a1f24d616675", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248478, "uuid": "fba2545e-9840-4a06-874e-283b51651f1d", "comment": "Malware payload", "value": "7a3267bbe7cf2b6e39f5f656e9a4c576707142d438b7d950a27b7173991c8f2784520eed7a312c7ada8f1f96c4e75463", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248478, "uuid": "afb9ed74-7b5d-4be1-9fd7-710b4df08188", "value": "D6F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248478, "uuid": "ccee0c23-a9f5-4ae1-9d4f-db4a6e151995", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248478, "uuid": "c3ca6b4a-20ef-462e-a6d8-c1402ff03c2d", "value": "3072:GWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:G42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620248478, "uuid": "152f4430-a028-434a-9b7a-2c05513f8cc5", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620248478, "uuid": "022d091b-c970-4d79-99cd-5dc7914ee736", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248478, "uuid": "a1d800ce-5254-481b-a8de-2b6be146adc0", "value": "8908795d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a371aa8e-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201921, "uuid": "0ccd1984-b2e1-4075-982c-141cccc8f5a0", "comment": "Malware payload", "value": "09880304fe880adfc28550d51bfcc48e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201921, "uuid": "08b3db50-c069-4bfb-8721-546d95d9e8d6", "comment": "Malware payload", "value": "3f4fcba5e0698d8fba2490f09b01071b5beb6f66b3f62ea8feede49789c165e2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201921, "uuid": "55b96ab4-9f8d-4757-9c64-604d7bdf6130", "comment": "Malware payload", "value": "4cf3833fb78ceff38292a03457cfe0150414d117", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201921, "uuid": "7dff5fe0-cec5-4b3e-9654-79f31e2dbea5", "comment": "Malware payload", "value": "f4293ba211c60c14eeefea57e348809ad73fd382c080e2d268c8c51a803f8af2887ac8a01edd3a4e2ea4eb9368b1ed0b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201921, "uuid": "4c3ad3e4-a100-4ee0-b62d-2a48bdbdeb36", "value": "67836C21B6D18072D277427508BAC2E0553AFE51AF7582EF3A983B5D5E72AC08C35F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201921, "uuid": "d1e5fe10-a4cd-41a1-a5e4-f0800a3f135f", "value": "5f259a07286d0de03289b72c296c1693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201921, "uuid": "a3014fc5-fcdb-4e52-b1f2-6006a26e5356", "value": "768:jxDDnyAiIbhn+oRTaFSxjquEDFAnA1tLRNk2djaYoCMHosOAJMPsED3VK2+ZtyOd:jxDDnd1Raqq2uBNdSCM+YTjipvF2Pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201921, "uuid": "64ee8430-828d-40ec-80b4-af421b2e554f", "value": 87466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201921, "uuid": "b0bf5f43-2674-41bc-96c5-0dceaf4f7b8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201921, "uuid": "29759f74-8474-47e2-a154-c47ed011334d", "value": "09880304_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b9ca10-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620212575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212575, "uuid": "1be01237-c290-41cd-9a50-ad3a6e28e619", "comment": "Malware payload (Dridex)", "value": "72af46838528e20211ad1f93008c7463", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212575, "uuid": "560601b3-f9fa-426d-ba6f-c7358451819f", "comment": "Malware payload (Dridex)", "value": "3f53157ab0c1d3ea8d9182cf335c264309e88f054bcd502185ebeb9d5a769761", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212575, "uuid": "04606ac8-9076-4086-bacb-a314fd69fd24", "comment": "Malware payload (Dridex)", "value": "5c5d14887933924fba35bd6742588c2e26750115", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212575, "uuid": "b6f2a161-d079-432b-b503-c072c80cd4b0", "comment": "Malware payload (Dridex)", "value": "fd00c666379f167d17f930894e68d57495e298be5a13a30a5fb6b99e4d9e834c7f2192f10da4986eb6728cc172ffce58", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212575, "uuid": "814fac49-7a3a-449e-925c-df5e61febb2c", "value": "FCF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212575, "uuid": "3917d26d-a6b9-474f-a3a5-d35785cc9488", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212575, "uuid": "0de321c5-cba5-411d-b9d5-9e6e776b70fe", "value": "3072:7A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:73J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212575, "uuid": "9e850d92-ca79-4167-9de5-f45af6fc7afe", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212575, "uuid": "d05ffc87-2245-4dee-849a-d6ebd3f9e4f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212575, "uuid": "2a7ad1fb-af35-4d09-a364-519e360fbed4", "value": "72af4683_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f42407-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252366, "uuid": "8fde93c7-7618-4601-8aa5-1bcf154fb9e9", "comment": "Malware payload", "value": "a39e40081f69b2c6eece62a98276da4c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252366, "uuid": "befb6780-2253-4888-aca8-1d82dfbada48", "comment": "Malware payload", "value": "3f63d7b295ae8b4370c8f91af3c3c24eb39b4d81c57fcd41e03c619f1227053d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252366, "uuid": "c5291c18-dd11-4a6d-b357-afd0ca6430e1", "comment": "Malware payload", "value": "1e481c4e419f81fbbff4186bc2232727e65647ca", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252366, "uuid": "322d079b-4a48-4e30-8843-cd2016f3b525", "comment": "Malware payload", "value": "292735a3d6c607efc38abf2fd075dfef882820e42bba907b080aa9e81e3fd9edbb78250ebd270d3d35286710e19f237e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252366, "uuid": "d268e965-4f82-40cc-968b-10a174fea3ec", "value": "74F3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252366, "uuid": "3db84d0e-36a6-4bba-b0d1-f6170ec290fe", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252366, "uuid": "d6403a39-2381-4176-8a2c-3a128cae1d80", "value": "3072:l54Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:gDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252366, "uuid": "b3090c0d-5d77-4f17-8837-ac876d253748", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252366, "uuid": "eae8d649-b966-4e00-972b-894f27690a5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252366, "uuid": "2f05433d-84ff-41c0-90e8-a044e997524c", "value": "a39e4008_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "442414fd-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209063, "uuid": "a94ac44e-3903-4992-b296-77069acd7512", "comment": "Malware payload", "value": "fead176904c749f8fe2cbe254146f18d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209063, "uuid": "d4c325cc-ed66-4ab7-b578-9295f2e1d228", "comment": "Malware payload", "value": "3f813a48ffd074124de4fd1e3afdc9ac03da864c4ff65e40ef9d1ed8d2faa5b8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209063, "uuid": "b5807d9c-d164-4341-aa46-bec8e1341b12", "comment": "Malware payload", "value": "4403035cf13d327b3479b71af79801167231724a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209063, "uuid": "1d0dce4b-104d-48af-b491-0869c62523a1", "comment": "Malware payload", "value": "936dac5e491311d4af9634e0a554513e749cae015b649a48c64bb325cb39c0d3f07d082e1e3ecbedbdde4b30467adcdc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209063, "uuid": "d5917267-c1f2-4e5c-9834-5360a82ed8f2", "value": "6985E0517B7F44E3E2C329F2213D85C7997004B66ED5D86E10C68C8EC39E297EE949B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209063, "uuid": "702ca7ab-c2d8-4c70-8b5d-dddbfa5747fb", "value": "b003478c0763a97388dea04e6b77d8e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209063, "uuid": "30cf04b4-39f8-4c12-943b-3a7ac64d3f61", "value": "24576:YUGVzjvJ7Icl6g4Nl+RkcmOJWBXmusFRvVHQujH8sDyPDGadlANyCl5m:YUw/vJMcl54NfufRRHjHDDE3dlayClY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209063, "uuid": "0926e819-3749-4e3e-946d-4d83ecbcbe92", "value": 1723904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209063, "uuid": "bc286c87-7e20-4b47-be0d-9c05188f49e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209063, "uuid": "d723e594-f4c3-4d2a-8a34-1f70db78d305", "value": "fead1769_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f18a0fe6-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208924, "uuid": "4cb14956-c6cf-4cbb-bf8d-71def2f9ad8f", "comment": "Malware payload", "value": "88b31cb469e84a182e41558001e502da", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208924, "uuid": "efdaeca2-e04c-4f9c-b853-37c22a2cfc3a", "comment": "Malware payload", "value": "3fba936cd0c4d507df5e4d3ec140cc452f81defbdc3ce515b94564d517d4aeca", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208924, "uuid": "f1748096-ccfb-4982-81c5-3c19c7734d3a", "comment": "Malware payload", "value": "4bd6ff92df1a32fb3adedf511ca508cefadb09ef", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208924, "uuid": "399fdfa4-a65f-4228-9beb-b22d58b3595e", "comment": "Malware payload", "value": "5d5034ad69ae372a9dca28bc1d1bbd69fd43d22aa5326dc384509ea0bd43436a6d87ce46af57ea0e3098d174cfe7462b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208924, "uuid": "840b6882-5120-460b-b009-8b53007e7a27", "value": "6CD4AC2D8F6D5593FFD34AB61CEFBBAD1608DA130E2706D2DD8B0A2827C4F6215550A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208924, "uuid": "9a3637d2-1413-457f-8ae1-198f58fd6c9f", "value": "6ed2095060aff5088e5917e33913ff97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208924, "uuid": "f633e4f3-159a-41ca-8e37-57d03dfac186", "value": "12288:ymYwrK7dvur10X9hTF8AM3JBU0P8RavGj0Uwf1Tm:wuK7cI9hTHM3bevbwf1Tm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208924, "uuid": "e798a643-f85f-456e-b554-8166c1c40321", "value": 639488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208924, "uuid": "7d61a967-fc55-4ae4-b928-ab945e63de25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208924, "uuid": "35d77ac3-06f5-41dc-a3eb-c428a1a86d34", "value": "88b31cb4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a033244-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209207, "uuid": "1d218bce-4eb0-41fe-a043-cd40a165d344", "comment": "Malware payload", "value": "ccaf89cc25f7398cc1839dab53467b59", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209207, "uuid": "a94e33ec-b84f-4a61-90df-7889fa11ac85", "comment": "Malware payload", "value": "3fc8c1997c844bb42e346002fc089bb7f836a1eff37720da4fdf5939df643ae1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209207, "uuid": "bb9c0582-d4d3-4300-a6bb-c1e7fd67b78a", "comment": "Malware payload", "value": "8d83d07fd3079d1bd602d39547a6e52cf19033f9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209207, "uuid": "d042eb38-a3aa-4d48-8ddd-84722c5976ca", "comment": "Malware payload", "value": "12476bec1937ee9a754e92d3bfd27404007baf491ffe7ba2d485047ea2f569ca4f98f6d576573b8a6741a0c49fda3ca6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209207, "uuid": "40d23bb3-7c15-4237-94a4-7ab15935031d", "value": "B455F1D592B9EAAFC3040E37F2E9551B05598DF5C08F0F07612C06DEFAC7A2F9605A98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209207, "uuid": "124b7de2-9715-47ba-b2dc-a2b3bf2a43a9", "value": "7bb3bca09a531d186778d161aee11d39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209207, "uuid": "06f11726-7983-4da1-aed2-67e7b59ba44e", "value": "24576:Nidk7hzJG1/nOLzUd33ScTjogDjENP7WTKn2WjUn8I+H7EOdIbxnbxEDD7osHJ:NOk7hzA98A5i0ogUFWTKn3jUnFEDdAxS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209207, "uuid": "3d36ae35-8701-436b-9a15-093a9b9e2e2d", "value": 1337344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209207, "uuid": "33d3a8e5-5609-4b20-88ee-fddbeef18fcc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209207, "uuid": "f4ce4226-24d9-4445-9a37-c2cd364366ed", "value": "ccaf89cc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b655f466-ad80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205389, "uuid": "37b924dd-9e86-4854-bee1-1be9d60fe0ad", "comment": "Malware payload", "value": "ef83fc0b79a9a35ea4529f52412d8a6b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205389, "uuid": "bad17169-9326-47b6-9c13-8e4db08feef0", "comment": "Malware payload", "value": "3fd471944c8650c8883d23f0f7bf54d8aef165b0aad140353244b2a43be760f7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205389, "uuid": "186282ef-3865-4fdf-b071-aee74c6c62cc", "comment": "Malware payload", "value": "86205658ce67969050d4838f678644aaeaaafb98", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205389, "uuid": "a1697c47-c1e6-43c6-9be9-cf779cb40737", "comment": "Malware payload", "value": "53d820338c78c90caeecf0122e581607ab4a8d0602dc9044444d62b7b4db818e1779a493ea3dd0e8497945ee3620eab6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205389, "uuid": "4f93ee31-aa5d-4fc0-befb-43c2c495582c", "value": "8EF4BE411830DC7ECB8876762953CCDD6558ACBB13920D20BB2A5FFE0893B19169FFA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205389, "uuid": "6cdb0c88-ad40-4cba-a044-eaed110f90d6", "value": "92e9193ab2888f2130babe956c78ee0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205389, "uuid": "ce43ca1b-fb46-4c71-96a9-874899c2ff0b", "value": "12288:rJ9nOL8yDRu9VGyAA3rgqxHYRO+TO97WgyDtt0ZZ9fLocEX6tBJIBTm:fnJyU9VGyAA7rgO97WrDQ3bDIBTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205389, "uuid": "260cc424-ae23-4708-a232-bf1598e70891", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205389, "uuid": "ff26bdf7-c212-4c7e-97b1-5e4735c5687b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205389, "uuid": "758a3b5b-a740-4f27-9998-9db00db0435d", "value": "ef83fc0b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed45951-ad99-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620216221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216221, "uuid": "7a49f886-f85e-4d6f-af84-87e8e6ccb5ed", "comment": "Malware payload (Dridex)", "value": "3b68019679c29e9be0286a2a8d1d373f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216221, "uuid": "c1823923-0eab-48d2-9ac6-3a5901f5760a", "comment": "Malware payload (Dridex)", "value": "3fda28ea8b974da9b3cd1440cb67549dea97e65d33f28bff6d5d5b7a13e55f69", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216221, "uuid": "225bdd71-ffe1-442e-be8c-2e95beebfc14", "comment": "Malware payload (Dridex)", "value": "e5efb159ac90dafbce6f0636909a7337337bdc0c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216221, "uuid": "6bb3619c-780a-47a3-b372-866033d443df", "comment": "Malware payload (Dridex)", "value": "675c81ccab1e9ed43d1083589b25d778fd53004b4cb0703cd0d79234104bdac0cb0df589a23db1f4cc92395c1e2d2581", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216221, "uuid": "224a2d4a-cf2c-4b5d-a084-cefc1d482d75", "value": "69F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216221, "uuid": "771f9a14-f96e-473c-b7a9-0411baab1e5b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216221, "uuid": "72dd8b1e-1b3c-4e8a-bfd2-6054aae2bdc7", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620216221, "uuid": "797e8af7-687e-48e1-84e8-bb878ece5bbd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620216221, "uuid": "5e5c9581-f6ad-4895-99aa-c531c2c065f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216221, "uuid": "d0d15f3f-c7b3-4192-8513-604d4babb068", "value": "3b680196_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad29836-ad95-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620214308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214308, "uuid": "20b05eac-d8b3-4011-87f6-18d8669ae3ff", "comment": "Malware payload (NanoCore)", "value": "e16d86d9c90ae3369683a013f49a93fb", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214308, "uuid": "8433c5f6-8d1c-4c1e-a59d-769fccd45632", "comment": "Malware payload (NanoCore)", "value": "3fe2d6e555c06a2be1f2f226c28be9c428fa3749a6cc942ff32c1fd438fdf745", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214308, "uuid": "97ee1447-ff1a-4617-a0c2-e9af2bd79e8b", "comment": "Malware payload (NanoCore)", "value": "1fd4b0d9c2d1a36e63e9ea789bed0a4b5008b52a", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214308, "uuid": "d3b355a7-2165-41c1-b653-1f898f5cb379", "comment": "Malware payload (NanoCore)", "value": "539a17dec9ca463f37e1cdbc67f40889a3813e5a032dc03449c3e90bddbac1eaca71b40b37b05763ea6b0d90aa385f68", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214308, "uuid": "9a1dfdf3-6e50-40d9-a44f-3bb54784f971", "value": "7F14BF2637E88A3FD2CE897A612112528778C2E398C3F3DA68D454B75F663E50A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214308, "uuid": "2828819c-e618-45d3-a112-dbf08b05b477", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214308, "uuid": "dcadc5cd-9297-424a-a463-d475916fadb5", "value": "3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIDaIpciQB2u9Pco9NbHsRUSmx/:gLV6Bta6dtJmakIM5rIWIto9ll7dV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620214308, "uuid": "e1fbbf4f-a7af-4f51-a9fd-44e5cabe17fd", "value": 207364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620214308, "uuid": "f0e04764-2faf-4916-a285-4da90464b4ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214308, "uuid": "ba912902-60fa-40ea-9747-258e0dd8ade8", "value": "WYpfZXf96u0qzm6Uqy0S.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d08153-ad79-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620202104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202104, "uuid": "9dbafb02-f107-45ab-928c-9e11c362161d", "comment": "Malware payload", "value": "ab7ea30a58b4d1ec4d51283e1ef81c29", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202104, "uuid": "6488f9a1-1313-4c54-b359-26b926cd5aba", "comment": "Malware payload", "value": "401c34dc79b42ce3fdbb1737766daa366b2f0bbd405ff55487dd85b7c91147e1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202104, "uuid": "0d9b09c1-b666-4e57-b9da-3eb1f72e633f", "comment": "Malware payload", "value": "48d67c40677c21b3b9d69bb0236745ce7b25ba62", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202104, "uuid": "cda5944e-03e3-49e5-94fe-9388fc5331fe", "comment": "Malware payload", "value": "93d2cbca21eb5d405a1b3a79ae255b0002722b46fe51a6ddb9ab692d3aff96ded39d9fe5e2f94f488ea07690c203efac", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202104, "uuid": "e7fb740d-602c-4dd2-acd3-e668dd607490", "value": "2DB4E05735E1A0C6EAAE11FE6FDB0C44DDCAE9EB493DDB9129F67360DA00A0635342C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202104, "uuid": "c784ae7b-73f3-404f-b439-965d3bf53f76", "value": "b291109b3cc0cdcfb5650753e89b7201", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202104, "uuid": "b1a78de6-1cc7-4df2-9200-13281ffe88dd", "value": "12288:quyev2lReGeTwA+jdGAF3F3LrR4zFTNTt8sabXn:RwReGLF1PRAFhTt/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620202104, "uuid": "9014a280-e74e-4927-86fc-c8305f78838e", "value": 511488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620202104, "uuid": "7aa3b245-4cb7-4725-8400-2eb32c2b0c0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202104, "uuid": "6286282a-59d5-4258-8f15-e660915de272", "value": "ab7ea30a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae202313-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252620, "uuid": "732f3652-fe8e-46f8-aac5-1216a2cea2e2", "comment": "Malware payload", "value": "3b460a87251a91e10d7fa834b9e050c7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252620, "uuid": "a51e0b97-645c-4ada-907b-097df7779c3d", "comment": "Malware payload", "value": "40425542abe4fe6fe4c8fd55571bdb0b1d60cc2b2cd859bcb51a1ebfc5e76e3f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252620, "uuid": "e72bd6ff-5b34-4fc9-b254-3c6ee1493d2a", "comment": "Malware payload", "value": "9c0fde15c30624f56ebb69aedd3c9022483d4456", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252620, "uuid": "ee8f38b8-aab1-4f4e-9507-1e4e4f463eb7", "comment": "Malware payload", "value": "1736111369382b954fc4a5a7ea88a10735f643de16935a2cecb0705ba8f35fba71f4cb09bab1117f9fac35ddc5383929", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252620, "uuid": "e0bb3d1c-9dd5-4221-9e59-b64b7e064e11", "value": "81F3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252620, "uuid": "c719c20c-c94a-4f41-bd41-33672473c1dd", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252620, "uuid": "84caecae-b3de-4ad8-a8cb-5f831a42c473", "value": "3072:dW4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:TDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252620, "uuid": "3cb620f4-3e3c-4c2d-b7bf-9d0a949a89cb", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252620, "uuid": "840ed261-e6a8-4081-bbcc-261880c13b9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252620, "uuid": "7caef892-206a-41f5-a51f-c87981755086", "value": "3b460a87_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06653ed7-ad57-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1620187484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620187484, "uuid": "2d1e7bae-387e-4a7b-9b4e-8e6cd34cc8c9", "comment": "Malware payload (njrat)", "value": "e88c44570dc8a8e0546b1c878c3b31a4", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620187484, "uuid": "3838033b-5eb3-40b5-9650-9309bdc9ea1d", "comment": "Malware payload (njrat)", "value": "40439c197dbca26b851e506ca7cdd3dbb5c2ab9dba9530e839b68c2aa83362dd", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620187484, "uuid": "aa20b968-2cfb-4696-b738-da599decbe8d", "comment": "Malware payload (njrat)", "value": "be7815ce8a88b19cf9624a2433ac166f0c9cca6e", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620187484, "uuid": "dcf4a25a-68ac-4328-8f7f-2ac99227f83c", "comment": "Malware payload (njrat)", "value": "1873de16f97b6d3a472e06cdd77d62cfd42a439f56461d64db4843e81ef1c865431a0272aacffd5464e8cc70ef091d90", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620187484, "uuid": "a533b3c8-bec9-4059-b1be-7ea04deb7eeb", "value": "0B242CCD326BD8DBCA6505F43D13C27D87339C7AD146A65A28B2B72EE2B117723604D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620187484, "uuid": "292e34b5-217e-4c3b-b7d8-05026466ea8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620187484, "uuid": "4ce80f9b-046c-4ebe-ba34-794d41cc3c7c", "value": "3072:OG8K/xr+VBFaIqYIYiheeeeeeeeefYDeOWClppeppOpplppepppDppptpppjpppu:OSZrMBglSOvdiOsRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620187484, "uuid": "b4876b57-c785-4f49-ad17-a0f523feabd3", "value": 217600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620187484, "uuid": "bdcf8f00-12a0-4f7c-81ba-c287f05e63d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620187484, "uuid": "52e83ed0-1371-4515-9a19-d3571b87fea7", "value": "SecuriteInfo.com.BackDoor.BladabindiNET.10.31887.18690", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d7a806f-adbb-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620230607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230607, "uuid": "e3a5a7c7-3824-4c9b-93fc-609e8bedecdb", "comment": "Malware payload (AgentTesla)", "value": "b44c460bf94c90fd4e249210d6a33de6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230607, "uuid": "8e5ca01e-ab65-4d2d-aeeb-cdc03246f50a", "comment": "Malware payload (AgentTesla)", "value": "40544ec4e1b5b8ec2c78ef66bd65b5089646087f0f77b5c803e478f0765e4b8f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230607, "uuid": "688a1be8-4609-4866-9863-eac91b95eee2", "comment": "Malware payload (AgentTesla)", "value": "e84b6d6bff21613eec6dfbdb945f50af00923285", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230607, "uuid": "26272eec-32dc-49cd-a4ba-bab07302c08a", "comment": "Malware payload (AgentTesla)", "value": "1516e55898f686dc886e41c11555e556ad59676839b3464a957b2cf7ede6ddfba5c5e1741119d9f49aaebf58aeff7b71", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230607, "uuid": "fc5f56d1-a601-49bd-b9ad-4b57a97cdba3", "value": "D343E01EE1B2BCA5C4F6B8FDC304D8EA478D289CE10CAE1770C4BC0E9D953A6725D199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230607, "uuid": "c732c3b2-de3c-420a-ba81-70becabaa7c3", "value": "1536:x/IOOulNOOOIDEyoCKjQqZ9yb3UXIngz1:xWZA7UAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620230607, "uuid": "20b10dec-9a30-41f0-88f6-ffe48d39cbef", "value": 56162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620230607, "uuid": "e6b56ae8-f869-4130-b37d-b71300c9ed07", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230607, "uuid": "0aaac11d-8c62-433f-af44-39072db0e8bd", "value": "b44c460b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d7af78-adc4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234354, "uuid": "038dc758-659c-4c51-b2ce-f04124b7506c", "comment": "Malware payload (Dridex)", "value": "30ada90f27f065eea3fb86eab8fc24b8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234354, "uuid": "d8341ed4-676c-4a7c-9e16-b459ca58c87a", "comment": "Malware payload (Dridex)", "value": "40798d55e9019dda4e1222035df7c5d41f943cf0588d2d35c2797f158b02d604", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234354, "uuid": "91db3a41-98e4-4f83-a58a-e99792e45338", "comment": "Malware payload (Dridex)", "value": "87791dddb9cc5a1811e35c644bc6f7a64a09a08c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234354, "uuid": "fa796511-119a-46e9-9b46-6f4438bb01c5", "comment": "Malware payload (Dridex)", "value": "0a93fd6cfb662b1b94fab79d47b0d33076878bcb2a7be57e9e38b6d52e2368ab5e9467db4c3a1f0c962d861e0ceb4b62", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234354, "uuid": "98ddea5b-08c6-4eaf-97a2-f1b1195743b4", "value": "57F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234354, "uuid": "f0c4e2ca-0023-4efb-ba7f-3f30baca5410", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234354, "uuid": "aa91a0f2-7556-45a7-87ec-ae0ac02354c9", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234354, "uuid": "c93f11e3-5219-4476-b05e-460a4bc799a4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234354, "uuid": "7dc26fc1-ec21-40c5-94fb-1a02aa8969b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234354, "uuid": "3bb26ecc-5bbc-4fd9-ae93-29f107668b51", "value": "30ada90f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03eb6dbf-adc4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234295, "uuid": "a1c27899-c159-4e9b-aaff-1433d13b4373", "comment": "Malware payload (Dridex)", "value": "12eb597cc3c1486bb6f56ea7551e7289", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234295, "uuid": "ef4ad90e-468d-4649-aadb-e48a47f7e2d3", "comment": "Malware payload (Dridex)", "value": "4086a92ba6cbce01c1f9d12ad2717c9ae2d0fbce39b3621f678dc584f3991043", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234295, "uuid": "d60249b1-60ac-4333-965f-b4a6168e400c", "comment": "Malware payload (Dridex)", "value": "d9e74f0fc3a623a48219c59a8648d5850ac8c305", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234295, "uuid": "9928189b-b43f-4f1b-8e4e-ec5f38c01443", "comment": "Malware payload (Dridex)", "value": "4b08d7c9271dfd5f2a2738cf40effa1faf07a690c8d4a19ad0104732e1435f3bbf8c4d214b27f8d0092458c8f144ca1e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234295, "uuid": "5dd53cf6-0707-42c0-98f3-d09ebbd2536f", "value": "69F3C085DBABE8BFC45A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234295, "uuid": "12dc6d7f-8ceb-4f19-8c7a-6100bd0df70b", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234295, "uuid": "7949ecf3-47e2-46a9-8162-ae5db5868216", "value": "3072:sE45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:X4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234295, "uuid": "ca30ffe9-adca-4d3a-aa71-127ff1516330", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234295, "uuid": "be909119-b9e8-4d21-9604-580fd01f4d5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234295, "uuid": "b41f0b01-ac24-4ae2-9cd6-4de6148e0e82", "value": "12eb597c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e5a1f7-ad80-11eb-abe1-42010a9c0039", "comment": "Malware payload (Downloader.Upatre)", "timestamp": 1620205475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205475, "uuid": "2a1b2516-f172-4d71-a472-1b8bd1e2c9d1", "comment": "Malware payload (Downloader.Upatre)", "value": "f1afca68480c1ec32e53cad92ed8cf93", "object_relation": "md5", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205475, "uuid": "ffc648da-eeb3-4e88-9fe0-adad1d98ca53", "comment": "Malware payload (Downloader.Upatre)", "value": "40a783fe4eaa66f822ba12d9455915d6812555da38674e4d8ce34f269ba94d71", "object_relation": "sha256", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205475, "uuid": "ed7db122-1da8-4507-977c-45df7221ab6c", "comment": "Malware payload (Downloader.Upatre)", "value": "f6de2d37a311bf6f7e7d4eb89a834130ae5bee10", "object_relation": "sha1", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205475, "uuid": "57900b9b-7234-4c24-af5c-d1f6ea926bcc", "comment": "Malware payload (Downloader.Upatre)", "value": "deaf97fa8007a17640ea0c4561c6b6a32c143d73f840040d24a1ddf8bce80138179e39989c548e773c3b51392474e5a9", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205475, "uuid": "574c03b0-8230-4d19-a855-ea8477752a0a", "value": "6AE271387AD05572C277CA7199F39ACFB9347722790A9B2E66C61B000C23B17AC6D70D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205475, "uuid": "b9386907-142d-4671-bcbf-efb5cd2566ae", "value": "677e4cf676403d2b76c5adbd88df5afd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205475, "uuid": "a6b07450-042a-4dd3-b599-c20fe9830e4a", "value": "384:rHh50gmTTKeyMCQhgbImrgaMXAuRmH0gBKkOTiGEU7kdsbWtaX8sBJy1jl87N+gM:rHhTnQh4drgXy71OTi+W+o1SIprEj5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205475, "uuid": "86ac2e0e-520c-4093-bbba-a083b8d6e14f", "value": 33532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205475, "uuid": "269ed1a6-1be5-4f8e-9422-e76c332882e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205475, "uuid": "e72eb279-505d-456b-8ca9-846a968192c3", "value": "f1afca68_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fd2f513-adc4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234342, "uuid": "f4faf2ee-4392-410f-af97-19aa1878609f", "comment": "Malware payload (Dridex)", "value": "1f673e1de58d2262c0619e5db9656d0d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234342, "uuid": "b11a6786-49fd-416f-8a57-fbf6e41fb7b3", "comment": "Malware payload (Dridex)", "value": "40d37e37f0bf2396d24a4aa091b20b121f12fc852a518ad4eadc4017ee7997b0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234342, "uuid": "bf22efbf-0ce2-43c0-bd7f-40753cd2435b", "comment": "Malware payload (Dridex)", "value": "3450d99949d998017f7c1966172e633d7b4ef23a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234342, "uuid": "81f57773-ae9c-40c0-b4e9-12c861aa4640", "comment": "Malware payload (Dridex)", "value": "2510588d80298ad6e000f892e71005ec9376868db37beeb7a4fced5e9f9660ab09a097b4afd8f76846c129d854779c1e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234342, "uuid": "c287e892-4352-4e77-989b-fad4da6d8043", "value": "D1F3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234342, "uuid": "9aca76b8-3ad8-44a7-9c61-b9f8e858de7d", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234342, "uuid": "a0d649d7-7ab5-41c1-b091-2872322618df", "value": "3072:Pi45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:a4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234342, "uuid": "ddc32216-da27-4bca-a6f2-b4deee3078a5", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234342, "uuid": "0b40469f-435e-4d14-9a20-318ef125e8fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234342, "uuid": "e3d4749b-3adb-4284-ba90-1d17efe21440", "value": "1f673e1d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d796098-adad-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620224594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224594, "uuid": "f1d5c2ec-3c69-4904-bf14-747ba5ed2e49", "comment": "Malware payload (SnakeKeylogger)", "value": "569485b108d758cdf8ffb3084a235cc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224594, "uuid": "fc1cf01f-c7ee-4b4d-b986-0c17770ac6df", "comment": "Malware payload (SnakeKeylogger)", "value": "41079970ba3cbe794795657e8ceecc2ad76e58d9fafa18ec993e3a30e5d03dd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224594, "uuid": "38751a05-fd08-4706-8851-9b8243fd0d82", "comment": "Malware payload (SnakeKeylogger)", "value": "de02c0131c4ff5d2b7940997f40f47e06e4dedab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224594, "uuid": "d457615c-356e-493d-b179-9997ac8a97b5", "comment": "Malware payload (SnakeKeylogger)", "value": "7a820225d85c4316706e0e261404d0e37b474319e04eeaefa0d7b03dbc23b00ef9787e6acd6bf17324821d41df6ec29d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224594, "uuid": "72eaefb3-7521-4968-9a1d-dbd8ac8dfd3e", "value": "6AF4127D23D88956D57E1B3C2678C0402BF4B63AD633F70E6FD021BB1A667918630B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224594, "uuid": "b92b46a2-896e-4e45-8eeb-9a474dbe8188", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224594, "uuid": "03a5ccb6-75e0-4e08-8611-accef6d3eaac", "value": "12288:amtkfy3jfiM0rf+U4ve7BrTWB2eGJUDd2f51hJIbLn0QftTUxe/9n9EenCM:b6MRlv6DeGadMqBtgxep9EkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620224594, "uuid": "b1f0db97-87e2-4acb-88a5-7c74cc0ed446", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620224594, "uuid": "9cdaab80-9cc5-428f-b6e4-bc6e6c4bdc42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224594, "uuid": "eda3e0cd-3a84-4e6e-868c-afa09518cf6f", "value": "Orden de compra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fae5ae9-ade9-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620250260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620250260, "uuid": "e3044fde-6b0d-43f8-ad61-980ab8a1fe76", "comment": "Malware payload (NanoCore)", "value": "23ac98e6182d3cd14904ad366ff902a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620250260, "uuid": "7a2120a6-f9c1-4488-b65f-fc310892a90f", "comment": "Malware payload (NanoCore)", "value": "411629ac75ca15afac6e306ce2864f46117cbc5f5dd0187d3809cfa4b2d85289", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620250260, "uuid": "544d769c-31f6-4c25-8233-8bac0f2a0a6a", "comment": "Malware payload (NanoCore)", "value": "40cfa8297b76540b6d244196f516c1dd624d26ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620250260, "uuid": "787bc0ea-ae7e-4cfb-b0c3-712d39bfcdd8", "comment": "Malware payload (NanoCore)", "value": "3028e476b5fe7a51613ed1079d23507719354b557d890b761be73e408e66f81417e04de8c529676f4806d0e68f953c02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620250260, "uuid": "364dea93-03a1-4d61-b99d-09d7f955802d", "value": "8614CF1A77B84A2FE2CE8679611202539379C2E3A9D3F3DF68D454B74B267E406071E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620250260, "uuid": "fcd04a8a-8f0a-4839-9fb9-8abfd67d1bbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620250260, "uuid": "c95b39d5-9044-4205-bd8a-ac23513d678a", "value": "3072:UzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIBrj1LFAzSQHa46NgfWDB1Z+XW:ULV6Bta6dtJmakIM56VQ65NgfWDTYXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620250260, "uuid": "86a78e68-34a5-4789-a469-fc95cc869209", "value": 208384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620250260, "uuid": "fc06f106-1503-4dbd-ae49-4f8fbc1398fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620250260, "uuid": "e1148398-5694-469d-8aae-6c6dddd386cd", "value": "23AC98E6182D3CD14904AD366FF902A3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da09fa8e-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241956, "uuid": "cbefe2c5-cfbd-484e-93d2-f312188b1352", "comment": "Malware payload", "value": "de6c115f8f231a72f847b7802243c64d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241956, "uuid": "244ac7d9-b6cb-4d22-b787-d819a385e0a7", "comment": "Malware payload", "value": "4117ff81bbfc2272a05353ee406c19763472833d32ed36d20b59c1fda1ef7269", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241956, "uuid": "3cc81a1a-aefb-44f1-897a-35414f0d04d1", "comment": "Malware payload", "value": "b2f44a82c80be35f4e7bbe3058658f1d68ed7c25", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241956, "uuid": "40b1c736-e09f-4e17-a4e7-c2974a266532", "comment": "Malware payload", "value": "337a7fbfde450979f03af1aa3a4e86ced941dd34597d936a0ef364b8f075dfe51e0e9f28da65b662f3c9f6e0e03368d4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241956, "uuid": "43834450-2696-40d1-996e-d02bb62af311", "value": "56F3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241956, "uuid": "27567b61-3cd2-44f7-aa3d-0edb81039d51", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241956, "uuid": "8b979e9b-3634-4482-89a9-a0e243f37661", "value": "3072:ai45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:j4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241956, "uuid": "8dd918a5-6aa8-4187-8050-50b7e0bb626e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241956, "uuid": "4c1f8423-d404-4289-8470-97a4af82ed2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241956, "uuid": "5004cc8c-915f-49f5-a6e3-ce44c4632b12", "value": "de6c115f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78fa8dd8-add4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241363, "uuid": "bd20dae1-9cbd-408d-ae7f-0cefabeb7f17", "comment": "Malware payload", "value": "bd198ba6a44ce698c2e8c8efb05b13ef", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241363, "uuid": "dd76fe23-f2c5-4922-888e-9da2bd312482", "comment": "Malware payload", "value": "41471cf3d54ac0f7da4e572a8f3f1e0cee98d71e848f09b96169de53578d5f33", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241363, "uuid": "8bb4a434-36eb-4799-a3ec-628930db34a5", "comment": "Malware payload", "value": "9d88649e4ff49175922b739473ba90b83fe0e6ec", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241363, "uuid": "4958621b-a297-4a36-8427-3f2bfb6bfc56", "comment": "Malware payload", "value": "875535b772bea7c3aa640292a24edff62e31000c72461ab8db8be78610fef903fdec0148f3113de402ab4f87ca41b26e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241363, "uuid": "6938752b-36e6-4374-a931-57b10182ee26", "value": "A4F3C085DBABE8BFC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241363, "uuid": "63e414cc-4a8f-481c-ac9b-895b48d3055a", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241363, "uuid": "1d103f88-162c-44a8-a60f-e209e7b080d7", "value": "3072:jF45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:Z4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241363, "uuid": "8f90c0d1-99f8-4127-980c-1e07fe446eee", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241363, "uuid": "4e43cf3d-51e1-4242-8b3c-5ae1ec509368", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241363, "uuid": "3db6a6aa-e929-45c5-aaab-d83f7549f204", "value": "bd198ba6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c578dce-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620212512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212512, "uuid": "ed911058-610a-46d8-aebc-4c2c72a72b12", "comment": "Malware payload (AgentTesla)", "value": "697ab9f3b642042e968e55c99e8179ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212512, "uuid": "1973cc06-dcd1-4b0e-9233-6a29a885c9e9", "comment": "Malware payload (AgentTesla)", "value": "416d4d6c1ef534fa4888859d89296821f8bb7d31f3cc4861511b8400088c5eb2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212512, "uuid": "07ddf2e5-dda0-4650-84df-21dd81889b41", "comment": "Malware payload (AgentTesla)", "value": "a3f53f2459e7d085c217345e5ef454f88487b63f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212512, "uuid": "05510fb4-3b7f-4926-bae6-4bcbf08135c2", "comment": "Malware payload (AgentTesla)", "value": "e4ca87aa83a09b508e874b84420f62f53a45f9c66d0563b56036425f15dd8fc74788aa9523adceca164394dfb448e15d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212512, "uuid": "ee4a3ac3-60a4-4813-b822-d69571bae66f", "value": "F6C4F12293E89F26F1BE77B96571100057F1B52AE733E35E3E99019C0EB67808663772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212512, "uuid": "38bb5182-ca8f-4360-97c8-e8fc205c7654", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212512, "uuid": "7daf9174-11af-4831-9345-dc10efebd7dc", "value": "12288:SWx+8Ht6mQg3zqYBQ5hYdmSQ2ARhT2djA53a6CwNdYhLKY:XJt6mdqYBshYoTRBwjCqSdEeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212512, "uuid": "fc5130d5-4e87-4b5d-acb8-7b6673cc2903", "value": 572416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212512, "uuid": "6c7e3631-ed96-4019-b694-fb5c3c3101bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212512, "uuid": "f5400e69-f6c1-432b-9260-bb09132fe2d4", "value": "09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2680302-ada8-11eb-abe1-42010a9c0039", "comment": "Malware payload (OskiStealer)", "timestamp": 1620222669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620222669, "uuid": "4fd82bf8-a677-43b9-a6f2-8cf8b996447a", "comment": "Malware payload (OskiStealer)", "value": "36b4c1f86cd7fc31c9b1a9b9baefc560", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620222669, "uuid": "baff660b-e202-4c5e-a99a-2cf138b41c93", "comment": "Malware payload (OskiStealer)", "value": "418496c57c3534bc0a50b416caf093937d6d14850765d3795da4f93a3f81dc21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620222669, "uuid": "0a2ad085-120f-41dd-a2ba-a9b4f60c46e0", "comment": "Malware payload (OskiStealer)", "value": "099e570c8e2d498758be4df54760384d226a26e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620222669, "uuid": "9c6a8d3b-1186-4443-b8de-3588aeb1f186", "comment": "Malware payload (OskiStealer)", "value": "32fca6800881788ed86029d0662e33caae27bd6ec8d7a568afdac060f2bca4d75e98145d911e931105ebc54be442d72f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620222669, "uuid": "b2b17907-bf00-4568-966b-eda21c7dc8f0", "value": "5515F1789ADECC9EC436163C2430C5100AF2EF5B4643F789BA987D3BDE35B02A65553A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620222669, "uuid": "b059911d-7698-42f1-ba88-d8ed67cf8299", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620222669, "uuid": "c94637d5-c000-4d7a-9258-5c724b5d30b9", "value": "24576:0NTKi6K5sVmW8k+7ixM2ehXS5k2mbHBOlM:o6Tl+7ixM24XBhOlM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620222669, "uuid": "f7c1bcbf-c974-4c88-8f27-3a21432dcb35", "value": 932352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620222669, "uuid": "d8700b33-6960-403f-bdb3-6b4cf5a0888e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620222669, "uuid": "09ceb84d-c239-4ae8-a23e-bf0bcf07a9b6", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebebc81e-addd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Stop)", "timestamp": 1620245422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620245422, "uuid": "dcaa0428-b050-4aae-8c65-f020a39be85b", "comment": "Malware payload (Stop)", "value": "d261cebed0f29c2e90222dc7e949ee09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620245422, "uuid": "864ecb85-8519-47b7-9a6e-850cbc98aa0f", "comment": "Malware payload (Stop)", "value": "4191eab7dce6ae84489c20d6ac93d123e42bf0019060847cf76e7be00139eb1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620245422, "uuid": "d940878a-6bdb-41b6-9860-c048f3c461e2", "comment": "Malware payload (Stop)", "value": "81a645c5703137419abc6d163649d5911d7347af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620245422, "uuid": "2482ff40-d38f-4553-a1ca-86b954511972", "comment": "Malware payload (Stop)", "value": "55bb820d1b25a347ccf4972de7853b58230ba1a95874ac098799fa3f3cca3f66ea743d3326a17c58692f4cf89c468fea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620245422, "uuid": "743e633e-2fe8-43a3-acb3-1dec34aff7ef", "value": "00050120AB60C038F5F711FC48BB867C653DBEA15B2490CB62D529EE9E306E5BD30657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620245422, "uuid": "69ebdf1c-93e8-4916-a802-4a400c20364c", "value": "927da9753e83c2ae1d1bb0527fca142c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620245422, "uuid": "978cc6ad-c435-413a-b292-33b7c7258b6b", "value": "24576:a2yEY7rP6OHoPb4RZwoYGe4sYoBl3AO3k/uCaPf:i3v+b4WYywOGDaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620245422, "uuid": "8d4f8c6a-9384-4804-9d3d-f7743295dede", "value": 862720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620245422, "uuid": "c4412cd3-ec54-47a8-a770-3eb4a02b18ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620245422, "uuid": "1e799337-c6f0-4f76-917d-990916f4441e", "value": "d261cebed0f29c2e90222dc7e949ee09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e8c7929-ad92-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212892, "uuid": "1bc48d3d-2201-4ace-a627-089d05874c2b", "comment": "Malware payload", "value": "49e07fb6f30bccc797c84b4fe7456037", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212892, "uuid": "6dc68a7a-79a6-41a9-a27d-d057788ad405", "comment": "Malware payload", "value": "4192c32e50a0c1c567863b0b26e5f9e7357c35b23bf0d0bcb3f6115e408f8c55", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212892, "uuid": "c08638df-de37-48fb-8a0e-718b602946b1", "comment": "Malware payload", "value": "d30ca1913cfb2d6c8ae93c37fcf58e96a964334e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212892, "uuid": "92bdad08-e5e2-4195-aa57-ef58ac8ae6be", "comment": "Malware payload", "value": "0ef7da72a84aef56e4211666e5ca9546ecfe6db2feb6776fdf411789c21c60043df52721228d5eed37d59d9a12bfaa0b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212892, "uuid": "0f86431b-4cb7-4162-86b0-ff9b1e8124f0", "value": "7BD4F1BB8CF1ABEDDEC02D399A943E80CD5F201DE5943E074895D67A33A0EE5942DD18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212892, "uuid": "32b8fc8e-9133-455b-a28b-492d2d94fe9a", "value": "c9d460da81e3fd0ebc5b1022ec87ace9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212892, "uuid": "5697f216-caf1-4b46-95c4-af2072422b33", "value": "12288:uBoJ833pTsM9ftnZi8B4KJhdmP+7yI3klqaAG1+NRR5BYxuNDaMG8cYejzAcuOfx:sou3FsMzZ76KJXGxqWArR5BYx8XdUAcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212892, "uuid": "554c89b2-eb45-4229-98eb-03ea37b08755", "value": 625152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212892, "uuid": "7e652119-c325-4c5d-a232-7ffb014b0315", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212892, "uuid": "baeae589-2def-4f78-aab8-5d6a3926354a", "value": "49e07fb6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bdcd129-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252133, "uuid": "a59981c0-7d1b-497f-a674-2657b7519854", "comment": "Malware payload", "value": "c88d35949162b88018c7cc918e483c9a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252133, "uuid": "77e48c33-e321-406e-907c-fe3992cffd7f", "comment": "Malware payload", "value": "41aceca0bb988c74c9320155126761b98d50c6e556a684070c8e3f3822464229", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252133, "uuid": "898c54d9-c9db-433d-b8ae-f6db7cc7cbcd", "comment": "Malware payload", "value": "4a8487bcb011498c171fe995e89ed3f9a557c48c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252133, "uuid": "499448e2-678c-4783-894c-2553151d2c77", "comment": "Malware payload", "value": "7bf18b25f63985be4bfe31704ad47d4408b8bcf9ea85e7c95b7ff150c8a8c531a1ea0a345e4b14500fe6c7bd1a4ef351", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252133, "uuid": "6680e3be-9de5-4e4f-8596-6ad042c2e304", "value": "F5F3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252133, "uuid": "eaeef852-29b5-4414-8cc1-f785be20ea33", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252133, "uuid": "1fe89054-b518-45ae-be93-604857c0568b", "value": "3072:3f4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:gDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252133, "uuid": "a0d26a79-f597-427b-b90b-8a067a1e5b59", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252133, "uuid": "c35f4127-0d17-443b-b087-615bbac163aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252133, "uuid": "8a66ab2b-4aa6-4d6b-b7ea-10313ff38f96", "value": "c88d3594_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f29dd0b-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201726, "uuid": "70f18215-6f30-446e-b54e-2b65c7e0272c", "comment": "Malware payload", "value": "2c811e8121cccc72818fe8da1363abc9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201726, "uuid": "86b14663-0f15-482f-8c67-982e0c810d47", "comment": "Malware payload", "value": "41e20476662e14ce7e2df3f3755fcbe3cc7c31b7f8a08654eb56333b32272098", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201726, "uuid": "3107bf9d-b291-43cf-afa0-94ea5192addb", "comment": "Malware payload", "value": "98a01671bc8edf6e0949d41b46d7eb3b947a5dff", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201726, "uuid": "742dc9f3-0254-47be-aad4-d9900722c4e8", "comment": "Malware payload", "value": "3c16de067508cc28823029aca6e6d415b90d866db28295c116cf41e3e1aa6de7eb423d2a9e5dc9e00bc86c81ec9b331b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201726, "uuid": "9e936c39-7d22-484d-af9b-fb27823bd0c4", "value": "74F4C0D8F00AF3BEEADF053069C8FECC01296659166E5B4DC1988797231B7C81ED64E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201726, "uuid": "eb1f3ccf-fae8-44f8-bb59-3b39ea219121", "value": "b154d36bd83b4fd4905c6ae9d011a5c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201726, "uuid": "a5b61e99-8e6f-41f1-85c3-b051aea150a8", "value": "12288://DBZsbRUUeOR07afe7WRUyr1iI6OVx1h6+67ivJnR/FTQ2ls9XaQTm:/7j/t7afl9r156GhA2JYXTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201726, "uuid": "5edbe33b-f7f9-4799-ac16-2158f3eb6610", "value": 763392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201726, "uuid": "86884404-b9a9-4ac6-9e43-6a41f04c7945", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201726, "uuid": "4a9a0a0f-4d4d-485b-8586-53c114380f9b", "value": "2c811e81_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2159e355-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252383, "uuid": "5c0b3498-5e27-4bb1-a0fa-cdf20456f884", "comment": "Malware payload", "value": "0a3c2780655edb2d2d980e7acc633595", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252383, "uuid": "f87958e5-915b-4075-bca9-6a417ebd63ed", "comment": "Malware payload", "value": "420f5577512d79ae6a73b07fea57916c94d63a71c20f1c3f1118624f5a243375", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252383, "uuid": "c7fbe3c0-523a-4da2-abf1-74e23079d70c", "comment": "Malware payload", "value": "11783b3f36bacae9124fbc1791b897ddf2806398", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252383, "uuid": "adef5e24-e723-43e7-afe7-4b05b202cc56", "comment": "Malware payload", "value": "96856ed04b5fa615ffe565f19780e8bff6d546546fdd191c986e0de8211553abab18f7c3262f61a4e42d8e2dc16e124c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252383, "uuid": "331f96bf-83b8-4a0f-b490-c8f5ec180d11", "value": "21F3CFE89A9FC097E663583055FF3BB6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252383, "uuid": "dcc3f507-c67f-463f-b862-87c160d40923", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252383, "uuid": "754a27b1-19e3-4987-9148-5995436c6768", "value": "3072:qc4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:aDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252383, "uuid": "d027cb75-f61b-47a4-b310-b476d62a7b09", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252383, "uuid": "dbedd126-f6b7-4b0d-9e0a-840904b13125", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252383, "uuid": "7ba5d697-e1cf-4a8a-802d-a6f45823f495", "value": "0a3c2780_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6338e4a-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212717, "uuid": "b08cd189-b3db-43db-8107-a22200530a31", "comment": "Malware payload", "value": "2860b2f817c2d85b4132eaec0cd7f96a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212717, "uuid": "8bc6b941-417e-4c46-973a-aa0305587d3c", "comment": "Malware payload", "value": "421725a0224c03a8495ca0932380440379b230b6e51b0df220650a0f54c3642e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212717, "uuid": "2017d857-37c8-4b70-960c-b0566222f094", "comment": "Malware payload", "value": "c48af1d26d86659f8d3f8c3909370f13ccb6ae11", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212717, "uuid": "9b74bca6-e384-484b-9dfe-30d3d8ef41a8", "comment": "Malware payload", "value": "de609747573805d7bdd478b999c6bc931c638f5b3323123b8102818630354fb88ddf64a6a17b5ad9602a5a8284f3c95a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212717, "uuid": "83ca6996-227b-4aca-8ea8-82e8ec02ec9f", "value": "C5D4CF5BA3977191C1D72CF5C74E33B2C0E13AE64BC36869FB8689E35850A7B095A307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212717, "uuid": "afeb11f2-10b6-4fa8-b26d-004b9960e75f", "value": "5faf6481a4e0420a12348aa00cd83cd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212717, "uuid": "936969a1-7a0f-4783-8d49-ea29334b22ab", "value": "12288:1GTQNsscgSBbVwMaHn/XfO+d7C0RSXo2IUvB+XvJrVjF1VTm:1GTQNssc1NH+/X1+gS4aQXvJrVR1VTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212717, "uuid": "bf40300a-53c7-429a-9dc0-931cc97d3c2c", "value": 640512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212717, "uuid": "d8a050c1-b504-439f-9836-c7f1241f9582", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212717, "uuid": "a3685cb4-0400-4cd8-ac40-38160387d868", "value": "2860b2f8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384677a7-ad8f-11eb-abe1-42010a9c0039", "comment": "Malware payload (BazaLoader)", "timestamp": 1620211620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620211620, "uuid": "0b0bfd27-c321-4f14-916c-f956087540df", "comment": "Malware payload (BazaLoader)", "value": "5f36a28c2dcba68802994d1b4873e41e", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620211620, "uuid": "c0ff2bc6-8bce-4a1c-92bf-38c45c5fe71a", "comment": "Malware payload (BazaLoader)", "value": "42465a486e5d04b9bc0c8ae10c03c6145cf77f7afabd1b2871af7184e29f27a6", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620211620, "uuid": "9d93eefa-8ca4-4b66-b28e-3e8611487049", "comment": "Malware payload (BazaLoader)", "value": "84ce20644fb36b7059d58125da8c900dbf73ba21", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620211620, "uuid": "b5e63e7b-159d-487b-a7c3-62fc850909f4", "comment": "Malware payload (BazaLoader)", "value": "c03b128acafd97087f6db31008bcb60fe38633676c7b27af0876cb524c2c4e8fc83ad765361b328dc9fc020cc02b705b", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620211620, "uuid": "84e90fa3-2be9-47d4-83ec-af5eeb19e5c8", "value": "39749D42F2C210F4D03FD9348BB79227F9263D1759B9EE1E12518A926F35FA0A369F05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620211620, "uuid": "956e0453-d80c-4e27-b5b6-76fa817f18de", "value": "d112f631d7a1e466d324373afaa20ca9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620211620, "uuid": "e4979744-e148-46b4-aa20-c4c875f8e76a", "value": "6144:R1hIDkgn4kt+ZoMaKebJIuuQOgLuaRbHPAJQ9v7nV6tAbtAC9iksF:RL384kt+OMCduQbaaRLAWFYY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620211620, "uuid": "a656ab99-38c7-47dd-ab3e-b3912287412e", "value": 366592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620211620, "uuid": "99635d14-3ef3-4711-a2ef-692a97b015a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620211620, "uuid": "799e21aa-1a9f-4b6a-b5cd-c238f2f92d4b", "value": "cheryasd[1].dll.11.dr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665470eb-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209120, "uuid": "572a16b4-cf8f-4140-9515-b76f9b1d93b1", "comment": "Malware payload", "value": "388f576e12b0cd1a466e9ef2eb55455b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209120, "uuid": "50ed0926-158b-439b-9ad5-9abe806eb406", "comment": "Malware payload", "value": "426bd2ce95e08daa774cb3e2327629355e178354c774dc308ade204a071c8431", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209120, "uuid": "033424aa-6f03-4ba5-bc5f-0288810d6be8", "comment": "Malware payload", "value": "900c1ed775394022087eacea09ff0d3a3636cb1e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209120, "uuid": "ec6ac249-cbc6-4091-8f8c-ce941b5c7f21", "comment": "Malware payload", "value": "baac1dbe0aec466e0ae7f747423976a8614dea64b0ab6483450520174803ee8cfc0c1bf60a441001d7e633e5d916613f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209120, "uuid": "b6f26802-b3e8-4fd8-aac6-0620a2a07f39", "value": "E9C4F1322E6AB499D3EECEF15F104AA42DD896B7A4D6F668DFBB2130CC4C1347156309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209120, "uuid": "2059c56f-2304-4b33-af5c-fe5e80bbf28f", "value": "36c9bb62142843147fa45d3cfa80b6d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209120, "uuid": "eeb69fce-576b-4824-9c96-ca31bf448f94", "value": "12288:rdjyq9TJWXxf1e9z2xsTuXEzin3XzDJWga+gciB3Ts+/V4:rBv9TJWBf1e9iUHzO3Xz88gcYjs+t4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209120, "uuid": "4834107a-61d7-476f-8337-6f62b736e1e0", "value": 546816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209120, "uuid": "260abc32-e010-4a15-8b09-06a3090b172e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209120, "uuid": "be05da6f-26d2-4668-98a8-aeaace5ed814", "value": "388f576e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae6fbf34-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241883, "uuid": "4f7122b9-d98e-4583-a849-832aaa96d7f5", "comment": "Malware payload", "value": "ac3e88720bcfd285c3b9b39c439c60c5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241883, "uuid": "c75abe5b-a457-4c95-8279-3a68060053ff", "comment": "Malware payload", "value": "42901be860c87ffb13cc4782552b6c3f1dd62a793bc04c901343bc427cd4ce7e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241883, "uuid": "6caebcc0-9427-42fc-8c29-588cae997ec9", "comment": "Malware payload", "value": "c4e7ac131b48284cbcf073ffc709fb24ec86fc73", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241883, "uuid": "73dbe959-4854-4716-a302-0f2f464f0f2a", "comment": "Malware payload", "value": "50bf2862085706f6496ef06c7591e2d74a4a118a06652d8c0d066dac8a61b96dd22336bd6b2370d1b14e99eccb77a869", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241883, "uuid": "b7f1b740-65fd-4c60-9945-4bb6bea25f0a", "value": "DCF3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241883, "uuid": "bfb07b5a-1036-4026-91d0-b6832ad4830d", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241883, "uuid": "aec06c13-7bc5-4fbb-b293-5888c717c7a1", "value": "3072:Ti45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:O4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241883, "uuid": "dac474db-3b2f-422f-b162-75770b40a414", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241883, "uuid": "4e5daed8-4e9d-4737-915d-a13ed6a98df1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241883, "uuid": "cec22190-7516-4942-9056-6c36e2be7482", "value": "ac3e8872_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f06a5fe-add6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620242045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242045, "uuid": "d3339128-9359-4482-9c44-ee62a6ac3a60", "comment": "Malware payload", "value": "7186116f26e97c0f322278807cdf6dc9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242045, "uuid": "19f4e121-6900-4779-ad69-649ea6e6be72", "comment": "Malware payload", "value": "431b016c444e762b8eccc6c7ad1b82cafe5711653b0b2322d03feb351c6b8304", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242045, "uuid": "3f1ec2a1-e7b3-4de8-8d79-2172b35bf7e3", "comment": "Malware payload", "value": "8ede50748d43c33e9b9a17fc6ba929060d2ffe87", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242045, "uuid": "21a56d77-21ed-4d39-a832-83b57efa0113", "comment": "Malware payload", "value": "b948888eb424e51ac0023cc4946c3227bd0f035b01f3282c2be1076c0855e0ffb1f8cbd2dc50252c64dad010af087d1a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242045, "uuid": "e7729f78-beff-41c5-aa2a-a47679fb27e6", "value": "02F3C085DBABE87FC45A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242045, "uuid": "30e4cc0a-2911-447a-9adf-146500d446ce", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242045, "uuid": "5fd087c5-7779-44a6-8cc6-713679c1bcdc", "value": "3072:4/45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:U4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242045, "uuid": "c16c74d8-f564-444d-9d4d-93ae54d3f082", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242045, "uuid": "9ba6a0e7-fc60-4028-b351-6f597696d41b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242045, "uuid": "8e538902-aca4-4f6b-ad6a-95ac22a4e6ee", "value": "7186116f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e50c168-adc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234098, "uuid": "df8dc533-fc19-42ce-a094-e17d2a32114b", "comment": "Malware payload (Dridex)", "value": "340e19119b956d2949694bf292184796", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234098, "uuid": "fa8e3e12-8c3b-4987-a467-e93e3f82b479", "comment": "Malware payload (Dridex)", "value": "432942820597557366679f541de70c6c7204d638f2ef9e45b31f73e7b964acf7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234098, "uuid": "16d3eb26-833e-4261-af1e-ad55f6d4527a", "comment": "Malware payload (Dridex)", "value": "4193356b68749e9083d749b95da572bd5be20090", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234098, "uuid": "050def9f-6126-4106-bc49-17390d46ba9a", "comment": "Malware payload (Dridex)", "value": "6dacff4e9dc00f5151b66da2d1aadd2cb272c819e3a6f1108abf6927a3fa654d13cb92820ade4b11895603adacc70008", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234098, "uuid": "09e3af39-d31b-41a3-a2f8-a23b7a661337", "value": "CCF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234098, "uuid": "dcbf601d-0422-493e-9f2f-79cc32b4cc59", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234098, "uuid": "19460e9b-1102-47d1-8c05-d2ad0b9fb0c9", "value": "3072:Slpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Slo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234098, "uuid": "bcd942e1-0dd0-431d-9e47-f4bdb6ed4daa", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234098, "uuid": "699abd21-b40e-4793-837a-3df7638bc542", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234098, "uuid": "84e95ee1-f25e-4f5e-93a5-3598d6ec2b1f", "value": "340e1911_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9bde374-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209233, "uuid": "6faf4944-0e03-4ed4-bc85-aa31b663d3e0", "comment": "Malware payload", "value": "2032b20b23dc8a34d24ae32604ec4745", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209233, "uuid": "e34e79e7-8bdd-45b9-8d07-216616f67ef9", "comment": "Malware payload", "value": "434cd183b3639d049f8468c7d5e1c1172795829e0ef9e8f74afaae5c5fae1570", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209233, "uuid": "5e069970-cd72-42dc-b111-8a429e0b8273", "comment": "Malware payload", "value": "2916140c12e3bb18e9bd035b395ae9bb62221401", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209233, "uuid": "2cb3a8d3-d525-4254-a845-b2982d68481b", "comment": "Malware payload", "value": "48553da1c9350caea8e57c287baf6e71c0da416e4170bdf055a70254e320c0fdd518cfcd128e929828908a76d59b7f21", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209233, "uuid": "2dfb8e3b-7225-4bc1-b12c-f4fd98dc04f0", "value": "8F75E0C4B2B4D876C92F9CBAB0C591980B21960E14D0DE9AE0C5E5A0DEE74DF7131E7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209233, "uuid": "fa09d421-2cf0-4da2-81dd-aa9797691821", "value": "0cc93d538a4cf124580dd2a69d70b688", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209233, "uuid": "0577c1cc-12c5-4b56-89ec-757d0d035d97", "value": "24576:OvbrMRISWBCTaDSnR3BksMevwFRHjOJtlxNK3GwownpOf8ck4Q7U:uXnCTJnR3FDlWbpqbk4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209233, "uuid": "252ae177-2bd9-4d58-a1a7-b4c9bf54f30b", "value": 1599488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209233, "uuid": "ad49dd85-cb53-4b54-88f1-037aa72ea88b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209233, "uuid": "1f538b93-6418-45e9-afca-c8e4219647e7", "value": "2032b20b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa10f7a-adc4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234333, "uuid": "722cd60a-7ec0-4717-8eea-31b6279084b2", "comment": "Malware payload (Dridex)", "value": "7609d93b73c5009153035e1e9949c473", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234333, "uuid": "23a3f7d3-6dfa-4a42-b54c-98c8a13687f9", "comment": "Malware payload (Dridex)", "value": "4365e9f8c022861d5aad7d7814b171ad277c3f7c33dcfe4c2d1815ff324effa1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234333, "uuid": "3f1c18eb-ae1a-4975-b61c-e120d7e3801c", "comment": "Malware payload (Dridex)", "value": "4ee8782ff82af44270040a53e59f52e93aadcc2f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234333, "uuid": "83a03e61-11a3-4b58-9482-bf815e42c90b", "comment": "Malware payload (Dridex)", "value": "7cff12e99b900d53541c89d95484250a93123e2b7c95fe25c4de6ecb5ea8d4ebfbe466bdf18c33edf1b21a065c539f8f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234333, "uuid": "a9383605-bc17-4f2a-a721-00728310eb13", "value": "15F3C085DBABE87FC44A35399472DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234333, "uuid": "6fd7a62d-8e97-492b-8d48-b118565c9141", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234333, "uuid": "11823cf4-d572-481f-acc0-2ffa61330742", "value": "3072:Wt45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:w4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234333, "uuid": "733c223c-71ce-4d13-a934-5429101ed508", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234333, "uuid": "c0ddc286-bc4b-494b-ae08-3c12e4a4c09a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234333, "uuid": "35d5c25d-67fd-40ac-a6b6-3af5c00820ea", "value": "7609d93b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "788e5be2-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252100, "uuid": "91c665b1-1768-4c83-a2e9-72c1c863fdaf", "comment": "Malware payload", "value": "cce7fc76ed354ce99df92da8a7c7b229", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252100, "uuid": "a1d6619a-275f-43e6-b4d4-1206ccb1460a", "comment": "Malware payload", "value": "438a1806a3c8e7344b9b453a6b5956763889e13966936003f0bb908ae7364f08", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252100, "uuid": "de34324d-551a-427a-add9-f2d430412002", "comment": "Malware payload", "value": "41ce94ccf2a058ee35e6e3fe3236e731e38b47a0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252100, "uuid": "1bf0efe6-de96-4fe8-958c-192962d44c4d", "comment": "Malware payload", "value": "4800e8284c1e7c0c10159b701d8a6f8e861795257c59553f86893d246ac6dde93535df1b1704d1818e924bd67ccfc0f8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252100, "uuid": "f2285c10-d7b9-4810-bd19-f8d66f6db14c", "value": "F6F3CFE89A9FC097E663583055FF3BB6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252100, "uuid": "b28fd2b3-d60e-4527-a01e-779ebd9e0e8c", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252100, "uuid": "be10ba7e-88f2-4c06-9510-55f24bed220b", "value": "3072:Vf4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:KDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252100, "uuid": "db540b8e-4abe-42b4-b948-4efd93f7fdbf", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252100, "uuid": "cdbe6a8a-a191-4f82-9d0e-d10ab303f864", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252100, "uuid": "f8019295-c19f-4581-b9e9-d4525f8fe3b3", "value": "cce7fc76_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99dde382-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252586, "uuid": "fcad560f-105b-40a5-bc81-bbe7004c6883", "comment": "Malware payload", "value": "636cbfcdd3336aaf4bce309e92703768", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252586, "uuid": "a1212cb8-1979-4c2a-ad85-fdb64b18ef79", "comment": "Malware payload", "value": "438ac1cd671896089d6c2567bd690f2e38bef7ca3562772287de50468b86a5cf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252586, "uuid": "606e0057-7cb6-4452-8837-85dc217db1a2", "comment": "Malware payload", "value": "8834cf35ffd7b22f3f3e82aa730aeb16fc6e42a6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252586, "uuid": "ef904900-5fc5-4714-b990-0b9bc2a1911d", "comment": "Malware payload", "value": "86b91e2ddf1ae56a20732881719403d7d5c9e011d2b72163c7d3f1b0a9289e9ab5420433c561479ce7ab55e166419177", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252586, "uuid": "a025628c-eb1c-4504-a26f-7872ab2b2c7c", "value": "39F3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252586, "uuid": "6286a75f-3d04-4819-a498-0534f516dca9", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252586, "uuid": "318d40ef-24ae-4273-aeda-71fff3e74813", "value": "3072:4d4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:pDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252586, "uuid": "80c59dca-c3b4-4884-b8b8-9848216b2a10", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252586, "uuid": "0026b84a-a694-4a4d-9c88-205840df72c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252586, "uuid": "f91c3d81-2aa2-4e25-8e89-89674c0d518a", "value": "636cbfcd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bbc0592-ade5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620248508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248508, "uuid": "df99d151-ab64-4a04-ac96-a95df65a3d9f", "comment": "Malware payload (Dridex)", "value": "286244f98967b579590cabaf82e027c2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248508, "uuid": "24add352-a1a6-4bcd-ba83-b1753d0da2f2", "comment": "Malware payload (Dridex)", "value": "439b89368e443dc110f2f066cea38c82895ba92ba6f384fb76f0f5e78fc86138", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248508, "uuid": "15e096e2-e714-4f2c-b6e5-6b34c43c58f9", "comment": "Malware payload (Dridex)", "value": "c7745b9a59cad5eb1e1ad4dbb3bcfc10e3292c3a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248508, "uuid": "df19cd34-4045-4593-a187-f5037b21e548", "comment": "Malware payload (Dridex)", "value": "8fb53a4125c8cd3f3809de366b9ec6e28ed018ebe03f20e40aaff02568fa2a724c8888848491b789b1e6a989c4ad7edc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248508, "uuid": "1dae8792-590c-44d2-b1c4-0f8fc76d1c8f", "value": "B0F3C085DBABE87FC44A35399071DFFB5B388B145650C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248508, "uuid": "e8ee449a-53c9-40f5-8069-1ac3c4490e6d", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248508, "uuid": "cd249459-f18d-4b08-aa4d-7328a289e731", "value": "3072:At45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:W4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620248508, "uuid": "5263c9da-d1ac-49e3-a121-7224a034117f", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620248508, "uuid": "0921502f-0351-49ca-9ff9-0c4b20c8ab53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248508, "uuid": "9c934a05-ee0e-4ca4-b752-70b153d0ae1d", "value": "286244f9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1537db-ad62-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620192436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192436, "uuid": "d7791cb1-289b-440f-af0c-ac091f340fbd", "comment": "Malware payload (AgentTesla)", "value": "86939ba71dc80c0dbe57c849f9b024d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192436, "uuid": "8ba10ef3-6b20-462e-a2ce-843b6fe5d1c9", "comment": "Malware payload (AgentTesla)", "value": "43a462b16b2f19b11d18cc193f08e2a9f7882d5c2af3fa4960a1a65d77628cf4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192436, "uuid": "975f5f3d-2d3d-4392-8ec2-16e57da8a648", "comment": "Malware payload (AgentTesla)", "value": "c4181f78bb5670217a972e7392c23336ebc4252c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192436, "uuid": "4eabdc78-3399-44ee-b1d3-2b9dad740df0", "comment": "Malware payload (AgentTesla)", "value": "b15e71e6a11af8afb498bb0a1d449cbcc0fc2ca79940c6449e3349c0a567b2c23a1eb1515f6182d793171143008447b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192436, "uuid": "11c438e4-5f8b-400b-9b54-143e51dfdb7a", "value": "70E4230A6371CB3BB73FEC41B4D7650FB0CBA9B81A315905B3D4735A63069691EAA3C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192436, "uuid": "33754c41-db89-4f1b-9383-30259cb8e24f", "value": "12288:rkWxGfo7dRt+1qRGLGOn6jv6iX3ChhSLxB/ESWF1B5eM1TTvs:rkWxpQYEG4ivnChgf8Rjr1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620192436, "uuid": "9907e228-ea7e-46a3-93d6-2c40038607b4", "value": 660790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620192436, "uuid": "39308d5c-fcb7-4fab-a91d-534475ec69ba", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192436, "uuid": "6789f5ac-8367-4f89-b9d3-0570a88edaf8", "value": "SHIP\ufffdS PARTICULAR ,STOWAGE PLAN, CGO MANIFESTS, BLS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b45ffb-ad90-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212197, "uuid": "4251d3f2-ea69-45e1-9339-ed763e0e4ea6", "comment": "Malware payload", "value": "560249d59ed42704b6ba16ac9ff7f584", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212197, "uuid": "dec8f6db-0b2b-4094-ad6d-ac5f375b6c16", "comment": "Malware payload", "value": "43cdafa25ebd5bd79459783011a6bb6b2e59aede1ed8465bfebea972d85b8f0d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212197, "uuid": "f3ec3d73-2862-4986-8a82-984610df9a4c", "comment": "Malware payload", "value": "4b0cd0b656cfd155c1b2b12231e1b6a145bc359d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212197, "uuid": "016cdf58-2a30-4e28-aea5-440af4d29922", "comment": "Malware payload", "value": "8665f1bd56b01170563bed5bbf93958a2959fdbd25f3504918da10da3b988d47edc8f19353e369a0831e93f8be95580c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212197, "uuid": "ec75bec8-6597-4103-a820-ce9f4518adcf", "value": "EAB255A6AF8D2112DBF9914291A5BA95C0AF7423EDD1FD7C3EAD120C0F2D41BDA02D4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212197, "uuid": "c2d89f84-56e3-4073-8e0e-85575b3b3f37", "value": "384:TC48kIxcBYrP+gK6jVeUnuHFuBR3I7WlJodP9Ki1pus79yn:TpXIxPP+gKMIzle36WvodP9Ki1pue9yn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212197, "uuid": "b2a01934-07f6-4f9c-888c-c5f67b2752f0", "value": 23848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212197, "uuid": "df9fb450-9f31-4106-b995-da0808315dd9", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212197, "uuid": "a010b12c-2f84-402c-a8e3-f6cf0aec9a55", "value": "560249D59ED42704B6BA16AC9FF7F584.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef2c9224-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241991, "uuid": "082160d4-8780-4fc3-92be-54730f0b38c1", "comment": "Malware payload", "value": "efe2825d38a5e3c670618579d3fe0b7b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241991, "uuid": "35a7a5f1-50dc-4f54-a409-4492f00a9977", "comment": "Malware payload", "value": "43dbff4fe6fd16149da737a09e4e8d0053463c420f84307d7b64612e9d16a4d6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241991, "uuid": "4e127b78-aba2-45f1-a6fd-c6dc00dd1da9", "comment": "Malware payload", "value": "ee357bbbe63e031cc2a22f72b23704e2340b779f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241991, "uuid": "dc977090-dc20-4d4a-bbb2-f52b3c748028", "comment": "Malware payload", "value": "e2129b0d55e1c12661cd4cdb5467985aad340d22c6d18d34bcf6f1f73db6789b7297bca0f9d0b1ba013e197f95538742", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241991, "uuid": "6df4c6ff-a769-47b0-bac2-319a14c2e93b", "value": "ADF3C085DBABE87FC44A35399071DFFB5B388B145250C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241991, "uuid": "459bcea6-7aaa-4917-a0d0-cf402c71d89d", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241991, "uuid": "5fcd845b-88d4-4399-a198-be62ada6aa76", "value": "3072:mw45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:l4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241991, "uuid": "4e938a07-9030-42f1-8c6a-ec47c1458b6b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241991, "uuid": "62b55d75-a147-4e81-a41c-f4654d8f5124", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241991, "uuid": "7689b267-59a1-43ac-b32b-65bb596dc574", "value": "efe2825d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e758a61f-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241978, "uuid": "41f8653d-bfd0-4349-8f65-442b1ae821ad", "comment": "Malware payload", "value": "a68f03d159191515a7ec4b88c3f171a8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241978, "uuid": "d71a7729-4ef6-403b-93b2-e69e433f82cd", "comment": "Malware payload", "value": "445e8bb1631934e9473357ead3339d8dd551ab7d32b5c556d0a7212c5a3fa2ae", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241978, "uuid": "3d7f4037-f806-4cb3-837b-103a87c08e2f", "comment": "Malware payload", "value": "94a7b0526992bbdb5e656b4a8c4af025269baff6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241978, "uuid": "847c32cd-1b75-4ec2-a5a9-6391fc88a168", "comment": "Malware payload", "value": "7770222c6871e8a827ab1aa4e263d9d72b7d018861a8df0f813357de2b7891d802c63c27384a0d3e25ea8f66a9f92ff6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241978, "uuid": "b06054ad-89b8-4810-907d-b13095da531f", "value": "F1F3C085DBABE87FC44A35399071DFFB5B388B149240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241978, "uuid": "cbf1a0c8-5004-4999-afa6-dfe73dd419f5", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241978, "uuid": "50529f17-fcf8-4376-b806-573687564a66", "value": "3072:i945bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:Q4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241978, "uuid": "ce485c8f-b42f-4720-89aa-4386d9267c1a", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241978, "uuid": "2703a799-c41c-4e70-ad40-3e9aad7c080f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241978, "uuid": "c779c7c7-152b-4ea8-b1db-64b3632a03fd", "value": "a68f03d1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca012c24-adb2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620226896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226896, "uuid": "ff798c6a-c37c-4f04-b288-73cb3a4985b1", "comment": "Malware payload (Dridex)", "value": "5c24fffe7eae104534e259171cd2e940", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226896, "uuid": "a1297e85-888d-46a1-992e-86154cf9273b", "comment": "Malware payload (Dridex)", "value": "445f03df810465b3135db1269684f2c16ec81792414bc1f59435177b9d36eb73", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226896, "uuid": "076190c6-e3f6-464a-88fc-4a97365c7199", "comment": "Malware payload (Dridex)", "value": "360c8d9a12ea09bdbc4296140775891005e78a79", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226896, "uuid": "b0c5769b-97eb-4788-af83-11baa57a710b", "comment": "Malware payload (Dridex)", "value": "9665179e6e3c7cb75c93fd6f864abc0a178680bc1dc3498088d07a0b4782e4f0cc92466f7353fd79f990729162cc8d68", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226896, "uuid": "7fbd2b7a-900f-43ba-8779-8b52c25f0c08", "value": "BCF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226896, "uuid": "fdf77131-158a-49de-b227-4ea3c9d1cfdf", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226896, "uuid": "fde67741-f609-40bc-a96e-6f7f70c00b29", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620226896, "uuid": "908aff8b-0d17-4c37-9661-18b565e05e09", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620226896, "uuid": "c4faae5a-1e6e-470f-aecd-61333a49e35f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226896, "uuid": "077d5218-6f9e-4357-b84c-e74d7d258941", "value": "5c24fffe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59cb26ca-add6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620242170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242170, "uuid": "548bc5e0-876e-4471-8205-bad165033e9f", "comment": "Malware payload (Dridex)", "value": "54de8cb729a101a4c4b714728fd3e767", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242170, "uuid": "297e6f5f-0aef-4ddb-b65a-b9f4e09911c0", "comment": "Malware payload (Dridex)", "value": "446cd34b6c9d1288170db8f9979246ad50cab9adf642517d5d19badc4b7710a4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242170, "uuid": "06a1d82f-a24e-46cc-9773-4b4bb97e3a71", "comment": "Malware payload (Dridex)", "value": "d4f06a13f3a1e9f07a9a9e96cda3462478f2b4f3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242170, "uuid": "9ba0159f-1d16-4bd8-8c06-ee7b76ab3aca", "comment": "Malware payload (Dridex)", "value": "d53f7fd1375fad7ae1984b24778372406cc3892c14b5d7b5c944f9607d6b64c9469e7d29d5f678d8f017ff00a4d380ca", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242170, "uuid": "c4dbd99e-8dac-45e7-8945-4a6ddc4d08f6", "value": "89F3C085DBABE87FC44A35399072DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242170, "uuid": "e75b60bb-fc14-4598-9896-ddb23b49c714", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242170, "uuid": "3b2184cc-864c-4132-96e1-4f88cd50553f", "value": "3072:Mi45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:Z4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242170, "uuid": "f4e9050a-60e4-41f1-969b-7c6ce607812e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242170, "uuid": "fc8f96d8-d6d0-4739-90ab-a43269d2be45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242170, "uuid": "4ed632a8-569e-437b-ad0e-c584c9956745", "value": "54de8cb7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca8ecb2-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201695, "uuid": "4931523f-1605-42d1-bc0b-5407c29f6e83", "comment": "Malware payload", "value": "ab64b01b6a2857d86af737702e1e3a0e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201695, "uuid": "1c952b94-acd7-4eb1-a6af-fbe6238f09ab", "comment": "Malware payload", "value": "44806ddbae35f70265b6acf39df67561c43b4545fdd78bc4b1b1bcce00a55700", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201695, "uuid": "2742f3ac-5091-421f-a293-f7db0a8b02c2", "comment": "Malware payload", "value": "9aa48d52df5aff44289cd5af74f233bc71bd47f1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201695, "uuid": "88004b02-e8db-4cee-bc2e-68f861e61545", "comment": "Malware payload", "value": "a29ff51dafa9eb18d63077b3c31c355f1a587a7ef636bbdec5c51156cc17b540a4fb10e9499210ebcbbd70901a298e8e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201695, "uuid": "b3e3f957-5f7b-44c1-8438-d600cb344b6b", "value": "68D4BF90C5500FB7C6528930AAF3B95571401FBEE15C7F8F932A7BAED6481EDF1A018A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201695, "uuid": "190623b3-f23e-4562-bd89-aa4e7596e5d4", "value": "295598b51351f226c9604bcc66e1f6b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201695, "uuid": "acb60d2a-2484-411d-ba03-3ab57223ab6b", "value": "12288:VpPbh3HC1Z1WxEEdc5yF8ocuw8Q0pqxpJyjaqWR4zCr0RdHNHoJgVMAkbu3xTm:s7dNy+o9WpJ7MzCQGJyYKxTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201695, "uuid": "4f9d18bf-cb70-463d-9f44-ef7a81393eee", "value": 643584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201695, "uuid": "7ad201fd-0009-4411-9ca4-0cbaede06a8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201695, "uuid": "48c94636-8e19-4946-a469-2ca84fbc7961", "value": "ab64b01b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58ebcb55-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252477, "uuid": "0cfa4ba2-1369-40d4-ab01-b23dc5e5c623", "comment": "Malware payload", "value": "1c074c1df7e0660e2fea7a5645a29b4b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252477, "uuid": "1bffd0d1-a0fb-47b1-aa80-77ae70d47949", "comment": "Malware payload", "value": "44bded0b85d2fb0609df68d66346c7d496c553dfa9a02f6c8bf44e5f24e33f7b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252477, "uuid": "422a80ed-88bd-4381-856d-4e6682df934f", "comment": "Malware payload", "value": "319a069c186ed5452cb2ec1d1b78ef00da0824fb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252477, "uuid": "dc69cf51-5a76-4cce-b76d-60489e359d54", "comment": "Malware payload", "value": "c9313e41bda235267008db424b76491dfdd3bb77178cde40b3d9efba793af5c99679d6a3458e1e2e5b09ea9879ec80c5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252477, "uuid": "aa7a2892-8c45-4be5-83c2-68d55630b395", "value": "1BF3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252477, "uuid": "93787a3a-3038-4dbd-8a81-0399a801ead1", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252477, "uuid": "092f71d9-8cff-4509-8041-a1b076e95696", "value": "3072:JQ45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:G4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252477, "uuid": "9c694e22-5aa4-42fe-ae15-bcb6533b94f5", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252477, "uuid": "d91dbca3-b9d5-4780-b67e-6f970b6a1244", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252477, "uuid": "71bbc7d6-8a77-40b9-a017-71854bbc1a7c", "value": "1c074c1d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd5369e-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208592, "uuid": "724d481f-4b97-40d9-97af-c7512848f51f", "comment": "Malware payload", "value": "fd2a5ebba2fc9d4c56b0d4bd4e03f7ce", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208592, "uuid": "76e932b5-55ba-4695-ba51-a24923888cdf", "comment": "Malware payload", "value": "44bf8e5add9b93074848f4ad6a26c71e790d49cfca270c765f09191b9d5aec3c", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208592, "uuid": "84afa76f-d083-4c85-8184-182add2a47a0", "comment": "Malware payload", "value": "a4c7427f6124d50c00772d2427e5735d65d30f80", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208592, "uuid": "8ece4a36-fa30-41c9-b5bf-c93d5d6381ab", "comment": "Malware payload", "value": "fd7ce0bf9e594f4dc53d95b48cd2c80272560810cd824661107e4d0f5099bb2282bf10fe602797add28eff5d198515cc", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208592, "uuid": "0292148f-020b-4a6c-919d-c38dbcfe9cd6", "value": "65A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208592, "uuid": "fa2bda1a-189c-482f-8e8a-1f248bf27e66", "value": "96:HRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:HRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208592, "uuid": "999dff87-19f8-4c80-8dda-b6c86eec2a6a", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208592, "uuid": "c7ee3fac-e05b-4a37-a2fa-64e6c0855aa3", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208592, "uuid": "e68f1c03-d931-43c2-8175-1431c21b6d8a", "value": "44bf8e5add9b93074848f4ad6a26c71e790d49cfca270c765f09191b9d5aec3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63110a4b-adbb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620230589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230589, "uuid": "b031323a-59e9-41d3-925b-2eeae24e852a", "comment": "Malware payload (Dridex)", "value": "22e1cd8083d9e728b848203fe21cc4f5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230589, "uuid": "b99b83f4-5870-465d-be80-3ad85cf84715", "comment": "Malware payload (Dridex)", "value": "44c593f3a98b8b9162076088cfdf9e2b6d041890e8be0fdddb351b1f381c40fc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230589, "uuid": "ca6c14f8-81bc-4e27-9748-5f4496821852", "comment": "Malware payload (Dridex)", "value": "69382faeb07226b9d1afb310d0415e58072a435e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230589, "uuid": "006a6f16-01f5-4c2e-9a91-1b7a266c4bb2", "comment": "Malware payload (Dridex)", "value": "11c0c0a9603dacb5963e6ea3c8219e969b131ab39cf20b0ed4a996f59c562556e6551c97dc6141d2ce27dadbbcbfc8d7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230589, "uuid": "87e49213-f905-48c8-b492-24651679d5d8", "value": "17F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230589, "uuid": "4058a759-1f81-4bb6-bb85-9596a7013ff4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230589, "uuid": "bc9d36b2-3a6a-4aa4-aa59-c2f0e78d961d", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620230589, "uuid": "2264d7e0-f471-47b7-a26a-f9c6d35b9a83", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620230589, "uuid": "3b70aca9-e950-4f51-9ea6-b873ceb3934b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230589, "uuid": "c29110b2-b57f-4605-90c2-43a6e552b67b", "value": "22e1cd80_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca8f79d-add4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Stop)", "timestamp": 1620241531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241531, "uuid": "a7261e5e-7183-4fb9-ad53-d170b37028e1", "comment": "Malware payload (Stop)", "value": "aa17eb5bd52bf8b4a252b6fa8638e113", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241531, "uuid": "051b9daf-8567-4608-b606-e541ea7d601d", "comment": "Malware payload (Stop)", "value": "44d267b517f8af6f68f9548528ccfe6f532e6f18ac6f4ba32c4363afd29d59f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241531, "uuid": "cb0da687-d62c-46ab-9be4-115b1105bd68", "comment": "Malware payload (Stop)", "value": "747d4638617c4fe61a705346ab4c840b7a1c56ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241531, "uuid": "80cebb14-9cd9-43cf-bc78-c95e0697ff02", "comment": "Malware payload (Stop)", "value": "2f680a04d260ed8d92233c682ba043250dfa11ad4fffb26070052b0c733b092d8792371df292aa45ffa560816468bb93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241531, "uuid": "5960fdf3-47f7-48b8-a0c0-4be33e9d37fa", "value": "E305F1207AB0C035E1F319F849F986ADB52E7E915B20D0CB93D4EBEE56306E5AC31647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241531, "uuid": "dd4adcd2-239c-43af-978f-147aca0aa179", "value": "927da9753e83c2ae1d1bb0527fca142c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241531, "uuid": "0fb3acc4-aba6-4bb8-8636-97b92b1d7134", "value": "12288:JhNf5fDI17csYw6CYjFhISZiHM21sqpiKTrG5bRfPMHMW+F0MMwFhiv/1I:J5IdcfxZmrI9PMsRw7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241531, "uuid": "047da7f1-b223-4a9f-8a09-cac09d56173a", "value": 862720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241531, "uuid": "c6e74f78-569d-4e7c-96e2-ecb120a421d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241531, "uuid": "8128b210-fa78-49c5-aa48-df2dff99f9c9", "value": "aa17eb5bd52bf8b4a252b6fa8638e113.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a52f1f39-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212661, "uuid": "e09ed388-88bd-4e0a-992b-8308c731f3b6", "comment": "Malware payload", "value": "7bf6d016d1afdabad594459111d1447b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212661, "uuid": "113db293-122c-499d-a1b9-00bdcc52a8c3", "comment": "Malware payload", "value": "44e90fab894d0802615edb36cbebc165b48dcdc73cf99e87cfd8c781d4d1486f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212661, "uuid": "2b798a4e-610f-4745-8187-2c279a9bc8a5", "comment": "Malware payload", "value": "daf3187e291ae87dcf7a9d9518cd758cb66a28c9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212661, "uuid": "82cd3468-ba26-4f20-8f45-8b93eb25c5ba", "comment": "Malware payload", "value": "368e82069f11b7ba8f0a563d35df58b7536456d7ee24e93ea644063b7ed993174cd998958701cb8ac4c33fd2e3e1fc15", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212661, "uuid": "a5d85366-0a56-4a58-9622-6f7d67ece82d", "value": "14A4E0CBB9DDE0BBD3345A36A91F2582179C8344BB51184EC058B3831F57CFDA4AE689", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212661, "uuid": "c914a896-547b-4caa-a21a-7572b34e6b65", "value": "900d56179362bc762fd2181ce6f80d54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212661, "uuid": "a874f826-c3f4-47bb-aaea-b9589d846deb", "value": "12288:dZz3xtKCAPGwU+eyte4RGxJyIcPjCyFtIeUypVpbLkzd:dZz3xtKCZwU+7S4IcPjCyFK2pk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212661, "uuid": "4d4637ef-57a6-47b2-a592-2a6a06fa3081", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212661, "uuid": "3fbdc133-8baf-42e7-90d8-777f7564e3ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212661, "uuid": "55cb6003-e170-4374-8e08-1c56200136f6", "value": "7bf6d016_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9289d845-ad80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205329, "uuid": "e87ffaf8-f9d5-467d-8fa6-9681fbc9e4dd", "comment": "Malware payload", "value": "61ff973df304bcd5c591e5d35c1ba554", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205329, "uuid": "b9e60f4e-c627-470b-9d8d-e170380cbddc", "comment": "Malware payload", "value": "44fc1a922778a69692fd0d7a35079cb8b39c49ffae58aa09ba04fc50d832fb7b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205329, "uuid": "9a3ee34d-30a0-41ff-944f-8f90d293e811", "comment": "Malware payload", "value": "7f67c4a5092714def234870650d444b48c917a64", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205329, "uuid": "5583b70d-6359-4e67-bf00-6e5d8805f054", "comment": "Malware payload", "value": "46a8209de9b634198568115aad9b58a01f0a7e17c4e63c36702897762f55dc6b8cc2e93213d0d569374ac4c85c1458bc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205329, "uuid": "d987ce05-bbca-46e4-800a-1503af7b924e", "value": "1115D08932BDE0C8C2D5FF345081C8E25E5D1C26928FEBBAC346479269327B374D9939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205329, "uuid": "a174a383-c265-4f96-8bfa-679c8d272fe1", "value": "38fe6584d3cccf8c868fbc778699aeae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205329, "uuid": "0ead5d7b-9e16-4627-9588-e59371795385", "value": "24576:iPdVVhcCuecvLjZ7z4If2sBJjG9naY6SNh+:Id/2Cu5vJz4If2sDj8naY6eo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205329, "uuid": "2cb17333-be65-4dc4-972b-b6e54e382c70", "value": 915968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205329, "uuid": "887287ad-6d31-45c6-94f5-97b9d69bee87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205329, "uuid": "5dfb66a5-06ad-4650-b783-0e0926fefae6", "value": "61ff973d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d3a64a1-ad7f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620204810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620204810, "uuid": "c8ef1909-5f71-4378-904e-6f2b534d114f", "comment": "Malware payload", "value": "b18a7e266eee1977ef3a145369589d5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620204810, "uuid": "961465a0-96dd-4fb9-84ef-25ea0b4071b8", "comment": "Malware payload", "value": "452f6c82573df4442dc2b111140c09c86fcdb5d776487dd6d2386645b319024f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620204810, "uuid": "8f644c78-e956-43a2-8dbd-6d949587e099", "comment": "Malware payload", "value": "217bc16e2c9d1cb3e51f0d18242def29595090b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620204810, "uuid": "16d16604-4aef-4785-84da-eb12c0c429c2", "comment": "Malware payload", "value": "40911894d406d5e20e3578518a45774d303ee054eba7d8f67ab4965197a1df3e14c6067efdadc7ce9037db6acc46ecf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620204810, "uuid": "d2f68cf6-c408-42c2-9aa7-d3cfba64d8c5", "value": "73055A10CF944FB6C2CE06B5E17427152BF6DC82A69BAB8E9948F9F93C7339085141F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620204810, "uuid": "6dab3a94-633a-494a-9a75-ab867abe3ca9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620204810, "uuid": "bdacf14a-6e2d-4ff9-8a63-3cd056e279a3", "value": "12288:g1fxhwL8mLAHefRIZtbVqrTwqEZr1z3qs6rLk2:oZyJAH/ZtxqEZrR6JA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620204810, "uuid": "f73b7157-5e78-4907-8edc-b15272cefd89", "value": 835584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620204810, "uuid": "c4d413dd-21a1-4b4b-8686-2f3e6e1a3625", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620204810, "uuid": "854fcf65-e556-4f0c-b876-28232c87a5ac", "value": "Scan0029 Bankdetails pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b38483e-ad85-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620207437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620207437, "uuid": "5fec1b63-d146-4beb-8c43-bb2e825c7e00", "comment": "Malware payload (AgentTesla)", "value": "d051630d2dfc63d06a090eff79f3ce08", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620207437, "uuid": "c4ec70b5-e141-46ef-bcec-ef31bde56e0a", "comment": "Malware payload (AgentTesla)", "value": "4545e415481d1e7d6512272fa0472b77838eba1594854e426561d72117d27631", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620207437, "uuid": "1d9b9ca1-02e6-4708-87bc-c5c49e35862f", "comment": "Malware payload (AgentTesla)", "value": "47471c68308ef39f493e3e562b3b9875e8de647c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620207437, "uuid": "206a4e16-afe7-4ab5-9940-3cfc9aceda72", "comment": "Malware payload (AgentTesla)", "value": "ff4edb401a61139488dfaaf104d7355c3057f39498ab731142519b088e3b7c0eb97aa54cbf50ea2d35d3cb7e5ed177de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620207437, "uuid": "0a6e26bd-e772-4e9f-9f15-cc003168fe60", "value": "A825296832A81BD1F27B5FB663DA1C0183B92575693ED51D4F9013FF0962F032A35A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620207437, "uuid": "4df2e8ce-e4e1-4c3a-8f27-9cebc124f3e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620207437, "uuid": "6aea5533-6803-467b-96d9-f6ef63ab4534", "value": "12288:zj+bB4fWXY3Ot6InK1sLuNp+dM0kKg0D75wAPG+zETi/Pih2CV5R2DMaQ9wLcmFs:HD9wLBToLA6LgwKPvzLgmpdcg9vps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620207437, "uuid": "ffa1c37b-d096-480c-b2d5-0f78be98d4fd", "value": 969216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620207437, "uuid": "ceeab543-f701-4a66-9cd5-3891b6fec3e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620207437, "uuid": "bfd54910-7dcb-46d8-9e6f-025481dca5ee", "value": "PI-ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c07d181-adaa-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620223169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223169, "uuid": "aee7e8fc-6811-4c05-8e00-b37078bda013", "comment": "Malware payload (AgentTesla)", "value": "cfbece984667af69dcef9925af9de045", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223169, "uuid": "2ea7a1ac-1386-40bf-8672-b3c3e1f34770", "comment": "Malware payload (AgentTesla)", "value": "45e52219279de265f05cb2996ca411b71ba752341a190ff8a43f82eb78ebc80e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223169, "uuid": "448d4c50-6930-46d0-b33b-92a007437203", "comment": "Malware payload (AgentTesla)", "value": "eed32c1c8d0b00c75e4f105e69bfdd10aaf450ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223169, "uuid": "fcdcd54a-a737-4a0e-8d6e-fbf6a3d0a449", "comment": "Malware payload (AgentTesla)", "value": "df17ed4df93ef7c730a8b363b268e8b34b760ee0ae82124945296d5a5185eeeefcad1a36912ac9789303e8e6ed87679a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223169, "uuid": "9844d390-cfea-41c2-8656-8f75947a49d1", "value": "CEF4238662AC7C24C6BCEBB65031815243FEA1077B96CD1D7E8294DD78DB503DB12B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223169, "uuid": "8f5a6a5c-60fd-4b43-bd93-f5e245186f7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223169, "uuid": "3980c853-b01f-4aa0-862a-8fea30ba9b09", "value": "12288:qME/qcQ3alEmsDS0B12yPmlzbiUoky3WVvh+S2B1R+jCfiuPB2psL7:qNSqlEmF0jhczbi7kyw+S2Bjp2ps3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620223169, "uuid": "6da2603d-bdee-4ce4-9ed5-1c31547a33d4", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620223169, "uuid": "c882e61b-3580-4538-bb37-e1e2d41177e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223169, "uuid": "ef92dbb9-1aeb-47c0-82dd-6119fd5f38d0", "value": "thai.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f4212a-add4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241543, "uuid": "1ade445b-e33a-48c7-9d9b-ed25d4f30799", "comment": "Malware payload (Dridex)", "value": "186ff3ac68b9b20874ae39762438366c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241543, "uuid": "8b311e47-09ff-4abe-9e4e-0e46bb6e97f2", "comment": "Malware payload (Dridex)", "value": "45e92d0bf006831cd8b01ad93dd059b1854b9c476f16144b408409d263494d90", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241543, "uuid": "7b5c8cf6-c72a-4634-824e-8432831d8dc1", "comment": "Malware payload (Dridex)", "value": "7497158c41a6e7c9c21de753c87fc3846978dda7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241543, "uuid": "a5850487-7534-4c01-925b-4fa25c61f368", "comment": "Malware payload (Dridex)", "value": "21365bfa2fa6d8d7c5e1f40dd7625f94d6e26e5e299679beff96cb2f548abbb8c9e0fd53e931b3b693e7f2767302f2c7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241543, "uuid": "771cf5ea-a38c-41a2-bb56-0829ec189cbd", "value": "99F3C085DBABE87FC44A35399071DFFB5B388B149240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241543, "uuid": "f407c41f-086b-451a-94d7-8b5b8f8e5ade", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241543, "uuid": "2ef9bf67-12a0-4e4b-99bc-efa39587f491", "value": "3072:Ex45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:y4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241543, "uuid": "ad333af1-61ea-4b10-88f3-25d24ecf9134", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241543, "uuid": "6c2722a3-5c9d-47fc-8133-a83b45e1a267", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241543, "uuid": "b4bad418-329b-4e89-ad57-28fc314026d2", "value": "186ff3ac_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dbe6ffc-ad81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205535, "uuid": "e19feb11-dae8-4027-aa14-cc627a53153e", "comment": "Malware payload", "value": "198436753abc3a016fd00782e68c4c2e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205535, "uuid": "3b6d0c53-02f1-475f-bbc0-c65237f9238a", "comment": "Malware payload", "value": "45f907016cb82a379a06187a3e9b478af573b771411c363cda9b4c8930141acd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205535, "uuid": "b741bd48-ea2f-4595-8317-01564a6ba8a3", "comment": "Malware payload", "value": "56163d55b15a6bf167966d05a5bb6b1760169128", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205535, "uuid": "a4ec37aa-99fc-4ccb-8691-7c2ebf3f5eea", "comment": "Malware payload", "value": "65d263a140ef8a522b08781f2daae1b09cfbf921896bd98dd793aa958cfd9caf2a4e778b339cd20676272e6659ab415f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205535, "uuid": "6ee4d65c-304c-407c-bad1-3b61761f0694", "value": "6273E1F12B2DB6E7E8B8E0719955F4580456737BA8C21DDD21F4038A0B34A62ED86C7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205535, "uuid": "19cee563-1a16-4337-bcbf-35557b1c7c29", "value": "406c785a6e2c6970c1e8ed62877e197b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205535, "uuid": "a325cf16-e0c7-49aa-b0a9-03cc8816320d", "value": "1536:JvQBeOGtrYS3srx93UBWfwC6Ggnouy8WFRxZOYTeGL/Rv6afX:JhOmTsF93UYfwC6GIoutWFf7TeGLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205535, "uuid": "a18b3382-7074-41d4-b870-174eec30fde9", "value": 80499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205535, "uuid": "f8befffd-acc7-4953-8197-5825e10d5f97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205535, "uuid": "bc84e4fc-0390-49a5-959c-f0cef6b19596", "value": "19843675_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ecb28cf-ad79-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620202101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202101, "uuid": "ed96d75e-dd50-4087-9cf9-f998f38e439a", "comment": "Malware payload", "value": "e1ed63d273de094f74d12a850305f156", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202101, "uuid": "8e96ac4b-e888-4fc1-893b-5532973060bb", "comment": "Malware payload", "value": "45fae482574687582244d4310a6f4760477952443e0be052f9d7ef76640cdb3a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202101, "uuid": "92fe1d5f-c716-4260-8c83-1b1c7712b4fe", "comment": "Malware payload", "value": "b3d716828f7017699483a04e78c5fd040c17b877", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202101, "uuid": "c4521336-6431-4be6-abbe-81600295b33e", "comment": "Malware payload", "value": "71f190bf5d2479b7aabdc6c705e9af22233a3b649297b43291c9bf7ddda9fd6ddc9560c5d6e19b84dfb4b2d8c23083f0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202101, "uuid": "69c79ee6-454c-46fb-859f-3bf80528e2ff", "value": "6E85E00C6FA911ACC683E87CA5A7C97969F262B2D4EBB0114C07E728BD2F546F5044DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202101, "uuid": "64cacbc7-36b2-40ff-8833-73772df8baf5", "value": "ea7bcfaf860b1d2ab4deeebd3d5a6196", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202101, "uuid": "88899f6e-0c81-441f-86d8-4677b599ec41", "value": "24576:VoenBZNvA7jfYJH0J16g9rljmY7QKl380tg8Ann5Rsr4ONmWsf39n8f0gFlh:fOjeH0zR5Kda/tmnn5Rs8Ym5nG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620202101, "uuid": "eb8544e7-2c89-4d2f-99a9-ad778ccca28e", "value": 1725952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620202101, "uuid": "284c8525-bf47-41dc-b9b1-2bf63d6b0da8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202101, "uuid": "96103016-70c8-4e90-bcf0-88ccedc690c2", "value": "e1ed63d2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa49620e-ad94-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620214093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214093, "uuid": "4cd8e259-6829-4948-a9f2-d772df516ce2", "comment": "Malware payload (RedLineStealer)", "value": "53e8ba681a1e03728a17f0aee3ed7fb8", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214093, "uuid": "d6068005-07fc-4fb9-9bd6-87c67186615e", "comment": "Malware payload (RedLineStealer)", "value": "46330652084b93bffdc354a503f3c65b7ed8589c379822c16674bace498c2950", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214093, "uuid": "1216fdef-6733-4089-adb7-89dddec23db8", "comment": "Malware payload (RedLineStealer)", "value": "afcab29aabe431b85a3efd0b2cbbacfcb7a06282", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214093, "uuid": "a72662ee-0110-44aa-b23b-cc3de75972b3", "comment": "Malware payload (RedLineStealer)", "value": "0b144f175e04aeffb66f222c14a2551b1a9e6696974e2f753fab5ad85e47ee530649961bbcda5402149f1d2589a02505", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214093, "uuid": "a4b4c759-2f62-44cd-8a84-a56f58664d39", "value": "A0D36D2473988A29EB7D0AB53471015973F1D1CA7211E79BDEC0ACEA2E5A7C17604FF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214093, "uuid": "4254c166-a654-48af-ac26-05526374d3d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214093, "uuid": "50313d59-d315-41df-a101-f4eb042cfc03", "value": "1536:LHvfVtqwc4+GIUTotWXxxqxwlltwujLyd1p46bRA1jLoccz1yMddDkFxekQEyI9k:bPqqPBDedHTcwcchysdwqIyIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620214093, "uuid": "fa59e998-69c9-4045-863f-5b8be0801407", "value": 131076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620214093, "uuid": "c099e607-676c-40d1-8207-6019093f964f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214093, "uuid": "8e0e31d4-bc40-4794-a908-1178e382c5cd", "value": "5Yl6Zy4B4HJ2tu1rCe1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c422b2bb-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212713, "uuid": "9f5e5799-a22a-4c80-b9b5-8425d1b7b78c", "comment": "Malware payload", "value": "c6f9ef3f3a0e1ba0a82b264d6a8c846c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212713, "uuid": "503e2d04-e26b-46cf-bd1e-83894690492e", "comment": "Malware payload", "value": "4637602d5daddbd457d57b05455cc456f1d66a20c5c045627c621f929487129d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212713, "uuid": "b2e26633-5545-4e84-8084-8b0018799bf0", "comment": "Malware payload", "value": "a78d95006242ff6584fb8533e78ae1b04c551d70", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212713, "uuid": "496a8e9c-0040-4279-8d91-28a30efc4afa", "comment": "Malware payload", "value": "616ad067dd8f6df78ce7182de1c68fdee47b816a4044ae97581939c38059be9cdd17baf4357588ae9faeda0e14d9302c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212713, "uuid": "f4d1c258-f453-4487-a517-c7025ce1b671", "value": "8A65012FC283BD2CEAD5793961D9990DD3E1C403F69224798D4C87F930FF1E89699262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212713, "uuid": "987edb09-e750-43ac-a0ed-0a79b3691d15", "value": "dae52fa138fc6680b3730ee9f082e1e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212713, "uuid": "d7bbba59-e8f6-42e7-9c2e-1621d7a304f9", "value": "24576:2tq+MzVoNNnsYv7H7YVgISpxG8vw+Kz/XMRO3xdFbCuGEwxNn35e5bEsiqV8Bp2l:2tqVpoNNTjHacRAvb0hPo54UOzDkBoID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212713, "uuid": "f08ab014-5591-4aff-959a-f2cc0eb5fa5d", "value": 1465344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212713, "uuid": "d90dd105-ef47-4475-8185-56628ebdd1f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212713, "uuid": "d7d2e9d8-0cc2-41b9-bdaf-53767cad9705", "value": "c6f9ef3f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c7d40c-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload (Meterpreter)", "timestamp": 1620209111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209111, "uuid": "c31071ee-bc0f-4e97-97e7-0d27efa28c95", "comment": "Malware payload (Meterpreter)", "value": "2325794e9d3b14cc65c9c321eade519d", "object_relation": "md5", "Tag": [ { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209111, "uuid": "69412da7-c0f0-4422-9897-4fe31ac4893f", "comment": "Malware payload (Meterpreter)", "value": "463ee7e3861ac909bfebc676baf1ee2e6520f42ee69024b7f8e1ce77713d4863", "object_relation": "sha256", "Tag": [ { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209111, "uuid": "1069dda9-e6e2-463b-a76b-6042cc6e5036", "comment": "Malware payload (Meterpreter)", "value": "4edbfbc805c126eeb84830b9ba740ab2a9e73bf5", "object_relation": "sha1", "Tag": [ { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209111, "uuid": "0cef2ea2-cea3-4b05-afa6-b6ae56f057eb", "comment": "Malware payload (Meterpreter)", "value": "021905ff1e2252bc51ac96b115cdf817115c1c02faa3ef4ad3a7aeca66b46d31aa206cbd16ba56892d9a7b6f14464697", "object_relation": "sha3-384", "Tag": [ { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209111, "uuid": "526c48ad-1d3c-49a3-81d3-080d75f826d8", "value": "1773BF81E9C4146AE1A5123E67B43EB65971F5F62341C2AF758CDEE8DBC18B062353C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209111, "uuid": "c4897b9c-ff86-430a-8831-d252cc08e785", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209111, "uuid": "4721622f-052b-4571-887a-c45025c807ef", "value": "1536:I6KJ9uJlw8Xj+1E6F9ZLMacQGvMb+KR0Nc8QsJq39:k9CBT+ZLKQEe0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209111, "uuid": "59830ad9-2f84-4bbf-b26c-10e902fe551f", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209111, "uuid": "9b51255f-d2ca-4067-8485-1d01dc5da27a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209111, "uuid": "21762f37-5114-4155-afa7-96e18889c523", "value": "2325794e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05690943-add4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241170, "uuid": "78dcbd34-6de7-4722-a002-f5ec76abf6b4", "comment": "Malware payload", "value": "0d48fb1f5c0f457ca4506317d90802a1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241170, "uuid": "721b981e-b964-4572-862a-9afcd9000733", "comment": "Malware payload", "value": "4646d0ec1ed0ef6f241858c944855e62bb4398c7edc3c40085b2089e976fb726", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241170, "uuid": "f3bd16b5-1201-47aa-98a9-bdd49494584d", "comment": "Malware payload", "value": "fd29d4e566bf73cd9ac3e87320a43b4e524792e5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241170, "uuid": "f36ed9c3-cf9e-406e-8c81-b31ed6288036", "comment": "Malware payload", "value": "43426f71aa725024b4c1205a6ab2c6dc87be0d7d576f50544f47bc3698453cae40cf9b98f8e44c51f6d1ba3581cd8aa9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241170, "uuid": "e44b1359-a95e-4a1d-b28b-dacfc4936183", "value": "760462BD06946674F092A2FE5F5BC2DC80F976F511FC239BA3309AF404489A54FE7289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241170, "uuid": "1e6cf2ba-4324-4219-b619-f5ae1e6f4e63", "value": "418bb7afa91ee2677e9770deeeb77473", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241170, "uuid": "14e76802-95e4-4df9-98c5-569f218f7c4b", "value": "1536:O65/LQ2n3qA3PSD1AWc15xX418gzMPA3MxGQk2x44XaN9QqGYwOo9:D/LQ26GPS5g1Xm1MY3+lx7oQqGnOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241170, "uuid": "b919909f-12d4-4250-a213-b64cda9c313b", "value": 180337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241170, "uuid": "da3923f3-abbb-4e8a-959e-40915dcf3828", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241170, "uuid": "9635ce3f-ff62-4d6d-ac43-6cc6bc8bba51", "value": "0d48fb1f5c0f457ca4506317d90802a1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e73a7d8-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252459, "uuid": "05c1e0ee-fb7c-4426-a1f5-50b6996d2099", "comment": "Malware payload", "value": "616e43b22f3661b76d26c1817424cdad", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252459, "uuid": "7232eada-de36-41c9-885b-dbe415f1a7de", "comment": "Malware payload", "value": "4654e9264a07145a5a9f64aa7bd6e4596449d8acaa80dfc69fe478c135f11091", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252459, "uuid": "709531ad-88ee-4a57-aebf-e2824a245786", "comment": "Malware payload", "value": "e6fffdc14b6f6308693f7774e14a3e685aefe481", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252459, "uuid": "716c13da-9281-4a39-8992-49e8f599e9b2", "comment": "Malware payload", "value": "8b590fdb2de873bc86d65c62e11d3db96368cda31ddaee5f6ef881e132f30731aa3415dc60c08e9ac4a2799f74f1cbed", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252459, "uuid": "bd9a947f-743a-44dc-b008-2f8b61f52cde", "value": "80F3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252459, "uuid": "4f28e38b-43e7-438a-b589-c632a36ae842", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252459, "uuid": "fdeb38fd-6232-453e-b26f-db3891cda89e", "value": "3072:vc4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:bDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252459, "uuid": "19873842-a5bf-491e-8ef5-87e755ada5ea", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252459, "uuid": "6dc7815c-a214-4b0c-9bac-7a969d03a077", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252459, "uuid": "b991145f-c1cc-45b5-8bf8-1096d7eb7873", "value": "616e43b2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2caa17cb-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208594, "uuid": "3cd0c285-75e7-4bd3-a7f1-49d873a35706", "comment": "Malware payload", "value": "107b63e0eb253a21aa0ebb6def59f452", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208594, "uuid": "57b0646b-af7d-438e-818c-076062c5be60", "comment": "Malware payload", "value": "467fb05ea55e4bf6158b195284a9f4f9754a9ed437ae866b0db8800613439682", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208594, "uuid": "bfca7fd4-ef9b-43bb-8869-cf842b739496", "comment": "Malware payload", "value": "092bd0a105469425cff8c33372f1bcbb6dff5e9d", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208594, "uuid": "a25b9b5e-71a0-4623-9ae5-1e1a7f0623a0", "comment": "Malware payload", "value": "1de216aec60f6ad64d99ea532f59c001d457eea79ac095f7cfe230900ad4466e782e7f854367af752c482b80b329025d", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208594, "uuid": "d8d980fc-da18-4d04-852b-71d5c8306a03", "value": "DDA1F750112C1AB07246697AD26FFA52B90EC81B0A7B7B358433A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208594, "uuid": "677ad296-f5d0-46b9-8824-9b425120992a", "value": "96:TZRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:FRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208594, "uuid": "17ec97a4-9934-4f4a-b4ca-b6cb9f4151ce", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208594, "uuid": "ca834ac3-607a-4dbe-aa68-8f4307a4a2c7", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208594, "uuid": "b1de8ed6-65cf-4e2e-afc6-ff226e7cd756", "value": "467fb05ea55e4bf6158b195284a9f4f9754a9ed437ae866b0db8800613439682", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5eaec18-ad80-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620205415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205415, "uuid": "d3da62da-1bc4-4300-8a10-d64ec48be1e3", "comment": "Malware payload (Dridex)", "value": "4661df5984005caaa2a1425baef813aa", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205415, "uuid": "1da765e7-692f-49f4-90c5-e89732203eb9", "comment": "Malware payload (Dridex)", "value": "46afc2136b00a702ab45792b3d621174b55721ed3ba51760bfb75436ca7cbd80", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205415, "uuid": "98cf88dc-71d2-4494-8ca9-7e9cefaabc05", "comment": "Malware payload (Dridex)", "value": "33589de7dab92dfbb10f08eec94fc4ab921e3517", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205415, "uuid": "6a58bb03-05a7-4066-bb49-ca2fe0e84bce", "comment": "Malware payload (Dridex)", "value": "5fe433462c4d215bcac136e667958b8120d4ea70ac19381d58521c77290ca400ea9d94c8b2f3e44b9431a679746d29ed", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205415, "uuid": "1a396e49-2e31-4cdb-9df6-f04b648a4175", "value": "5EF3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205415, "uuid": "a702eabe-e077-4e45-80a5-a037e8ba0184", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205415, "uuid": "6904a1bb-51af-469a-9fa5-0922ffdacc0e", "value": "3072:/WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:/42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205415, "uuid": "5426accc-dfc3-46a9-9d6b-14ebba55086c", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205415, "uuid": "118ed5e5-bc01-42ed-9119-2b33ca4b3649", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205415, "uuid": "56003fc3-3b16-478a-97db-8b5f09f2bd0b", "value": "4661df59_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d15501c-adef-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620252806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252806, "uuid": "e41aa061-150c-428d-82ce-c1e967fe1441", "comment": "Malware payload (Dridex)", "value": "5acc2a5d9a2bf2386d08b83082242ded", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252806, "uuid": "64dd7d54-2c5d-44dc-8fee-c4f97f7f4f48", "comment": "Malware payload (Dridex)", "value": "46afd4a7026555f6f898c0229bdea86ee37f6e9724eb5a1b892d049f346ba845", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252806, "uuid": "7a79372f-b047-45e7-8be6-8a172188f02d", "comment": "Malware payload (Dridex)", "value": "d3d7f656e3483e7692fbcc18f487124cd9dd1ffb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252806, "uuid": "23f819cd-b35e-442b-98d2-c09a91d6a8ca", "comment": "Malware payload (Dridex)", "value": "64d9660b5f6d7885af8d32c7e2590756abac1b585bbe2531a9166773ba1c4378539c0f16d95b4f1ef82d5f8b02f67955", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252806, "uuid": "ddd48e9c-65b3-4d1f-8d54-1d62b56b9980", "value": "5FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252806, "uuid": "01f4ac7c-0fd9-4792-b06d-0bd425f51518", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252806, "uuid": "fab7cd02-ef47-4669-85d6-967a3c2696cf", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252806, "uuid": "b893856f-25f8-43c3-ae81-b8bd08ff1a62", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252806, "uuid": "60874613-bb74-4adf-888a-9cba45f48ea6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252806, "uuid": "0d00c823-fb9f-47c2-b01f-c4375a494a07", "value": "5acc2a5d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9122e3f-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212802, "uuid": "48c742b9-62d6-48ce-ae5e-fb66e4ebe2d5", "comment": "Malware payload", "value": "de0a8f647d8b301ed9e1f10ea6acfef2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212802, "uuid": "9423663c-0c27-4c3b-9a66-8ba983169774", "comment": "Malware payload", "value": "46d531ff943b82a82f732920b0026ad5cd2a8820c4569bb5d8150fd243a8dcc8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212802, "uuid": "dd3ea964-f70d-4b0c-a258-388cfdeed689", "comment": "Malware payload", "value": "a6ef05c57502824225fb38adb0ac92641d9432f7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212802, "uuid": "fa2bb848-e895-4bb4-a3b5-2959da69896d", "comment": "Malware payload", "value": "42fb9b8ba4ff260eba325aaa737c2974a8dce57e7c0d6f6dbbea109ebf5b542b579c0c24dff12750efe48f7a64b2e0ac", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212802, "uuid": "4fa3232c-45fb-487e-b4aa-b1e4b6a39dbb", "value": "BFF4AC66AA8B9E119933F631C4C3D90830EFFE6508DC95C6C59376B5191B6EFEE002E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212802, "uuid": "4f6c8146-b47a-48b5-b621-fb139f823309", "value": "f8d4a2960104bdfeabfd05464fae0377", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212802, "uuid": "1f517c5f-47e0-4ddc-b4fe-8af936e37d72", "value": "12288:ifP6npLRsG/U3BMzrXNrJQIhgi17o4pMMp4ouYejNLO0J6h4fX/KlSY6+0xEATm:iHUDZcxGrdVQSt7o4FiAejVJI4XLeATm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212802, "uuid": "3a6222a3-10df-462d-969a-cbf5435b99d8", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212802, "uuid": "d2f7b545-46fd-4f3b-85d7-6647db156314", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212802, "uuid": "77dbd282-93de-46e7-92d9-e106281055f9", "value": "de0a8f64_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c9a3fe-adb2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620226884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226884, "uuid": "9a0cbc46-3eed-4147-9372-a476cfdbad8e", "comment": "Malware payload (Dridex)", "value": "69868e87091f7c810c3650f3550d1346", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226884, "uuid": "82723666-c281-4838-a80a-4e300ab8e428", "comment": "Malware payload (Dridex)", "value": "46d5e0b81f03ee8e7ae9c6d2dea4b5023784e4044ab279d8652c100557129d15", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226884, "uuid": "388b3dce-84ed-4cfc-b7eb-40755dc3e6ef", "comment": "Malware payload (Dridex)", "value": "20fb47d710b93d6966c7243eff432ed1e1ff1dcd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226884, "uuid": "fb230f44-36c3-45e5-af2c-5b51312d98de", "comment": "Malware payload (Dridex)", "value": "1635fed7f7120084bd55be6ce1454f298e2bd6fbca5d46baee0ca0f8f2999d807acc2abc84a47593a896a41260844b95", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226884, "uuid": "af0a01e4-5d7d-4044-b9b2-fd1efaec6cbd", "value": "DCF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226884, "uuid": "a7a9def6-d03d-486f-9f1e-fd2115d7a4f9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226884, "uuid": "0da2cfd6-a065-4a23-8bb9-4974d1afd331", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620226884, "uuid": "83910afe-702d-43f0-853c-f9b68632c393", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620226884, "uuid": "24ed3f82-9568-4605-9ba1-b64f3e42eab6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226884, "uuid": "50db101c-8cd6-4bd7-b40b-4e9f96d84365", "value": "69868e87_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91320cde-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212628, "uuid": "748fa3c9-f5e5-4379-b6be-7a42c70c5963", "comment": "Malware payload", "value": "ee20c7018fcc2530c7ae9fc3ac76bed8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212628, "uuid": "451f4a2d-bf01-4667-be08-000a01a9228e", "comment": "Malware payload", "value": "472848640db148453844fc598056659926859a89c0340151edffb83247b37d3a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212628, "uuid": "c0005d4b-d739-479f-88a8-5bffa4d76441", "comment": "Malware payload", "value": "5f14a655871c382f988a69814832fcf6dccce9d9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212628, "uuid": "e3cee101-d3ea-42b3-88c1-db72876c0efb", "comment": "Malware payload", "value": "6e59e87b702f72bde607f2c36219640a60464ec6f040c2252c6eda99814ce971f53933ede9ac4fc07f857808cc30103e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212628, "uuid": "abd16dd2-2273-49a4-84a2-854dd6255820", "value": "37052261BA0AE85CF564713860493538CB4DE0FAB54818706E6D0BDE3E9CA64FEB705F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212628, "uuid": "b848ca65-f277-493e-8a86-8c5ad2bc1fb3", "value": "e4290fa6afc89d56616f34ebbd0b1f2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212628, "uuid": "0d9348a8-f735-4dda-8e97-6cfa7603c4bc", "value": "12288:J5LnfEnwhTb2GlaekkIWQm/w2ONMXpGXXUAjeX/95ETPl3RMC711S9PaXzghq:JanwhSe11QSONCpGJCjETPlGC78i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212628, "uuid": "4a285a3a-721b-46c5-8ea2-2ab5f65ff640", "value": 851322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212628, "uuid": "25e24ac2-5fe6-46b4-b343-a112be0a9108", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212628, "uuid": "04345134-be14-4faa-9fad-df21e1c2aa28", "value": "ee20c701_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb486d85-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212806, "uuid": "54c39b78-bdf7-4ad7-baca-484cc5c71428", "comment": "Malware payload", "value": "f89bdf9af9db67c7e397e46163a8b64e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212806, "uuid": "8359dd60-9c39-4eaa-8757-9db345ef257b", "comment": "Malware payload", "value": "473d152a0a7b28a491afa98de41cde84056c231a53abd41d12a69788590b7a58", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212806, "uuid": "b986481e-d0c9-467f-ab9a-845c79097009", "comment": "Malware payload", "value": "3d4559b990925e1f42de56c2b23bc082ae04f1ba", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212806, "uuid": "009cc1e3-dc54-4919-a27d-4704340d564d", "comment": "Malware payload", "value": "100574971aa7598b2fbc71ac4c0ad9348b59ed74855895d230ab5daef464daf2cebb1e41975c025a81912ad708dffd08", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212806, "uuid": "c4063008-eca6-41fe-93a1-b991f9abc353", "value": "F8D4AD9160D85248E241993F6C6A698DC3DBADF5CC709C079CC2E4F26C87A9D1F219FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212806, "uuid": "1bf833b3-cc40-4e8a-b4fd-31c025f5b3bd", "value": "27af0a1f58659cfc462877b5807cefe4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212806, "uuid": "e796f104-f7b6-4c43-a431-d4e9e1aeb441", "value": "12288:Sfk0Bzt9uCk3ptcnquXisOUZYhe45BEbPDCig9DZHZ8MFUlXL6Tm:Ss097xhnBvOTF5MPDC59HGlWTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212806, "uuid": "bd5f2d77-df6f-466b-a8c7-05837619e4d3", "value": 640512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212806, "uuid": "bc98b2ef-a968-40e8-a631-ec03139922bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212806, "uuid": "293bf78d-8899-4ade-bf2e-ca986de2e582", "value": "f89bdf9a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc84d530-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201990, "uuid": "a4a65571-d5bd-47bd-b971-28fcace878d0", "comment": "Malware payload", "value": "e105e1e81c0082f4e28a0626ebe75623", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201990, "uuid": "ae1260e1-53c3-4457-9036-961e0a59f721", "comment": "Malware payload", "value": "4751c096775e1d5c93ba570e0cec33b11a171e5e307d7a9a0271aaf56c039aa1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201990, "uuid": "e93462a9-1533-46e3-b36e-c9a46ac89ac5", "comment": "Malware payload", "value": "361bea71195c8d791d01799ba0f6629ed8826868", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201990, "uuid": "9a990261-0f78-468c-be5e-6895c22a40fa", "comment": "Malware payload", "value": "3017f04e8db6d9e1025eaecae8a94f726efb753e3f8c7a5c39967459938c7d5f44d90cf211aadfd980846a463016a101", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201990, "uuid": "63dc4a92-2530-42df-832b-3f11a9a9cc0f", "value": "F9D4E09600B75117E38B2232BDC923CF36FD58855B653E12233BDFBA706B816A715A0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201990, "uuid": "91ebe734-97cf-4fa8-9a22-67bfc009c9c3", "value": "10148b22c8a1f5c7df095ac7ce330396", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201990, "uuid": "589accb4-217a-4177-90fc-61ac404793fd", "value": "12288:XSc/5Wc8ooqRvWFuV7oyA5rOrP+HMeaffhTPJq/GUM797ptyakPuQ/a5kPt54b:Cu5yovU27oyA5rlHM3fVJq/NMR7ptyaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201990, "uuid": "25c89562-6bbc-44c6-b612-1221573ebe9d", "value": 620032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201990, "uuid": "62238764-3c17-4bcd-adce-419f0b5c6c8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201990, "uuid": "7c6ce32a-6097-4ed2-9fc6-e1640b41d64b", "value": "e105e1e8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5201af1-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241894, "uuid": "34cec3d0-ff18-46c5-b80e-66191f03da85", "comment": "Malware payload (Dridex)", "value": "227b0058b4d054eee15e44d5f24da42a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241894, "uuid": "b793178d-1a89-4705-b2e2-98225a19f202", "comment": "Malware payload (Dridex)", "value": "476a9711d04ad3318b802bbeb9919510196b7a31072a17a6e3b1aa6d5808dc8f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241894, "uuid": "176e2164-995a-4b35-a018-b4dd91b5be4a", "comment": "Malware payload (Dridex)", "value": "125ebf36dab8143a447fe7f582a275f768172bae", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241894, "uuid": "c69596af-bc34-4aa5-9f6f-d6db1f8723e5", "comment": "Malware payload (Dridex)", "value": "27c02e320c163e05bf1d1598a2aac51aeb29a45ad4b9e206f4a4332cc59f50944e3564b6e425e64ad5250fb2b6a198b1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241894, "uuid": "a8d3dfac-9777-444a-bc40-4011075f87f4", "value": "E3F3C085DBABE87FC45A35399071DFFB5B388B149640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241894, "uuid": "65c650fa-133d-4eae-88b0-6ccbc155b9aa", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241894, "uuid": "9acbfe63-8dc1-4b6e-844e-aa9bfcebe3f3", "value": "3072:x945bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:z4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241894, "uuid": "4e373802-0521-45c8-ab97-0fa10dc41088", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241894, "uuid": "2bf988fb-3f33-459f-9bda-b02c9a84bdfa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241894, "uuid": "3b1d9630-f472-45a6-9ba4-b54dc34601e3", "value": "227b0058_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "633bff98-adf6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255930, "uuid": "cfc8095a-5fc7-49f8-822e-d00ede42a41d", "comment": "Malware payload", "value": "0312e6731423f34aa8b8ff4130e4e22f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255930, "uuid": "03bd2452-ee24-4480-822a-86acdbe30ff7", "comment": "Malware payload", "value": "478ebcbeba56748e5431488989a59aaeda6155c8484779b1df93bbbbabf499ab", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255930, "uuid": "cbf523d8-9eea-4081-9947-76caf1480869", "comment": "Malware payload", "value": "03f27dd3ceda7b3dfafba91f7fc39dd213ec278b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255930, "uuid": "4cf2b352-e462-49b9-978b-ac5a936f9633", "comment": "Malware payload", "value": "4a8b3c40f5c3aab1bb0bf6dd5491c9be7df207595faaca0c85fe3ddc7a0c64348d0fed016ac584cd585c37c28ec4ccd1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255930, "uuid": "f74c6cd3-6825-45f0-80a2-3344d0be700b", "value": "AEF3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255930, "uuid": "ce066066-f559-49a1-bff2-9999cb86b73a", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255930, "uuid": "c4dd1be2-e4e6-4b69-ac2a-61d7a8fbd352", "value": "3072:Ef4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:7DBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255930, "uuid": "8024c2f5-bd17-42fe-8e99-efb68680e963", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255930, "uuid": "d9382721-a05f-46b5-a6b5-cfcfca633523", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255930, "uuid": "9a52d451-6d52-4aae-b76a-c78463fa9a67", "value": "0312e673_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52357933-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252465, "uuid": "9636eead-a81d-4592-bf2d-043fec4b5996", "comment": "Malware payload", "value": "65ec8ba9eccf7435e939980b441ca24d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252465, "uuid": "d2ece6ae-171c-4829-a616-4981acf0b724", "comment": "Malware payload", "value": "47c71323306541f8b61a12c754ea426c1c8329475b588e9990a5adc239c1bdbe", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252465, "uuid": "2763d327-2ca0-423d-acd5-3fab1abea1df", "comment": "Malware payload", "value": "3cbcce3914d94e166cd193a291ea82a6d26a2c72", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252465, "uuid": "33e61c6e-c24b-4440-98e0-477c00218e41", "comment": "Malware payload", "value": "13777b10af12363701eb857896bbc18855fa2fb32444fe103466d8d886857b4e56c19a119f6c21a7aff71df3e1ccf4cf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252465, "uuid": "30a26607-7518-4f95-a415-b670ba94e46f", "value": "D6F3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252465, "uuid": "2a58aec3-45b5-4891-bcf5-a2c2a9e16d74", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252465, "uuid": "2732a268-ca1a-40fd-8a5b-af7ce4d0e446", "value": "3072:J84Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:NDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252465, "uuid": "230c5fb1-88e9-40ae-9073-a98f9310951e", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252465, "uuid": "06cc1515-7b1d-4f5d-bb49-c825de7c64a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252465, "uuid": "ff33c4c8-7534-41ad-9132-c4f55e4cdea8", "value": "65ec8ba9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a9b92d-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241702, "uuid": "96bd5dab-7d62-45dd-b530-9c0c77f01194", "comment": "Malware payload", "value": "b7ea95c7f4f6fb81ff85560279c5555f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241702, "uuid": "ce771d2d-a81f-45ac-83a1-5db910405142", "comment": "Malware payload", "value": "47cafc070edc3cd3ad6bcac1f1982d56c12704350e71ec03aa63837f2b86ee10", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241702, "uuid": "859cd45d-9ee1-4975-abee-c13af4fea7bc", "comment": "Malware payload", "value": "8777db8a69bd567bfba8ed35edfa31416c59aa39", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241702, "uuid": "5691ed61-6352-4b7a-955f-7be387c79c5c", "comment": "Malware payload", "value": "7c91c3ed98b6fdee5c4b7ac69ae0b5e9e4b40f3fc54a004d22e11ea1f69f56e2b392102ec867db302af9c3d457ae8694", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241702, "uuid": "80eee056-e8bf-4fb8-ae84-07e1a98ddff6", "value": "1DF3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241702, "uuid": "d152e62e-0aa4-43f1-86c3-72cab6633813", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241702, "uuid": "41e6153d-2825-4edb-9f14-dc6033f99056", "value": "3072:SQ45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:Z4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241702, "uuid": "c8448f93-d5ad-496d-a96b-56c0daca5d62", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241702, "uuid": "e6a9da9e-6acf-4587-948e-6792427c6449", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241702, "uuid": "9c5684c9-692d-4952-bcb9-bce29aeb021d", "value": "b7ea95c7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a159633-adac-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620224159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224159, "uuid": "51a9b8d7-fc20-4578-a096-2d4b476c7bd0", "comment": "Malware payload (AgentTesla)", "value": "135c44f32fecb71a904f408f71537a35", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224159, "uuid": "7980bf5a-b2eb-4370-ab64-e30abb175efd", "comment": "Malware payload (AgentTesla)", "value": "47fba2ac8b8734d57e0f0d34d573a5c0c567d22683bc128caa58946cca51565e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224159, "uuid": "adb62490-b6e8-417f-997a-4f9f91d2ccc2", "comment": "Malware payload (AgentTesla)", "value": "3649548b633af99e882fdcd1dcb3706ffa7c94aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224159, "uuid": "8340456e-ae58-4b22-831c-9dd958e9da72", "comment": "Malware payload (AgentTesla)", "value": "abb3f45cf9c6f6b92d32a7719fba6b82de7a9a1dc9c55982b9c2d7c118361b340e70723fbcfaf01f7897f7db2eb745ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224159, "uuid": "788e1967-3f83-4720-b5f9-a25c22b81f7c", "value": "D205023D25087E11C87E1F3FD9A5D56162BEFC02A953E93F2AE0357E59F2BE40610226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224159, "uuid": "e06812a7-7272-4f8e-8269-7460df756053", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224159, "uuid": "be5c694d-f6a8-4b89-9043-1344bc872284", "value": "24576:YuKPZnwstiISAhC5ixRK7fYp9JHg/lDi:Yfhnw2SAkwxRp9pIlO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620224159, "uuid": "4bff6787-0a22-455b-9e75-a9b8879d22ac", "value": 855552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620224159, "uuid": "be0032d7-320a-4485-8ccd-2f918e2d8d03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224159, "uuid": "9e5a98c7-229a-49ef-b9bb-aa8e2d27a20f", "value": "PurchaseOrderPDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d47d7cdf-addc-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620244953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244953, "uuid": "8c215519-0715-4aad-83ef-3a1007da8bce", "comment": "Malware payload", "value": "ff27b491cea3313fbad628453ec770ed", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244953, "uuid": "b9c75929-4884-4fdf-a804-c9bfe6efda5e", "comment": "Malware payload", "value": "481c2a80d5ecc3177675b40d8afc390ff4a6e14c4664a39c66a34f8257f4a11f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244953, "uuid": "c82002db-77b4-42f4-9ab5-bed364baf449", "comment": "Malware payload", "value": "e1032fe153d53d99f0e4657f682ed187d40f0e41", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244953, "uuid": "1d232384-ba90-4f97-819f-e8ac30634b7f", "comment": "Malware payload", "value": "0382135400c4862d53d5f9af2f6ba7b6435f8710a745416ab8affd4a6f01a8621a647c65b104d5356d77283d0776010b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244953, "uuid": "df1c87da-f12e-4518-b428-4cf367a624ee", "value": "84F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244953, "uuid": "cd697e34-06fa-4448-8b7f-55e962830411", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244953, "uuid": "938dc816-53c1-418d-8c75-d89041c50b63", "value": "3072:WIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/c7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620244953, "uuid": "a7c14258-c561-4e31-89cc-78f405fecdcd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620244953, "uuid": "ca36810f-aade-499c-9bb3-c7983c753157", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244953, "uuid": "4cdfdd68-f4b2-4ab8-8975-4789f957636a", "value": "ff27b491_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92082b96-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212629, "uuid": "efa68c20-624b-4c56-9238-ea6bfec17447", "comment": "Malware payload", "value": "0963a66a183846a6a839f09994210442", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212629, "uuid": "989e02e1-699d-44e8-8e52-d322d7d02399", "comment": "Malware payload", "value": "4881bdda48b69c176e00ccd5ca5f3bc2118689946411be9e2f42303a45b2c8e0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212629, "uuid": "fa8f00e8-675b-4a16-bd33-ad8749ced009", "comment": "Malware payload", "value": "9a68d4c2e458c144782e050468c1231607567f8f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212629, "uuid": "784cf5eb-07c2-4deb-96b9-9353f6e409b4", "comment": "Malware payload", "value": "4974db49b8ea8f8b997cddc015349713de08afd86c6931550e146793b935634a89a484d4aa2f8b0677b580411ee07e9a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212629, "uuid": "eda3a956-866a-4331-a0c7-56499f8fd357", "value": "6743C538BAD044B2E2F7863684F241D2AA327C523D65451F3987338C1C72F5AADA971F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212629, "uuid": "9df5553e-aef2-46a8-8ca3-2d9d06647806", "value": "be8334f6a61dda093a2ab9b40f871a66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212629, "uuid": "95d9cb69-fc04-4069-9338-0644a4355039", "value": "768:tUQqQ/uckvClHD7RPsED3VK2+ZtyOjgO4r9vFAg2rqeAV26:iRYrHhYTjipvF2Ra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212629, "uuid": "580e308f-4cb5-44ed-bb44-b982ae7f0a9e", "value": 58431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212629, "uuid": "f287e918-6f76-41a2-8d53-ffd065446841", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212629, "uuid": "ead238ef-cfb0-4fdc-874c-cc7776a4d51e", "value": "0963a66a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3c83485-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252253, "uuid": "5eee9188-f1e4-4efc-8a69-0b6012524073", "comment": "Malware payload", "value": "89d19dc9a91810aff5290a4f255cf3f6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252253, "uuid": "be478250-1183-44e3-815c-b6213989e34d", "comment": "Malware payload", "value": "4884de14cfb69366134affc1ec182574dc47b101d20c255ea0f8b615549f07c3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252253, "uuid": "f6b8426a-655f-4fc3-8f48-9b56debd58f9", "comment": "Malware payload", "value": "bf9cde7748ebb71bbf102da6eda3e6a777105eb1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252253, "uuid": "0cc82f6a-7b75-49c4-8c5e-3450cfa18eb9", "comment": "Malware payload", "value": "a4e59ba76c25578a6c88f77854edf83008c51917fbc5b9580083dc8c6ff75f920aa79a5fbb24f5d82dcc8dbe9afb9e6e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252253, "uuid": "a0527ffd-d91e-4eb3-bf77-accdfc46f3d8", "value": "49F3C085DBABE87FC44A35399072DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252253, "uuid": "2fcf79bc-bec3-43cf-8a84-b6a3bfef341d", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252253, "uuid": "17d3dc34-556b-4726-b955-4e9fe25e984d", "value": "3072:lF45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:T4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252253, "uuid": "6c8db3d9-8a9b-455c-b7b2-8a9730730238", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252253, "uuid": "972528a2-d538-434c-aa52-08154a48dc83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252253, "uuid": "5613d9d8-7c66-4e0a-858d-d08cee7eb213", "value": "89d19dc9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d9b8eaf-ad3d-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620176437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620176437, "uuid": "465cf05c-062d-49ba-ac6a-67b76fe04414", "comment": "Malware payload (IcedID)", "value": "cff667f7cc386481e1083c98a625848a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620176437, "uuid": "fe63b1ba-bc6d-4d51-9d8d-0ac329d60b53", "comment": "Malware payload (IcedID)", "value": "48878e6ae9aad7bca993b41cfa36351ae853ec3a59683bcb0ed5accf7c595202", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620176437, "uuid": "be807032-04b4-4f6b-a936-86468c727d2e", "comment": "Malware payload (IcedID)", "value": "299d91974d842ebf371085889d7ab3a3b6dd6d17", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620176437, "uuid": "49aa325e-3fd1-467c-9f31-0013ec1ab049", "comment": "Malware payload (IcedID)", "value": "5ef1bb219a22700dbb1604d51a9d868ec85ade614b7089f92579bfd209a5a895dad0c2b257b9706caf4c3ce825af12b4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620176437, "uuid": "15d498a2-98b5-4bce-91c4-b17ec64c8a3d", "value": "31434C91F690F1F1F6E66F7141794F2A903463A09B83359F909C36F6CB7214E1B22A4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620176437, "uuid": "b2e5885c-6ce0-4269-b160-0bc649747aac", "value": "cfa8dd488fd4044f7dbcc5838881a33c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620176437, "uuid": "3791b789-ecd1-4df9-be33-1d37ab9ca3b6", "value": "768:Pn8Sg0+bpDPQPqxBtfQqxonY1rCsxPbEBJHVpEyVfkgAv36HAV1Mb7nTaHx:kDtEQBaQoSPIB5evK6qbnaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620176437, "uuid": "5df4306a-ba8b-4be7-bcff-0fe102589c21", "value": 56408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620176437, "uuid": "31793571-131c-4ed3-8305-ee51997799ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620176437, "uuid": "fa0404f6-aab8-43f6-8c3d-7694c9f505f0", "value": "cff667f7cc386481e1083c98a625848a.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a679f09-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241607, "uuid": "07283587-2b2e-4300-8917-e9e9f94e4f8c", "comment": "Malware payload", "value": "679480016d15cd4dacd57a054309d8be", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241607, "uuid": "14abcdd1-4877-4f6c-9c02-3267d9b517e5", "comment": "Malware payload", "value": "489deb3557aa080127aa904771ef86249823a2e99c4c3d108f56d6b5c4660f5d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241607, "uuid": "abbcd7c4-20c9-4b2a-ba0c-2cd1d7de528f", "comment": "Malware payload", "value": "80a36ece3f1ff7943689ec6c5eceea8fd1f57093", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241607, "uuid": "8038a878-c29a-44e4-8665-424aaede6bf6", "comment": "Malware payload", "value": "7d8eff8ee144654e2725fd27b52f282ee7baf2a0f55b9c45b43ea48c2b74ff51ddf7f1b5c18e2280c6cac13cdaf4ac4f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241607, "uuid": "609b3d92-67c5-4555-bd4e-1d9bc34f9181", "value": "98F3C085DBABE87FC45A35399472DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241607, "uuid": "a7bee669-86be-4299-bdcb-e34dfa2b25af", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241607, "uuid": "a3f93463-38c7-46f4-8ec5-0fe92d2cf6ac", "value": "3072:6X45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:a4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241607, "uuid": "d5066134-9cd3-4a24-9b85-925a74030f2b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241607, "uuid": "fede03bc-1e39-4d25-a2d9-454538c0f830", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241607, "uuid": "b385a8a9-ca87-4a65-9d33-53b58dfa2f62", "value": "67948001_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a4fd18e-adf6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255915, "uuid": "f5833852-783f-4b76-b793-65b404a56d52", "comment": "Malware payload", "value": "c83b805dfaf31210a140a151c665fb73", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255915, "uuid": "a9571bdc-ec77-48fb-96f9-5167c8198e3e", "comment": "Malware payload", "value": "48bf4ca061a72de28bb041741804bbfde4e0218d2e44aa2151ce5803e058cee0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255915, "uuid": "2015e381-b2e6-4605-92c3-f1fbd9eb8973", "comment": "Malware payload", "value": "5b198afb0c485762e1d1c4e43af622003a7b8960", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255915, "uuid": "52da1659-9b05-4712-9334-470532268ac5", "comment": "Malware payload", "value": "014f6fe026acc63beda471a60db3205d3608dbbde353f73bbaabc1c20ebe84157431d0f8c2aae24c0c28abb47ebf31e5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255915, "uuid": "01f40068-72df-4a38-a1b8-effa3f20f564", "value": "5AF3C085DBABE87FC44A35399472DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255915, "uuid": "d7e97fc5-a7ff-43ba-b362-d2d0eb0ca98a", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255915, "uuid": "53543688-21e7-453b-9526-bbb75832dd2c", "value": "3072:nx45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:x4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255915, "uuid": "06e4fd81-ef7f-49f4-8ace-ddf1e23bf063", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255915, "uuid": "c01e3bab-8424-44f2-96c1-3e5b0203220e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255915, "uuid": "a4c89824-cf16-4939-bb7a-33c926c94bf3", "value": "c83b805d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf5875e-ad9d-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1620217879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217879, "uuid": "5fdcaaba-c2af-44cc-ba7b-18c212acdfac", "comment": "Malware payload (njrat)", "value": "a3ba3e470d3da87be8632657a33869c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217879, "uuid": "d6e26de9-3711-42f1-b940-05726d5649b3", "comment": "Malware payload (njrat)", "value": "48e608cc0205f921ad888c1357007a4d0ea6ca0936cf167cc1a78fbe8ef31bc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217879, "uuid": "335908c8-b8b7-4408-88c5-fc823bf193a5", "comment": "Malware payload (njrat)", "value": "8da94c0bde540329dd8b1a391df968d581dd26f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217879, "uuid": "96f35cd9-21fb-4d5f-bd0c-89f19042f1cb", "comment": "Malware payload (njrat)", "value": "688ba7558f10c43e3f63d30b2edfce108ecdf3a4edaea4b329bb38f53057b3995b5e1b52c829efd9b84a0a09471f9acb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217879, "uuid": "14b4b9d2-9620-4d7e-b354-cd8e50764c7d", "value": "9EC2C002D5417276CD21CF7A1AA393E0A0E1D1081BD71F3749B89E79AA73BCD5D72B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217879, "uuid": "203b14dd-7844-44bc-a020-3f9e4f94fe45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217879, "uuid": "ab44db10-a529-4fa2-817e-2a0b9e597b58", "value": "768:5vkEJEHLWzOpBOzHylhYBBoobXiC663Q+2Y:yzrpBODbB+u/MQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620217879, "uuid": "cc403e5f-2216-43a7-ab03-5f1b5cb8fe49", "value": 25850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620217879, "uuid": "89292076-215e-4f6b-ab52-5356eb18a366", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217879, "uuid": "86e93004-71e7-413f-8efc-871dd1d39034", "value": "Windows_Update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b2e051-add4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241571, "uuid": "e4320007-b722-4f07-a9bf-ea24f29cb34e", "comment": "Malware payload (Dridex)", "value": "78f217f5f59f9f09131917481fb9e387", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241571, "uuid": "eed876ec-95e8-4345-a398-11d5d1aa0224", "comment": "Malware payload (Dridex)", "value": "48ecc9c8bca542d65a41f93d9379649e8371d57c0327c97227d4ad6adc933da7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241571, "uuid": "648e2e55-4934-405c-bd0d-20263d2fd78c", "comment": "Malware payload (Dridex)", "value": "97deac7e5265e7ab1606219eeceb09ba0d86552f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241571, "uuid": "eb000fd7-c058-464f-bf3d-cb09da2dd916", "comment": "Malware payload (Dridex)", "value": "f3feda580e90605ec9ea32361f14bb32487dffe938d742354a62a8c22c7c1ef22cd1640e44578bd8a3a461afa7858fa1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241571, "uuid": "e38c4ba1-4f0c-438a-ad7d-1c104fc165b7", "value": "BDF3C085DBABE87FC45A35399071DFFB5B388B149640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241571, "uuid": "ea12fee1-7f15-402f-be22-070e55d96382", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241571, "uuid": "6f367304-333a-409a-86eb-64df31596b5b", "value": "3072:j945bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:R4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241571, "uuid": "72502d19-e2b4-4cc5-8ec1-f25686cfc41b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241571, "uuid": "cce224af-30aa-4c71-b475-b0c0d322a673", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241571, "uuid": "4c5bd7a5-59c3-44a3-ac0e-ab500e78d5d2", "value": "78f217f5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "043393c3-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208955, "uuid": "fd2e4335-2fd3-431d-87be-41a17228c40e", "comment": "Malware payload", "value": "c6e53e16856d29a8f6ac08b1b990c593", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208955, "uuid": "0db8996c-349f-4bbc-9704-192c7a757936", "comment": "Malware payload", "value": "493f8b68ea03a7ea26f61a22e6cf25b7f2c2d5a088aa6a69f451b09b186bb4ca", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208955, "uuid": "b29c0ea2-e5de-4435-a831-221723d3ec61", "comment": "Malware payload", "value": "e1ccff2e9e83c1c6567c2ffc4c8cbc3d12989df7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208955, "uuid": "d9212f18-d693-4718-916a-8dc751fc1116", "comment": "Malware payload", "value": "d47b5092cb9c7b9ce3a15946b51ee7aee2dbbd0c392924b648100dff54598f9b4d507b40d46d92ea3aeaf25c6f04c20f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208955, "uuid": "6a2f70c8-0f74-410d-aca7-44cbf1bed5d7", "value": "45F49C0C1083352CEFB5DA3E8F4796ABFBAC45840E81BB6734B971B6A41E16357C9274", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208955, "uuid": "184b64df-c331-40db-8102-7958d8f6f4a9", "value": "9591bb5230e2d04641de844ed574d921", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208955, "uuid": "6403024f-563e-4b04-b5ed-eaef1f80b334", "value": "12288:FGPXrc9JMZ5NOKmhG0cXezWBi2SW2Ou+D7WuLbwCkVY33Xi++Y08RTm:FGzqJaKKmhL4ezWBeV23Xi++Y0STm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208955, "uuid": "f3041cee-ea7a-422a-af68-dd9931c3ce33", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208955, "uuid": "ddc271da-c54f-4f90-a754-ba47623866d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208955, "uuid": "32be602a-b057-4335-bfc6-268b29880666", "value": "c6e53e16_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6639438e-ad9c-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620217280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217280, "uuid": "51a951ab-b63d-4036-a85d-d607702cfca7", "comment": "Malware payload (RemcosRAT)", "value": "56626bf21f8de8d051d744973cb2566c", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217280, "uuid": "a7517455-99f6-49be-8049-54591d7dee13", "comment": "Malware payload (RemcosRAT)", "value": "495e8980ae0b6b1c68d472e9ef3cdb5eb888f8d0be94309acaa35b20536ee859", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217280, "uuid": "d2d51fac-2a90-458d-8816-ea0495742c84", "comment": "Malware payload (RemcosRAT)", "value": "af13b7b6844342fd2b2784bb01df9a780be5acbe", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217280, "uuid": "a20a8ad5-1daf-4ede-b029-2c7b7d0820ed", "comment": "Malware payload (RemcosRAT)", "value": "d4e7e61fcb6ec30837db2f013846fcd1276b7e301fc85aa003bac9d5cfef2ec7b46f70a11bcb9ae54e5b80cf44b72e0f", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217280, "uuid": "c8b9593c-8db8-423d-a4da-25468c574892", "value": "3585643A51E07116ABB3B9F63E6650E867E3F6B336F0C61D6109381D1FAD3113A2075A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217280, "uuid": "31ed0ea3-cfe0-4c3c-9b6b-22ff264fecc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217280, "uuid": "c0bc8b8a-9a52-4087-8a29-edd823aef727", "value": "1536:hbHDuWciMS7ZwLW333333333333333333333333333333333333333333333333h:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620217280, "uuid": "c22a95b7-b817-4b67-8361-2fc655b0ef4a", "value": 1750528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620217280, "uuid": "b7d25f71-40f9-4e06-96a9-c581622475fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217280, "uuid": "914d86f7-61e5-4e06-860d-575044d5f698", "value": "SecuriteInfo.com.Trojan.PackedNET.703.13913.18290", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd2eb848-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241961, "uuid": "73ee5302-1e12-4a57-b255-41b022a540ca", "comment": "Malware payload", "value": "ffd1dac293c4e25c1dcc7830fa09fd66", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241961, "uuid": "8cbe6a8a-c8a4-49d7-991f-aa54b461021b", "comment": "Malware payload", "value": "497f288ff5d9c5e4244b46239ddeff9ca44896ef7ffa001881e1242f2d3c3990", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241961, "uuid": "1cbb5a47-e21e-4450-b751-de3902f22ac1", "comment": "Malware payload", "value": "2343cd7dbe2bb6f0d0d6ff0fe631b3376c855f0a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241961, "uuid": "f635a3bd-d17c-4f33-ab43-2d05dc8b5b65", "comment": "Malware payload", "value": "10695ad926e5bb2b6f299cb7378a52fbb4c9d71ec153850ea1a4cb8d4fdca5ac1faae096a469a3d06852f5971d8a723c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241961, "uuid": "26d8419d-44c5-410d-82f9-3a5f4db6c6cb", "value": "83F3C085DBABE87FC45A35399071DFFB5B388B145250C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241961, "uuid": "4734b16a-6e87-4d5b-a54c-ae57c72e977f", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241961, "uuid": "18b8bdf1-6cf8-443d-90a7-d6f836645a17", "value": "3072:aB45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:k4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241961, "uuid": "9fc6ccc5-ffa5-4960-ae44-3949a88ba9bc", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241961, "uuid": "852e0f11-a8a9-4ee2-815f-5c947f32b2a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241961, "uuid": "e57af45f-8cfb-46ca-8a58-4f8c8e289103", "value": "ffd1dac2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d4c04d3-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212648, "uuid": "87f9b663-8b5d-43ff-b4c3-88f224933157", "comment": "Malware payload", "value": "de667529c8bb64848b518041985d801d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212648, "uuid": "6e09f2ae-18ed-4435-ac65-634ee11852e3", "comment": "Malware payload", "value": "4996334fe940c231c1fe0394d558d82f4467d931dd99f0fba58d6b49e52e0a9b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212648, "uuid": "5ce9e06b-2d9c-4494-a7ef-f8630c36686d", "comment": "Malware payload", "value": "2991ce038eb4f0afd88111d48b9a1760dfe1a284", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212648, "uuid": "481a7473-9299-4b42-b156-77756f2c77c0", "comment": "Malware payload", "value": "2d5aa7a3a449b0b254e2975f20b1d801d7f84f3f44efe47fc0a5061cb5c83f6778a91aae26f366218f43f1027791bbb6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212648, "uuid": "57e75e28-8e22-46f0-9a82-2c2638919abb", "value": "BB65C0B22383038DFD2708FE0D78B4F685D590A6F7FE79967768D5C9A5112633882623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212648, "uuid": "76d418e7-1f27-4d59-a952-e9cef4d8a704", "value": "2f690bb170e566ed12d06daab3d73a4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212648, "uuid": "ababb5ea-2211-4c41-8a24-45b1b62c0701", "value": "24576:8DFL3YhWhjZMRfsE81DwAxM8baBxVUoHZYBN5kCRL1SLT5UHBNc2qV4jUHqUPtfO:8ZLIhWhNgfqDwAfMxVUo4N5klLyBNcp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212648, "uuid": "34bc04af-83bc-4a55-b7dc-a8ca08d9ac6b", "value": 1476096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212648, "uuid": "5d9a7280-eae6-442d-8368-c8f33bbb84ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212648, "uuid": "3994f51c-2989-457f-866e-f7a40be30119", "value": "de667529_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b38a896c-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209249, "uuid": "bd175b9f-0a26-4530-8666-b5fa40e89e1f", "comment": "Malware payload", "value": "b64967d99f163cddc3c5159be6a9e7fd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209249, "uuid": "f557469d-2965-47fb-8da6-dde9df092708", "comment": "Malware payload", "value": "49ed352b9bb55524eface47ae4c8587908171178964d447c795774c969c533d0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209249, "uuid": "6c6c1ba5-1235-48eb-98e3-c18966b84250", "comment": "Malware payload", "value": "0fba3ba1702ee95ee10c15147681cadc682f3ed9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209249, "uuid": "6ea47b54-25a7-4056-b7c8-a11b52a0f445", "comment": "Malware payload", "value": "2f76829c42f4f007fc9c6bf534c41927c7898f1c29d0cde7af3f58ed04c3102b74a8f41ccd95ba7b3bc1e18ee93ef9a6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209249, "uuid": "23e72a59-f48d-4ce9-8f8f-4bf44a9aeff0", "value": "29C4F1B5317DC9A5DA64D8339B8ED9832E5CBCB9875A8DA41DA84BF9F0C0C1040F4E5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209249, "uuid": "da652a5d-e8d0-4cc9-964b-3a1185c8ddec", "value": "2d34f217073713d9b474a30cfc9d7b5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209249, "uuid": "337af1e5-793c-4725-8d75-2e17d7e10b21", "value": "12288:08M8SgEW6YMmyANVNObwcnwRxt+UnqrZdMXUbssMYpVfqMsW:/igEW1MmyCApwLsqYdMXUI7wVyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209249, "uuid": "2fb7babd-0df9-4414-8491-a6fa5fddc580", "value": 594432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209249, "uuid": "bbd6e7db-480b-45ff-bab6-7d65b375439a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209249, "uuid": "2ebee2f7-0aff-47e9-acc5-db9fbf8acab1", "value": "b64967d9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c7ab69-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252248, "uuid": "d599faf4-b0a8-49aa-9792-aac8b3f8b976", "comment": "Malware payload", "value": "dd165437a27c0c6ad3a2b5b09ed157ad", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252248, "uuid": "18a90ddc-ffd1-4901-a9ce-5a4cbf3673bc", "comment": "Malware payload", "value": "4a12ebd3fda3fb7b9836aa114b85452d17699a4abe4778e506a6db1d2c11f3c1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252248, "uuid": "547f1e38-ef3d-4abb-94bc-789ed08cea76", "comment": "Malware payload", "value": "1b350580285ef21a30705fa44e2a4db54480ef03", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252248, "uuid": "33501f4b-d8a4-4a9a-9f04-08965b21e9aa", "comment": "Malware payload", "value": "34fa6ca0231b8222a9cf6e691eebcf1c5735f4b491f91ff76c4a322918751c9bef539801789618f3fdfdd6430837e2f6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252248, "uuid": "e05d17a5-357d-4c06-b512-0dbc7d0364f0", "value": "2BF3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252248, "uuid": "48b881b9-a5d0-4424-986e-50c096e63bbc", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252248, "uuid": "66a757e0-2b7a-4d08-962f-cea3c178f35f", "value": "3072:Nx45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:X4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252248, "uuid": "8c0f92a2-a46b-4049-8b63-2e90a77ccafb", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252248, "uuid": "08b8d92a-9321-40c9-ab95-15082466ea67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252248, "uuid": "93da6390-89eb-4041-8b29-d78eabbdc0b8", "value": "dd165437_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "203ca416-ada5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620221028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221028, "uuid": "95119612-43db-4ae8-b10c-a5c47f68da25", "comment": "Malware payload (Quakbot)", "value": "0031b6b380045ba014bb3c32f6ec7877", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221028, "uuid": "acf5ac07-5f7b-43f2-bdce-66241b1643e4", "comment": "Malware payload (Quakbot)", "value": "4a14a8b28709afd3003beb39044bbbfde5bdffdd1f9b24f836dbaa1d73ab617f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221028, "uuid": "b896722c-a514-4c6b-a16d-8b1fd2135bd0", "comment": "Malware payload (Quakbot)", "value": "d9d2db0c1b2991ea1b86d7f4a9298f07bda0f04a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221028, "uuid": "a2540f9c-9693-43a3-bc79-900c166f7b52", "comment": "Malware payload (Quakbot)", "value": "8c3ca530c4e91a88a4f7568ac8c587f6c4f6500d41801d1a538cfc3cfcfb9766d7d3630c68a1070c2d7b69d46dcdc5e1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221028, "uuid": "2d38adab-028a-4ae0-a28d-b5240beffa3d", "value": "84A4AF6CEB62D977E1182FF492C35F940B53E9D17560660E42B01F2E3D993E53C3AA88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221028, "uuid": "9500040e-e375-4dd1-add0-b309d3e9168e", "value": "bb6c5cd9afdd44aa768f3e91032660d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221028, "uuid": "efc431aa-3ba6-434e-bf4a-c1cfeb181adf", "value": "6144:K4kYHG/5aWHq/Ca6VbrdRNNcjuQ/9zoaV3Eegof:KTHq/CjtN6juS9zoadEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620221028, "uuid": "d5eb2539-f9cd-46ab-b237-0c01c1e2b5d0", "value": 492499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620221028, "uuid": "a30f38e1-34bd-46d8-9fbb-2c6ba2797616", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221028, "uuid": "fbe89055-ca16-4616-91f7-93ad7a0d6f8b", "value": "0031b6b380045ba014bb3c32f6ec7877.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da93ecfd-adb2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620226924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226924, "uuid": "60c199a9-d3af-4410-91fb-b3d740d8a8ae", "comment": "Malware payload (Dridex)", "value": "3256535b2a2a1835bb3dbcc322690222", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226924, "uuid": "178f51c6-5b75-419a-9a3c-8dee29a1ca76", "comment": "Malware payload (Dridex)", "value": "4a2582f90d6a3358cb12c0854606ef4e27bc903c4a51a6b927537b28f7c14547", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226924, "uuid": "a302cfd0-a1f9-4892-8a7c-fb1612d25546", "comment": "Malware payload (Dridex)", "value": "893d08493d99df7c919844fb3d74d6a611cd604d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226924, "uuid": "984e216c-7ccd-4b05-94d3-b41e92309b65", "comment": "Malware payload (Dridex)", "value": "de451c73edfb6b369fd3d8ef582e3b01524a48302409100900f6af24bcf0787ac62404a20bdcdea99509e7b2197eccb0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226924, "uuid": "07215641-32d1-4b82-a551-bbaf9dbd624f", "value": "95F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226924, "uuid": "03012263-0538-4a31-be64-254a9e715f96", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226924, "uuid": "6e0772bd-ac9a-4d42-8ad5-f52b92d7b7d2", "value": "3072:ylpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:ylo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620226924, "uuid": "1ef3c9bd-0d1c-4cbf-b7f7-335dd3b1b46c", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620226924, "uuid": "1c25e363-69ca-49ab-a3ce-2659c18c4589", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226924, "uuid": "04cd7afb-7f8b-4ce9-8505-6f47330ee500", "value": "3256535b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f6147f-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209126, "uuid": "6e736240-c086-4806-b89b-c1cc4098f74a", "comment": "Malware payload", "value": "04df14b98b44c478a9f5931f2d4b52e8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209126, "uuid": "241d8517-9e2b-4392-8006-5a359e2f0463", "comment": "Malware payload", "value": "4a2e98cfa8460230649d71d26eb1971efaa3e7b4c9e21ad9f92224e93bc49543", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209126, "uuid": "73fd439c-a9e2-4db3-9317-fc8be3becc92", "comment": "Malware payload", "value": "afe526e249d5b5c8db2ebb1cd04b08ace80f091d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209126, "uuid": "f9a65d2d-22d1-4dbe-9ebc-6ca3f37d0d38", "comment": "Malware payload", "value": "a1e7bef80e08e1490d88184afdda07bc4e0243d0e8c176b50ff303ae71c04b8f538f8b4e1a8d15d8a855d0162bbced39", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209126, "uuid": "b69f3771-1c81-4486-b637-9fe2ebc51ab6", "value": "6315BE3944F4D609DEBE977136670361DC23B4C36728620AEA4CBD891171E6BFB24EB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209126, "uuid": "ea812d73-ef43-4fa6-b340-dcd631524b0e", "value": "eecc691f49c7d6b3c27b4d9b3cc458f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209126, "uuid": "3f4ceb78-9340-4867-bcb7-0f0be94cf87f", "value": "24576:7STCUsmv2rM7cKrFiZOxUcsasRF8S323BmQfTHfsJD:7STzsmerMwKr8ZKsaOifHfsJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209126, "uuid": "80eb3db0-266a-444f-b978-e86f54a3d329", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209126, "uuid": "3f7866ea-91ce-4673-a019-ab742a4ac05a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209126, "uuid": "74adaf5d-2dad-4855-b58c-59719462baaf", "value": "04df14b9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5d338a4-adc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234245, "uuid": "8126a536-bb0f-49de-b466-7b79025729fc", "comment": "Malware payload (Dridex)", "value": "b4396eaa6e71896fd5bff7432929dd4a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234245, "uuid": "bbec85f2-5608-4219-87bc-6a84bb16fe1c", "comment": "Malware payload (Dridex)", "value": "4a30ee465aa85b851d9ebcaf3c5d326a5063c26b9e6b012a5e0c7d51092c3793", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234245, "uuid": "0aab4e90-1023-4c8a-b5f4-750cc814e208", "comment": "Malware payload (Dridex)", "value": "1d713deed805090b0b77037eb06c5b8567f5be52", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234245, "uuid": "93e9a8d5-3344-4191-b877-7d8a4e5e969f", "comment": "Malware payload (Dridex)", "value": "c10d9c47954b351ad904342a7751c288c34a88cabbaae647de540c55bcaef031f57d94c370e7086ea9477cbdad5fc47b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234245, "uuid": "ed054c27-a7ab-4051-bcb0-ac18bc9837cf", "value": "F5F3C085DBABE87FC44A35399472DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234245, "uuid": "e900323b-cef8-42d6-87bf-76a8ff10c6ea", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234245, "uuid": "080f820a-0d17-4489-b467-855f081ff864", "value": "3072:Xt45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:d4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234245, "uuid": "e94e946f-ae14-4fc8-9d2f-45efe6c13dc3", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234245, "uuid": "f84ef790-9efb-4933-8ec2-6b8a13667741", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234245, "uuid": "b4852ca7-4785-45ea-83c9-160b62a837a8", "value": "b4396eaa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe499cb-addc-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620245026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620245026, "uuid": "527a0707-f695-4fc8-89f2-61a97b04aae5", "comment": "Malware payload", "value": "b7b897fee80679b0662234aac0502caa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620245026, "uuid": "6f7dbf2f-745c-422e-99da-b0912103c24c", "comment": "Malware payload", "value": "4a54164063d2d2b3681153e29c943669f79b0d4a7b0bb30d2dffa97c92a57f74", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620245026, "uuid": "5e3b7e8d-1bb0-4d6f-96f0-796ae55bbf03", "comment": "Malware payload", "value": "d23f851ab6826b8022474956b880eef45b01407d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620245026, "uuid": "32830c8b-be30-4d09-8d41-e3c891378204", "comment": "Malware payload", "value": "9b06863bfc5e6bdc7a0c80303aa7ac335987802c52641f587375f2a4cb27ec85653cc6fc35492d4bd933db396064299e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620245026, "uuid": "740dba3a-5568-4acc-ba4e-13e2df175cfe", "value": "1AF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620245026, "uuid": "a07b0436-eb84-4304-8dce-630f64f2cdf6", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620245026, "uuid": "bdebc04f-432b-4167-8c0f-cc3934088246", "value": "3072:diFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:meAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620245026, "uuid": "5723fdf1-e93f-4552-95b9-904278ccd81c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620245026, "uuid": "e86d0dee-169a-498a-8455-fc6f033c180f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620245026, "uuid": "b4a928c2-1534-4942-934b-e273be1da602", "value": "b7b897fe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fb18e90-adbb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620230503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230503, "uuid": "ac694b2d-1b0e-4a56-a166-517fef61ee53", "comment": "Malware payload (Dridex)", "value": "3134e631347b403bcd913bf0752a7637", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230503, "uuid": "6bdaf0dc-e001-4af9-b80e-8d71b4a36ce5", "comment": "Malware payload (Dridex)", "value": "4a668a5428ec2a4d21cff38629ea5a199d17edad66451565a38f35d12325aa6c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230503, "uuid": "428fdd5c-62e8-4461-9ea6-fcd506d402d8", "comment": "Malware payload (Dridex)", "value": "7a1588b2dcbccb576b1259fede78bf8263943741", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230503, "uuid": "bd54f894-f680-4b86-9b3f-8f3ebc43d58b", "comment": "Malware payload (Dridex)", "value": "b5950e1d1cf14046eeee594909528de05f0be4c0ad402720a067b9ac594b83f1dd89f4d31b8ac44ce5ca6318e7c70037", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230503, "uuid": "148aebfb-20b7-4159-921d-7ddfd25cbdc5", "value": "AFF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230503, "uuid": "1977e033-a1ca-43e5-8c7f-3f99d70d8cac", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230503, "uuid": "5b4e3c5a-67b7-4ec9-973b-7ffd49d58239", "value": "3072:AA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:A3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620230503, "uuid": "ecb9c792-c433-442c-918b-194b1a9d4724", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620230503, "uuid": "60f542d1-9c7d-4eac-9c43-dc523253f935", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230503, "uuid": "51fe974b-a75e-4dff-b882-0cff883b5dc5", "value": "3134e631_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "783103cd-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201848, "uuid": "40bcb3f1-0e51-41f9-aa32-7bbd10ffb5a7", "comment": "Malware payload", "value": "6e955ae5337345352f1c6eeba13a34b3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201848, "uuid": "91ae21f7-9d07-4cf2-ac37-bb24f298de82", "comment": "Malware payload", "value": "4a77d5a691891ac9c479a99940b6b2ec86ab3ab0d411b868716a93f548782d9c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201848, "uuid": "4dfcf665-fa24-47f1-9425-d264c0bd8f99", "comment": "Malware payload", "value": "10899021e535a056c35a4b9fd483d59bd600aa74", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201848, "uuid": "c969947c-1519-4194-ba34-dc064ff073d4", "comment": "Malware payload", "value": "4c2a0d7fdacb4e1ee90444b5befe8e5b7574060f75ec6413be07cec0060aa60e5d214f2bd34d6048226f347c381dcfe5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201848, "uuid": "9531fbc0-3ffb-419f-9bbf-8e4cc005dea5", "value": "B755126F57BA18DACF1DCEFFA9109871C85EDF1036CC40819D5B81A18EA5C6DD8E2A34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201848, "uuid": "01e229d0-fb3b-4180-b786-bbaa1a682c5e", "value": "a72e24b95d7d909c18087c24b4c9060c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201848, "uuid": "e8c3f722-281c-454e-bc46-75e1f2be1ad4", "value": "24576:pWzK5o9A1Bg3Uyr484naFdofoPt4qXRj5kN562J:8WsUyr484naeOXReN562J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201848, "uuid": "6c5afd3c-67a6-4138-b933-432c0cf4b03e", "value": 1337856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201848, "uuid": "5ba5f264-b941-4797-b475-1a4a0ca92628", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201848, "uuid": "d75128e4-e5aa-4365-8e82-a25f09a21f00", "value": "6e955ae5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c4a12c-ad7d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620204096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620204096, "uuid": "054eefc5-38ee-4914-aa82-9f28421adac7", "comment": "Malware payload (AgentTesla)", "value": "f03d3e4da1a819c09af6d5951def4699", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620204096, "uuid": "1c0a13b4-2952-41e6-afe7-9da8cf3bc660", "comment": "Malware payload (AgentTesla)", "value": "4aca8284a28707330988003f732d3c96d8c79961eff90138be412b26e6a31717", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620204096, "uuid": "7e1f405d-0b46-4807-b149-65cd238ab175", "comment": "Malware payload (AgentTesla)", "value": "709413f55814aee5d2dcf7c44906d35eae8dfeed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620204096, "uuid": "c564f0af-7fb5-4d89-99cb-51812fdf390b", "comment": "Malware payload (AgentTesla)", "value": "ea7738d692388d59887d883bd221681329a030e4d1b666cc12f52b9eb23d1c5d73fd0016ad498ee69b3106cff621d478", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620204096, "uuid": "0774bfc6-9821-4ccf-ab68-8caf6909a85b", "value": "AA0501C6F604A064CC29D731123AC9721427BD2EA6B9992C3ECE7D7B3DFB4138521A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620204096, "uuid": "05a06308-2c10-4d73-adbc-856c970165ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620204096, "uuid": "1a415919-49fe-404f-892e-8702c20b6679", "value": "12288:3MEbrpP20Op41zLslzgwZm8tjlBGzlS7MDFwjpiGTjfXIldVweI8SvHV:3dbrpP2Xk/sG06SQCliGPfXIlA98+HV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620204096, "uuid": "7e054a39-6299-45fc-a02d-ce2ff114c931", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620204096, "uuid": "432dde80-0ac0-45a3-be3e-8b5f068aa860", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620204096, "uuid": "6d1f2117-dc83-4e82-bda1-cc93e0c29781", "value": "BL INVOICE .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a28870cb-adce-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620238856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238856, "uuid": "581eeb97-1542-43d0-a25e-5fc1e0a52b15", "comment": "Malware payload (AgentTesla)", "value": "10eb8904402a85e510748c036e3a9a96", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238856, "uuid": "29194715-303b-49b9-93d7-5cdb87da94a8", "comment": "Malware payload (AgentTesla)", "value": "4ae09441287bb601114041d8eec7857f10882dfcb48639c155d9a6969da9c5f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238856, "uuid": "83dcc434-57fb-4210-ae20-4798c8c8d7f5", "comment": "Malware payload (AgentTesla)", "value": "ae6da8c8f5caa1e4b028e7f65dd9b3b1e9e0b175", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238856, "uuid": "cff8957e-3567-46aa-a84f-a2a1a06781c0", "comment": "Malware payload (AgentTesla)", "value": "40b8492d1a2918f8cb0d83219a310159ead655b54b190d2a5c45d941430802955be0d9cfd27a3183bff0c3029f005be1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238856, "uuid": "b841360a-7c90-4eed-bc8a-03e5aabc91c8", "value": "75F46CAC751469F0D35B5D6263CF0C0783651274A93BEA0A8F6013FA1A67F173E3998E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238856, "uuid": "bf2266f7-0150-4e89-9324-04a727040ece", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238856, "uuid": "faf28b84-282e-4d5f-b4b4-df1fb4ed7871", "value": "12288:LXooLLoS60/K7yh0Rm3EcA4YXZMiP0KZssX1f7ofpb/:LooLARm3EcA4pi8KXzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620238856, "uuid": "c6b5bdf5-169c-45db-9790-168dc3a0e511", "value": 754176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620238856, "uuid": "25fd1321-8dc4-4927-8932-ef944cc073da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238856, "uuid": "08e6029f-9b25-4f01-912d-8b56697aad4f", "value": "Factura comercial.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8551677-ad80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205473, "uuid": "714e8673-4309-4541-abe8-3c050b75f574", "comment": "Malware payload", "value": "70aaccf24961e6002fdbe6de7a356ceb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205473, "uuid": "ecb7943f-193d-40cd-880e-56ca11a90dd9", "comment": "Malware payload", "value": "4b1b5c9701099601062f1fadc81992eb6c61a6c864a29c6c68be8fd927ef32cb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205473, "uuid": "90251af0-31cb-4997-b17b-cf9b0c673a7e", "comment": "Malware payload", "value": "c11e1d62e5e2e418f285fea5171a63fbe2e00e27", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205473, "uuid": "61ca159b-15e0-42e1-a65f-89780d30fc05", "comment": "Malware payload", "value": "23a66a613505512c45f08655b107a69fee507748c7119d129d33d264c31fdc7fb2d75cc30b5ab402bd67ee85a974a581", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205473, "uuid": "57173489-ae26-4d32-be96-02afbb4057ee", "value": "6B75026B4A507BBAD2E069F1B4C3A48E0628C16DF7F9C50511BD3A819BA3FF7119B0C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205473, "uuid": "f01afe59-c16f-4cb7-ad56-54086447b5a2", "value": "6626ce66d94d28a10d7cb425f091cacd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205473, "uuid": "2ff8202f-9502-4261-a4c4-56019574fe7f", "value": "49152:27diRu75oa2Qjyh4TxBzXeWcR86k1bjyZ:2IuoNQWF86k1bW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205473, "uuid": "1d1f82ed-f428-4da0-8ac5-b0dd417ac694", "value": 1595904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205473, "uuid": "a00489a9-2741-4c14-9d9f-3a49fa730e96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205473, "uuid": "66ed9f8a-5680-45c7-8fbb-2def856698b5", "value": "70aaccf2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86123b03-ad65-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620193711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620193711, "uuid": "fdf581f8-5ac3-43e8-b745-68a46e8af03f", "comment": "Malware payload", "value": "33a86125d4bdf907ee70c75be2b99f9d", "object_relation": "md5", "Tag": [ { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620193711, "uuid": "a76a7e16-128a-4ed0-b0b1-712619cac067", "comment": "Malware payload", "value": "4b2b38ac21633e5df154ad4cb368f77db88a245edc825cac374193120ad8416d", "object_relation": "sha256", "Tag": [ { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620193711, "uuid": "62b12829-39d1-4920-9fbe-11e07e08dc74", "comment": "Malware payload", "value": "70d098c0f7b7a6e21d6584e28c6948da65e34b0e", "object_relation": "sha1", "Tag": [ { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620193711, "uuid": "7d195cca-05b4-47a2-a70a-50039d8751c7", "comment": "Malware payload", "value": "7f8615fcc28bbbf9d3c11a50e311d348719ac3a6e722d27ffae0c584683d5f1fe9d0c850467a6b188b8433eb2b931c9b", "object_relation": "sha3-384", "Tag": [ { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620193711, "uuid": "4a8de2e7-0dd1-49ce-9177-9213e2695e11", "value": "F0256A01B7944696ED8E2775E0BB193153A2AD95A97AE70E194BFBB13FB33C140039C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620193711, "uuid": "9a989213-7d96-4263-9c05-29d6cce4bbd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620193711, "uuid": "d5d28170-8127-4857-bbe3-2ae516ef6069", "value": "12288:C1fxhwL8mLAHefRIZtbVqrTwqEZz85p3qINnjrrDgg/H35EvZaGOujF9:OZyJAH/ZtxqEZzSRbfcHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620193711, "uuid": "6238090d-4fb2-4ce6-9c51-4656bb986bb4", "value": 986112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620193711, "uuid": "8d037967-8060-4dd3-a821-2fd363e9d2f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620193711, "uuid": "658a1923-916b-4cea-a42a-16efb50e632e", "value": "S01_1091716697001_31-03-20211.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "523bea02-ad9e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Matiex)", "timestamp": 1620218106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620218106, "uuid": "acbad1aa-4c36-4b91-93a1-a7bbc455d5e0", "comment": "Malware payload (Matiex)", "value": "6c77cfccfafabb57e7c916fe3bf83fef", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620218106, "uuid": "a0b38293-87a1-4f48-971e-6cd9fc82b6e1", "comment": "Malware payload (Matiex)", "value": "4b47e3ff0875f09cc24a778e80a165f790cf7e289fd4d2397e649b925852ae3e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620218106, "uuid": "a0653892-5c38-404e-920b-b20558b1f6ba", "comment": "Malware payload (Matiex)", "value": "33502b3866e7297dcde4a7c76ab1635e1ddc5818", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620218106, "uuid": "933f67a9-a796-4fc5-8eb6-5807c9d9e555", "comment": "Malware payload (Matiex)", "value": "c10498b25441cb593c92ae2d2a420afeb10face8c01bb03d2b2365d0ecc79a79588be489b459260be095763bef896d93", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620218106, "uuid": "39b834db-6f03-495d-a31a-16e007d5b68a", "value": "61E43302A207D1139C1E5A7F716A61EA26C0655BE18012D74CB96F0F3D4EDA3FB8C67B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620218106, "uuid": "93889b36-7a6e-4cdc-a4b9-4c948f5cff47", "value": "12288:lLhgl/m6LtF2VYaVU/yqvLJXP+4vjb7Isoj4eEGIz+eKak88nT:hhglu6Lzl2xqZPBfhneA+eKRpT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620218106, "uuid": "aed299dd-7c12-4988-ada9-5d4db1d7e6dd", "value": 664923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620218106, "uuid": "b84033fc-f95a-43bd-a0eb-74127e44df68", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620218106, "uuid": "af5c42ec-8fe4-4a5a-ab8a-7f84f90061c5", "value": "PI.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27deb2e5-ad63-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620192694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192694, "uuid": "0ecc5408-12cb-4fa9-bdd7-025c97f0f56c", "comment": "Malware payload (AgentTesla)", "value": "b4563d3be50c385f1761b0786b607520", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192694, "uuid": "eff007d0-f3d6-450d-b3dd-15d230b5dced", "comment": "Malware payload (AgentTesla)", "value": "4b58992b26f47023772b4651fb523236b890894ac1fbafa7832ce0937b5fcfb0", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192694, "uuid": "2c6f30b5-4030-4d80-8e5b-8ac7b2f154c0", "comment": "Malware payload (AgentTesla)", "value": "dc037564a147baf45a862dc594da01460cfbac9c", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192694, "uuid": "a69683a6-4b87-4ac3-98e4-f126855f9326", "comment": "Malware payload (AgentTesla)", "value": "3f953adc3996a161015d24f53f3ef9683b877ccf0c22dfec15050cacea18b57c77a4c116d11a8e2ce4f93ebc171f01a1", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192694, "uuid": "a471a7f1-a708-4ccf-a637-bb7cadc32028", "value": "BA84238F07788BD5399FBF1C61E81A96CE22BCF52257761F44E680EDDB29A7004541F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192694, "uuid": "255533d2-ed8b-44fd-a789-ee66c05aa4fd", "value": "12288:Jn5ZrTNBsONpXZJwPNzLlDBCtB1CXZWBrwI:rqGpXZaVzLlDBCtB1QZCwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620192694, "uuid": "50e467bb-62f4-499b-889d-646781703ff7", "value": 393813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620192694, "uuid": "b7321132-cc3b-47ce-859e-d5e8aaba0037", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192694, "uuid": "ba6af12e-fbeb-40ac-892a-982cc7806365", "value": "Consignment Details_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b19a9b11-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201945, "uuid": "ac29bc1f-028c-465e-9186-4d3b637e29de", "comment": "Malware payload", "value": "c0ad70f9c2b3620dd629c84220f06181", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201945, "uuid": "3513fadc-0584-4a5c-a1da-41535b648d3c", "comment": "Malware payload", "value": "4b9afe0a9750dec2d7dc5191281107337cfd58514cc45c794f00827db79df003", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201945, "uuid": "4507e582-5548-47f1-a472-6df6ed69e8c0", "comment": "Malware payload", "value": "74459e1ef6e7b892ac1a68a222e36263ebcd01db", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201945, "uuid": "6c4371ed-afc3-4654-9d57-0fce4bc5ca13", "comment": "Malware payload", "value": "c6aafc236426c3086dce030a257c4bc07c783c0abe881783a99e1e2cc86e53294f109c1566db93a52b08f37b169511af", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201945, "uuid": "229065fb-1bbe-4de0-b0c0-889b92893587", "value": "AAD65A01A2E18077E0B76670497796759E72BD211B3582EF6288B75E2FB3BC19D34323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201945, "uuid": "5cf94df2-ca4b-48a9-b2a8-8642e5c696be", "value": "aa87db00eff03dc11398f903a07cd843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201945, "uuid": "952bec72-e7b6-4505-9ad8-e21766a3ec1e", "value": "196608:Ta9+6Y7SOEibgRvGBfWRO+kGBfWJGBfWJGBfWE+3LbsA7PVKdD4j:TFgRUWRlWeWeWE+jhKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201945, "uuid": "4bbfef3e-1be4-4f73-95fd-dd3e19677840", "value": 12943310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201945, "uuid": "60014876-ca08-4c31-9dad-115c35c17750", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201945, "uuid": "aa3c27f1-2992-446e-8b69-03d1fb5b5631", "value": "c0ad70f9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0132ca4-adb2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620226880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226880, "uuid": "0da81c92-fb54-4ea3-ab3c-85fba999474d", "comment": "Malware payload (Dridex)", "value": "63d43377c4d63fbfec4af786712f5d7c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226880, "uuid": "7ff6d1d2-f836-4589-acc1-7ac4d8b34245", "comment": "Malware payload (Dridex)", "value": "4bb3c87913fb6f49860762a3e4cc7d8c05e37e2c16c64a964168ce00bfb2ac0f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226880, "uuid": "5c708767-bbe9-40ae-83a7-b07f62471e9b", "comment": "Malware payload (Dridex)", "value": "accd55e7bcee97212fd3cedc50a0aff88f0e1edd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226880, "uuid": "4e429c72-d4d9-480e-95dc-37d420d649fd", "comment": "Malware payload (Dridex)", "value": "80ea4f2bb7ab3b33aab8708c23f4e5a7bb2180f480c2784700a328d1453ec4016aaef5efad725e81ebc152ed28c2fae3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226880, "uuid": "e6c381f0-13e6-4954-8054-6c6f3852a808", "value": "DDF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226880, "uuid": "3274f5c0-aa4e-4a88-a3a2-2335c610c4b3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226880, "uuid": "71b8f3dd-33eb-44f4-bd5d-ff2e7949542f", "value": "3072:hIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Kc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620226880, "uuid": "e3a1bdf1-4879-4fc8-9381-e6763f5d49d4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620226880, "uuid": "bd0e10c6-7801-4c73-9f10-67c06a323e1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226880, "uuid": "c9be1879-ba55-41ba-bc11-f2b560c4e90f", "value": "63d43377_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77148dc9-ad47-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620180801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180801, "uuid": "4947263a-70e2-4899-8711-21e1bff63698", "comment": "Malware payload", "value": "03da1723f12c760c9a4b0486b0b50066", "object_relation": "md5", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180801, "uuid": "26d29ab1-b3af-4cd8-a069-be29b49409e8", "comment": "Malware payload", "value": "4bcfcf7e0d099e83409fd43c93599090621c46a4dbdb5eefb107f629a25cd757", "object_relation": "sha256", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180801, "uuid": "aad7fc66-f48e-44d2-a55a-179b941c7ab9", "comment": "Malware payload", "value": "0c534a68a767c4bbc8eef4b8e56c4450344dfbb6", "object_relation": "sha1", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180801, "uuid": "ad536307-3cea-4736-a03f-fd9181642c2c", "comment": "Malware payload", "value": "cf0d8287e1bc6007d9576d29e4b0e515a9d726818d7385bf1f593109b7e214a32c125f2b4ba8dfc8a2d574cc31b1038a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620180801, "uuid": "af126c94-db77-4655-8772-ea5fb736e474", "value": "B2B36889878AC8D7D5B33DF42487B4A20AA2DC7C51D3B5D572DBFE6D283219108CDB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620180801, "uuid": "d93e6828-3fab-4d3c-ab78-9886809c9e29", "value": "5932b570a5feb5cbea054f78d4403601", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620180801, "uuid": "fc127bdd-0cdc-42f2-ae28-eb32caabf2fc", "value": "1536:6M+3ltHxr1P5zdOjApjVSyzK/gYiNHMq9l4+O8iHUDHzzJmhWZ+uJrQh0HTxp:6M+Ckpj6/wH1/zb0hVHuz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620180801, "uuid": "6d7e3882-4f29-4508-8ee6-70a6f26806b5", "value": 114146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620180801, "uuid": "f2966e53-3e3e-43a6-baa9-e4b572e90838", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620180801, "uuid": "0f5a70c5-17e8-4a48-9c35-1b4eb4dad998", "value": "4bcfcf7e0d099e83409fd43c93599090621c46a4dbdb5eefb107f629a25cd757.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac69dbc-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620202041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202041, "uuid": "5d9cd0c9-f024-4ee2-a2c6-761d838eded8", "comment": "Malware payload", "value": "399a5bb2c92b73c1bdabb0307ca24ee5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202041, "uuid": "80bef8cb-e57a-40e3-a1c5-6675f42799f8", "comment": "Malware payload", "value": "4bd8ca7a186343d59945c7258608115dceecb2da70ee94391774ff5f3f6e189f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202041, "uuid": "03595e44-2e71-47b7-b680-8e5f933a24f8", "comment": "Malware payload", "value": "3ee0dc50a5b1ada2d90b6a96776934d91758491c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202041, "uuid": "f941078e-d4a1-4361-afd0-94edd9e5c657", "comment": "Malware payload", "value": "de21bce348a647c233be3435410bb9b29ac08b16807eaeef4c67b162e37fb5525b3a75898033fa4554c0eaa796e1dc76", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202041, "uuid": "8d09b35b-0e46-4e94-bf43-1e08d9b11b59", "value": "1AF4AD39AE6D9531EBA57CB5AA441FF51E2B2B084A439D30E9B41B1C7DF3DE0909432C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202041, "uuid": "23bae110-8f75-4962-94d4-65dfd0f7fb09", "value": "ab0fdaa59083cf06bab8d15e715a6a21", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202041, "uuid": "e8c06f0e-0a84-41b5-b301-1590f92f68fb", "value": "12288:E6EIUoxsRVJj0Bv9QYcwhzbVA1RSgkIUNKqI2qMlAT1uKTm:cgxsOBvaYfURSQUNKq1RliTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620202041, "uuid": "08e87e12-4909-4be9-b793-e4a18e5f9230", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620202041, "uuid": "c6080129-dca9-474c-8c91-1cd77de42e07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202041, "uuid": "196230bd-ac4e-48cf-a3ef-5a1735760d5c", "value": "399a5bb2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8881f58c-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241819, "uuid": "dc137999-449a-488b-919b-a2d08427888f", "comment": "Malware payload (Dridex)", "value": "07f77e9fd2099d8a46af09479fe418d0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241819, "uuid": "a0c63bce-bc58-42c5-85dc-d5a05cab02de", "comment": "Malware payload (Dridex)", "value": "4bf278b58ea0bf435ed4f1896b27a10b66122f6dd648496ac0fd3e52ede9a7cb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241819, "uuid": "9f3d0216-bda5-4f71-839e-85ad2d40cf38", "comment": "Malware payload (Dridex)", "value": "a283bf26623e6354730dba09cd7667d7e5989aa8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241819, "uuid": "115c2733-7b72-48b2-bcb7-0d66334ad555", "comment": "Malware payload (Dridex)", "value": "965ed24f4fd2dc25df5e5c85a05b0516a96a4edd186a9624bacf88ad8675dd44c5b10d4dcc576beba1c8d55a680660f4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241819, "uuid": "c1844992-7725-4ca3-a127-f8ebf3455550", "value": "C4F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241819, "uuid": "273ea3ae-eb5c-4423-a76f-2971e1ff23ce", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241819, "uuid": "33881f82-49c1-4b48-839e-0e684aec8aaf", "value": "3072:fQ45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:I4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241819, "uuid": "8e17f7c8-c7b7-4941-ae5f-8db30142837f", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241819, "uuid": "956431fc-e791-4b2d-a24b-80dade549503", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241819, "uuid": "3799d238-095c-4bf8-b8ae-7a754363b748", "value": "07f77e9f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ae96d0-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209124, "uuid": "7f97809f-165f-40f4-a4dc-9a29a6a17a9b", "comment": "Malware payload", "value": "4d4a900ab1b17a2c9d8672c642c5c06d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209124, "uuid": "e0e03f58-ffd7-478c-9e21-3d90c1931d38", "comment": "Malware payload", "value": "4c35c4b654e54ddfa21e8c1d0b5aaa8cabbe829b4c5742089c8b6f69fed21fb3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209124, "uuid": "45b569b8-72dd-4641-9402-24e4de6ddd26", "comment": "Malware payload", "value": "65e0a7faa9dd5c155f606055adc4664bf78c7d89", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209124, "uuid": "9c0e6c03-8901-45b0-8824-b5fc1ed1582c", "comment": "Malware payload", "value": "d8fe9614fa310df89867e2d5d15a26746ec2bb1d3d81e401ab248e238a8959b960ff30bbab1f6b0012a05cceb8acf03b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209124, "uuid": "14477a74-9213-4313-9377-5a0bf1484529", "value": "8BF4E0B51FCB6446E83BA17124FDA7133742B14E22991DBA1A59ED63C22C11F0B7B43E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209124, "uuid": "d4892a9f-99f0-4dc1-aa02-70762f934932", "value": "446cf1c3545e162a924d17299d624b03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209124, "uuid": "c7a22418-8791-4c26-aa15-98e22098c145", "value": "12288:gCJUYM3txV3N0iUUVdxwh5Entvl61rxnohqBfypNPly58RWfBjfQqrM26Ovoi74/:gKsN0iZfkitdkr41lfgfBjoqrMco5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209124, "uuid": "3e65ba42-2951-45ce-9768-23ccdf077568", "value": 723456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209124, "uuid": "a913d750-2177-4533-93e6-5d9f6bf1f428", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209124, "uuid": "1e860067-71e7-422f-b9e5-a53142f24181", "value": "4d4a900a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab9bbaa6-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209236, "uuid": "4fb9f106-9fa2-41e6-ad9b-b881c9bbb210", "comment": "Malware payload", "value": "5afbcde59ae65310c09a144383811b35", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209236, "uuid": "f9c412e5-ffff-46b6-9db5-36580f264edd", "comment": "Malware payload", "value": "4c59ff29b64dd8ed999cdbb856a11d428ffa2ef98dbe5493554c6955a083d20f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209236, "uuid": "95b5921f-9adf-4cb4-8f52-fc6ae21bc5d2", "comment": "Malware payload", "value": "b41b733ad9582946a4d53d88232fa609ac3ada3d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209236, "uuid": "47de034d-52c4-4fcb-bf24-f1f4084d9d85", "comment": "Malware payload", "value": "d8bfaab363c8d61e886b0abd6cc96d1894d68bf02f8d31a04a38696319da366f17f22f7b71d2d840ed4907b573413df9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209236, "uuid": "5af9ca70-0371-4b6f-9ac7-abc3f45181b9", "value": "460321369EC515F6D67396B7F4F696C2F922B9663522490E108B3F4109F3B82BC91C0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209236, "uuid": "468909ab-cdec-4de2-afff-a1a3023f6c6f", "value": "db206e36db5c9492ce02c61a679129e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209236, "uuid": "49fd6910-fc93-40dd-ac36-3e51bd0d1f76", "value": "768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGpebVIYLHA3bcd:o1KhxqwtdgI2MyzNORQtOflIwoHNV2Xk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209236, "uuid": "8a683ccd-5c92-4cb4-81e0-95082bd7ceb5", "value": 38776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209236, "uuid": "d82737f2-e1f7-4d80-9640-6825e1705bec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209236, "uuid": "268c23b8-abfa-49e0-98f1-f60cae85c036", "value": "5afbcde5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d85fea-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252409, "uuid": "8c05a7ac-c693-4c33-a849-8a6c20d50324", "comment": "Malware payload", "value": "ce1d921451c21c19077ab6535e8c081e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252409, "uuid": "669dcea0-2fe9-4f9d-9053-6e14fa86e8a4", "comment": "Malware payload", "value": "4c7c88e1c985612b4b64efc248052770bb42da2a21fe700b8ac353d4b977230c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252409, "uuid": "69c2252f-74de-4344-96e6-673f13bbf291", "comment": "Malware payload", "value": "3a5ebc6730dbd5effaca12e1febb891daaeaa249", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252409, "uuid": "db1fc681-8d09-4bab-8def-d68980df9874", "comment": "Malware payload", "value": "fd7ff92f06af4ee2b7d98b91f104acd438633f936c9d271e8229f662c0493fb3bd4688ec38f9a7fcb5898f1c00d01683", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252409, "uuid": "50c55a6e-a335-4c9e-bae2-62ca81d5ab7a", "value": "07F3C085DBABE8BFC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252409, "uuid": "1df64ccc-c625-49ff-9a40-23b8cb29344f", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252409, "uuid": "e13ab9bb-4cba-4502-ac3e-b31a2bdda166", "value": "3072:LB845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:e4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252409, "uuid": "a4e5b014-d5c2-4ff8-838c-f05a5d40a595", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252409, "uuid": "6abefddf-967e-4d14-9afe-66341c9b1a2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252409, "uuid": "4ead7ec4-8a35-49f3-bd83-c4eb1b6697e7", "value": "ce1d9214_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b1d1cbc-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252104, "uuid": "d278dded-7674-4f50-8cc7-6289e3e5044e", "comment": "Malware payload", "value": "9a0e3ec3069e32f3ae3615fbd86f7a7b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252104, "uuid": "b32c4f91-299b-4c2b-9e27-97802c9660a2", "comment": "Malware payload", "value": "4c7cb267c88218551c1278bccefca612eff744972c974edaf25532c3de88b3b1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252104, "uuid": "044ffc60-10a3-42e8-81b5-e11ec528efdf", "comment": "Malware payload", "value": "94cb432038a08350fd2dc5b6defda656c6f38204", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252104, "uuid": "696474ba-dfbb-463e-8463-4dfa143147ea", "comment": "Malware payload", "value": "6f19c2ae2ba57fa4f71eed70d8b022e62e16613c8fdeb4861452e8d3801c5fd8a63d69ba67d0af40c2d3153b7c9bc5cb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252104, "uuid": "59efd6ad-d5b0-43f0-91f9-201b9bd54222", "value": "C5F3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252104, "uuid": "711f53ee-97bc-4ecc-a4d1-38a710bcba4e", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252104, "uuid": "399686c1-be17-45bf-a28a-05ce550ce290", "value": "3072:zf4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:cDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252104, "uuid": "780ebd7a-68e6-47a9-8545-8b7480c443ab", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252104, "uuid": "f0b642f7-bd6f-4340-abce-b134ff150cef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252104, "uuid": "92898264-d5ed-43f6-a6dd-3dcb1c58f4cb", "value": "9a0e3ec3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c92ced89-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201984, "uuid": "4b3188fb-2e0a-47c6-9244-3f60a82702f5", "comment": "Malware payload", "value": "6c928d29b3e39a0dac917a24f8c36b50", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201984, "uuid": "d05cd2f7-def5-496f-8f73-6fb12ce5df9e", "comment": "Malware payload", "value": "4ca65a7dc9bc7f08920b22c81068635a4eaa60cd67b957fd2b03091048b9d3c5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201984, "uuid": "d1268a6e-8a25-43e6-a236-1d378de2d96b", "comment": "Malware payload", "value": "d8d7e55dc89b980a16c773d4f740d897fc93746e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201984, "uuid": "2b8f6544-4ea7-4745-9251-0c2ba7f75241", "comment": "Malware payload", "value": "388c9c82036da0cb5d1e25651a92f46ceb54c5e0dcf0d2a54405dbe4b156dfd16ba854e453ca648850c2af0e5521399b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201984, "uuid": "f8f0b1f2-3af9-4173-af86-a6ac9eb2eabf", "value": "C1F4AEBB59054D67C379117E88A3BB902869045F30B6B2CBA690BFC11EBFB25F44359C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201984, "uuid": "d29d9850-2187-4132-ac13-fee38581b40b", "value": "4d1713b08e882843e3819c75fad63840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201984, "uuid": "b6a08106-3888-430c-a60c-30bd8399c1b6", "value": "12288:hg9sMwWaGqFS/9V0ZH/TPuTR3czR8baJwA/32AD6lu+yDe1yTm:Umc/9V+HLO3AR8bQl6lu+yDe1yTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201984, "uuid": "0f769c39-c8c7-480b-90a9-84cb94d5a45b", "value": 772096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201984, "uuid": "8dc1f237-31aa-4551-a6ec-18d47cb93348", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201984, "uuid": "53746a66-fad5-4f0f-b74d-1ce398c79610", "value": "6c928d29_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893182a2-ad80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205313, "uuid": "77754fa5-fe63-474f-a810-57625f051c54", "comment": "Malware payload", "value": "b22697322542b01715dff490fdf38628", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205313, "uuid": "bfaaef9b-1a93-4a53-9968-e4c8c1f4f0b7", "comment": "Malware payload", "value": "4cad35ca0e47906f8543f734b108f266268fb0a9e5a2fc0c6474933895fdcbb9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205313, "uuid": "4a8fca65-0ac2-4f96-b397-c2527411a887", "comment": "Malware payload", "value": "b7be8ac22f40aa3e0a5fa7c1d883e42fb477d61a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205313, "uuid": "b785b643-3b5b-4525-9279-005acca2046d", "comment": "Malware payload", "value": "e10aaf376c9bd4d8fbba97e9510e45a4c8f59121b2355db9e628d547b80aeacbefce11f82b9ec4509e8a1906c85ca80f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205313, "uuid": "552b93c2-0b85-4d3a-b620-ebcc32f8f491", "value": "5225BEED615FFB51CE2CC97259445CF6E3FAA3935A22342F0DB02FD29E015A6C9184B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205313, "uuid": "1ddca19e-e064-432b-b72a-7f219bcda50a", "value": "1f2450db12c8525e44f4442ee65be8f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205313, "uuid": "e4acdc55-d3c6-49b5-b082-e6ec531e20ca", "value": "24576:xQG1+up1O851MrFeQeUqYbrCpPdemKy0Kv5K:xNDv51M4Q5Bb4Ay06K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205313, "uuid": "e03da47d-73d2-4f0b-a07a-02fe2eb8d6c2", "value": 1042432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205313, "uuid": "6c2a43f8-d862-4669-a46e-fbfdd89f45ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205313, "uuid": "82c2efa2-5cb6-455f-a752-afbb543a8e7a", "value": "b2269732_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76cce351-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241789, "uuid": "6a285465-6595-4e6a-98e3-cd0d4b725353", "comment": "Malware payload (Dridex)", "value": "0cc3f46b610b58370bc127e016089349", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241789, "uuid": "51b8f8bf-3f62-4470-9734-416a3adc9ca0", "comment": "Malware payload (Dridex)", "value": "4cce9cbbb10a8e79905a55a90f6c700809cc94f7e619b16932d580aed2eed33f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241789, "uuid": "1663c6e9-0531-4b2e-8b84-c8c58157b5d1", "comment": "Malware payload (Dridex)", "value": "30ebb9e5568e8ffc467366cd4d2c403ca8cdba7d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241789, "uuid": "7893aea1-1900-4177-85a4-26787947fa6c", "comment": "Malware payload (Dridex)", "value": "1a366afc3028408ca1202b496a7cf3e6c1a317fd6f77790eb5683c79e9e58c029bbe6139d4004c7f6b56507a030d9e16", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241789, "uuid": "ae98fa95-ba93-423e-beee-a3f8aa90e1c6", "value": "DEF3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241789, "uuid": "2bd5413e-b133-497a-997c-1a10677e8977", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241789, "uuid": "fba71f52-57dc-49d7-874b-305eddf53e03", "value": "3072:Wi45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:v4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241789, "uuid": "8c57b644-2c4f-488e-aa61-7947c272302d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241789, "uuid": "2f6a1e9c-8c42-4ee2-9e82-53a0b36bfed7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241789, "uuid": "9caba64a-4c21-40d6-acc2-3985684f9b7d", "value": "0cc3f46b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db672ead-ad80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205451, "uuid": "5810c6b2-79c4-4b2e-b0d2-835d9a39107b", "comment": "Malware payload", "value": "66ea485a7db4dc9dd58a3df7e05aaa20", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205451, "uuid": "f98cffa8-1d5b-4865-9a72-74cf378464c4", "comment": "Malware payload", "value": "4cdd341387f7776e6b44296ef8ac0167538967e9d5285a092f6b302157b4c779", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205451, "uuid": "2a84e673-1e67-493f-9e45-0fcff88c59a3", "comment": "Malware payload", "value": "0eea2b439cf38b2f13bfdd872463076a33a00d79", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205451, "uuid": "826de3d2-519b-4a2a-ad81-40ac808febf3", "comment": "Malware payload", "value": "675901ba99dad3821b13bb9a966b2d386c87eea0ebfed276fc6e097518fa77c40390041c9e8427ea829eda4a39d6a86e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205451, "uuid": "b8fd67ba-cbd9-45cf-8192-d47a5bba7de8", "value": "7715BFB204F2B0CEE5BF483C626376E62F512476A322C60DBB56055FE67CF50AA7152C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205451, "uuid": "4760a2b4-fc68-4081-a9bf-0575cb8a6db4", "value": "63afe889b7563f11bedf107f2ea54d24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205451, "uuid": "2f86c44f-cdbd-40ac-8bca-e3697dd96458", "value": "24576:UDWjiagHEJk7vrhOohRo9bWHFr4Zep9VDI5+:UWjiagHO+rhGVWHFr4Zep9ZG+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205451, "uuid": "ffce83f3-a960-4c21-89f7-c277809d1c78", "value": 919040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205451, "uuid": "d284f6f5-78a3-4552-bbc5-935316efa2da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205451, "uuid": "02dd4e91-7bea-4563-be68-f0b46634549c", "value": "66ea485a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fe7a15c-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252488, "uuid": "ad51a460-5f72-4e65-b5bb-a097739e9214", "comment": "Malware payload", "value": "003d6e73d52951d80f07a424e631e032", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252488, "uuid": "e798f7c8-970c-4fbf-96f7-4ee0981eb11c", "comment": "Malware payload", "value": "4d5abc630f8636def9c155ed0488998804efb50f68ceacb3b20500973367177f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252488, "uuid": "b023df43-dc1d-4933-a621-4a1ae4482ce0", "comment": "Malware payload", "value": "a1dfedfd6cb02705e6f5f6a0863b9d8d6e8f7ea5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252488, "uuid": "02541398-d9db-408e-aa09-6d9e7a1b29fe", "comment": "Malware payload", "value": "2c9226dc7457d6987d2b604d54a6321bf2e8ee39d72918e56221bdb43bcd1d472325de67ae9cf0682746650d5bf0418e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252488, "uuid": "22e06c2b-77d5-42e5-a6a1-4ba889a32bfc", "value": "D6F3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252488, "uuid": "81a6399f-6f9e-4812-84e1-f1e7d5128561", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252488, "uuid": "00b5df87-29bd-4590-a3f5-f261fa0ad8bb", "value": "3072:kR4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:pDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252488, "uuid": "2c7a5ca1-d34b-4d8b-8527-717f6d3fb3c3", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252488, "uuid": "837410f9-ccf9-4dce-85f5-04b818b4a1b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252488, "uuid": "394fd486-04c9-4abb-93e7-4192adf1d76a", "value": "003d6e73_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06f1504-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252704, "uuid": "db0d3fb7-19c5-4e17-941d-f14de5fadfc1", "comment": "Malware payload", "value": "55bd7015a388a96265f2afda29b99fe1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252704, "uuid": "34e176ba-c052-406f-b6da-e2521d8ad0ae", "comment": "Malware payload", "value": "4d7b97cd89927baae96fcdd320689430dce4aa9fb630cac1b1477d6b753b5023", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252704, "uuid": "ced9f03b-5282-47cc-89b4-732d18bc35fa", "comment": "Malware payload", "value": "002fdb7e79ae6d2b1f0f9cb5b2fd8ac98ec9b24f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252704, "uuid": "60efe573-c8f7-456c-955f-2494d5c58af2", "comment": "Malware payload", "value": "52e60dfbb79a3db5c3f006c2d0a750286dc1575acb787acddaedb1773025cb2a9908a0f6f3fc1292e8ee87e60aaa18c8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252704, "uuid": "81bc5f5d-418a-4fad-bc21-c74d8612f956", "value": "6BF3C085DBABE87FC44A35399472DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252704, "uuid": "1830c24b-0d6d-48bb-a714-99f8e0038957", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252704, "uuid": "20e6cffc-ebcb-4922-a5e5-37de7f774297", "value": "3072:WL45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:K4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252704, "uuid": "bee8d4d3-a583-4b9d-ac40-b1b84d07138f", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252704, "uuid": "4c538937-bb4f-48ee-9bab-c959caf258e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252704, "uuid": "0b0ea37c-beac-4aa5-aeaf-ec0968ef7bea", "value": "55bd7015_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5cadabb-addc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620244955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244955, "uuid": "cca938c0-8b0f-4316-9561-4b23fcc232ec", "comment": "Malware payload (Dridex)", "value": "f622b70da0fc7c61ddd15fafb9bde216", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244955, "uuid": "990f6fd1-c6b7-4680-aa44-120d77453825", "comment": "Malware payload (Dridex)", "value": "4d9d224432b8fd4784cccd663eec5c205a198e5ce0d6639429a23d3eb00cec24", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244955, "uuid": "1076cd15-5d7c-4ebb-b0d6-e83cd01d9c9e", "comment": "Malware payload (Dridex)", "value": "0433c2fa7d5ef057a2e2c7994ada78ac5a23e139", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244955, "uuid": "ba53d2ee-d8ae-4943-9c2d-a3eafe7ff019", "comment": "Malware payload (Dridex)", "value": "5a626dfd97c8ae8e4fdb989ba8de09a017014250cd8a097b4ff26730ebaa039433dd0f33abe084991934b0de83bd8117", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244955, "uuid": "9ba53f59-0b48-49d3-a937-3cdd9320b021", "value": "3EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244955, "uuid": "75119dc2-a05b-405c-b7b7-a32ff269a826", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244955, "uuid": "258b2918-3e18-41db-95b5-76eccee0241a", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620244955, "uuid": "a4fcb055-a5bd-4aa6-8f24-8e26ab71a448", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620244955, "uuid": "93dd04d4-2697-435a-91cc-b9ff56ff64c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244955, "uuid": "ccb97588-5db3-488a-89ca-4c1fdde1bfdb", "value": "f622b70d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6667adcc-adb3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Stop)", "timestamp": 1620227159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620227159, "uuid": "66944981-db5d-43ab-8cbb-1ec0ea054366", "comment": "Malware payload (Stop)", "value": "33783e52b9ba752622135e94ea7fe8c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620227159, "uuid": "12e4e45a-509c-4c5c-a879-6b8ad59bedbe", "comment": "Malware payload (Stop)", "value": "4db37a46432a8cf387a6ba70d689db2675c3a6f5294fe5ff7db3d785f068671f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620227159, "uuid": "ad3bfe44-dfb6-44ce-8812-eddeb16c5765", "comment": "Malware payload (Stop)", "value": "9614056762cf85993f17020c3e21948b7efdf2c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620227159, "uuid": "b37918b7-40ed-4556-8ee4-dcb65afa01c8", "comment": "Malware payload (Stop)", "value": "794368c08cf3abde0f2e19dbdcf2da184aeb03ca1184c92f132b2d6dae175cd94df75eda2f297429eadda6fda04036a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620227159, "uuid": "79cf1af8-f227-4059-997a-59c527ed49b4", "value": "1505F130B550C039EAF726F849BA83A9713C3EE12B6050CF52D526E95A386F5AF31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620227159, "uuid": "8b0254e8-cdf4-4949-8a77-ae3155eb0703", "value": "eccd8454bdaea67267cc8192a6bb73fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620227159, "uuid": "06149761-9b29-4df5-b641-90602fe8592e", "value": "12288:fgrg1ZZGhCUvltJus05lhr6//PjhjMxKhZ7lWGPXrezhpnFW5xwgwGYKtB+OaiWK:T1/GhCUvda36tjY2ZZfqzhpFWtVpiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620227159, "uuid": "6a860ea7-4f96-4f03-ae01-333cc4c5ec8f", "value": 838144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620227159, "uuid": "64318ec0-4b22-4e6a-955f-c961f00f4ae1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620227159, "uuid": "535d3701-4be7-4110-81f5-7850f6a6d0a1", "value": "33783e52b9ba752622135e94ea7fe8c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "933568c0-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212631, "uuid": "8e0a7149-ea76-413f-8bcb-a730683cc081", "comment": "Malware payload", "value": "3ad8fd739bc653f092b457c26657c571", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212631, "uuid": "d7dac460-18b2-4d52-8515-e8bfe330ff4f", "comment": "Malware payload", "value": "4e130a91bfe492163055ac47a15c048d4f7037213ade249d90df57cd10a6a144", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212631, "uuid": "5a6a8dd5-9e5f-4944-abb7-aeb27d8ad3b0", "comment": "Malware payload", "value": "96a5e53e072694c8f40465de66299b8dec9e5559", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212631, "uuid": "1cd1c539-cfe4-4870-b8bd-643306ffdef0", "comment": "Malware payload", "value": "cf86cb0e6f33cadf95f1e3d187523f5ebdd24ca91d7ad415ebb204ff69655d43c948af1d0cb5329a9a4695a0424ae0bb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212631, "uuid": "bc508728-c9d2-4ad7-94d1-8364dcc058ce", "value": "2CF4BD9A37865A02F64FB476F30BCCE5520AF824961E7AD1773BCA0164FC711474EBA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212631, "uuid": "c9073af6-06a8-4364-afef-98d8856ff8da", "value": "5976ad10c7cb3fa98ff2e7bb07d093d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212631, "uuid": "dfffd15c-45a2-4313-a041-59add1a1d02a", "value": "12288:XW7YpSKow3FfB996rw6/GkuMTqPb6NzJhmmgyk5y6J2LY88zLXTm:X8YUKT59KGkFumnm8OXTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212631, "uuid": "5e701aaa-7a48-4c91-bf9f-eba29632cd8f", "value": 764416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212631, "uuid": "9c67c13d-aeee-4dd5-bdd2-9aafb86388f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212631, "uuid": "b49bdd75-f63f-4ecc-b01d-8c7eccb5d32b", "value": "3ad8fd73_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb4a846-adf6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255817, "uuid": "0de35bc6-3c04-48ad-95bd-0732296dddd1", "comment": "Malware payload", "value": "4bd2d17882dbe8b7d78ae775189bd61b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255817, "uuid": "c0572bce-fbc4-4adf-afd5-2346b0ac0979", "comment": "Malware payload", "value": "4e513d4715fe7ec27981cb94fb72b73d2558d7d2a34aba714d9b6aa499128f16", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255817, "uuid": "725a36e5-5a0f-453e-ab29-1384d533e507", "comment": "Malware payload", "value": "1a7c3bc7a49d0d7d42569324481ff1a81fa7f7c9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255817, "uuid": "71268f4b-ad15-4446-9744-0564736432d6", "comment": "Malware payload", "value": "ee4c01acb6d40508e08623696c25937b85e43c9ae5c45ffa392d33474ad00819f38922460a2cb27bbea8d5671a0f031f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255817, "uuid": "c765d39f-3e09-403e-9eee-d5dd83c7717d", "value": "87F3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255817, "uuid": "dc0c1a3f-949d-4652-873b-2e2c5b17c052", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255817, "uuid": "b9988688-d38d-4678-8203-3ee27d74f3b5", "value": "3072:a84Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:GDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255817, "uuid": "1248dc2e-130b-4192-8298-f1368f65eb9e", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255817, "uuid": "371e1112-763b-47bd-a3b5-fdd99db0a392", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255817, "uuid": "4d3f9bdf-7429-45c6-b55d-35df5e7231ed", "value": "4bd2d178_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6123b4c-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252230, "uuid": "f883be01-d1d6-4395-8f7d-e9124f70e964", "comment": "Malware payload", "value": "9ca53968e6e6d402aa684b8a756f1321", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252230, "uuid": "decfd170-5e45-4c03-bb55-1aedf6be50d1", "comment": "Malware payload", "value": "4e6f8c178296378efab0ab1cc2779107746dab82ed6cb720c808e26865ef95dd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252230, "uuid": "be8ec709-cccf-4462-963c-7b2dbad724e7", "comment": "Malware payload", "value": "2ca1d44502c6a7643ec21b8cc9643b064c53a396", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252230, "uuid": "9b8b2e1e-5a52-4f07-bbde-e0ee0209e476", "comment": "Malware payload", "value": "bb38b8e059437b5144db9f1973474d4f5ac89874695c7a0613da7185eb07dbd0f783c948c815069c1f80b5d9d8cafb6a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252230, "uuid": "24774548-ca02-44a2-8bb6-a9b5774a7f50", "value": "47F3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252230, "uuid": "70b7a64e-545e-4674-9bbe-8234106a8f2d", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252230, "uuid": "3c98eada-2e0e-4ede-8f14-4e5ca8b0fa6a", "value": "3072:Tv4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:kDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252230, "uuid": "a76e3cac-abe2-4d89-8f99-3b33030794f6", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252230, "uuid": "2622d8c8-d720-4d39-bf1b-e884be20bddb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252230, "uuid": "62e6cdcc-d587-4078-8787-5920bd8d53c1", "value": "9ca53968_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90aff007-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252141, "uuid": "b03070a6-e871-43f4-882f-63382cf3ff44", "comment": "Malware payload", "value": "ae0f68cc7753802f7cd22666cf6d3e14", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252141, "uuid": "fdf1b3ef-d903-444f-ab42-ffab218da1e2", "comment": "Malware payload", "value": "4ec406d75588c4e395c1a5b93bf43da319684352061cf42876c704d92a52df92", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252141, "uuid": "53c2dbb6-c294-442d-a189-233ba26a8d3b", "comment": "Malware payload", "value": "01b960a0798f5986dfb5442c9986fa3ade94018f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252141, "uuid": "c7a87a37-ccae-4200-a0a3-30754064afa4", "comment": "Malware payload", "value": "af3a3d02a126979aad32d46fdad7efd87d46cb82f30c56eeaea03879164595d69d8cac511a73a0b533a56199012083c5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252141, "uuid": "47cd12c0-8adc-45a9-9ce1-35eb1d9748b0", "value": "79F3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252141, "uuid": "02ef96b5-f7ce-441c-aeef-84036ee33120", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252141, "uuid": "466c129d-38c0-4f30-b812-121a53b22be2", "value": "3072:cK4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:yDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252141, "uuid": "eced0673-6d2f-4454-85c8-29e2a72cc864", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252141, "uuid": "0192bd63-73a4-4151-bf1d-21b035d8e283", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252141, "uuid": "6c23b386-ff1c-4336-bbe0-37ad9d57a7de", "value": "ae0f68cc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6176d1b-ad67-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620194705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620194705, "uuid": "77a1f14d-44ed-4e5d-98e3-ea1022500b81", "comment": "Malware payload (AgentTesla)", "value": "e1c955b695f54ec92b5662635daf199c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620194705, "uuid": "77c36346-8cd2-4f7e-9d41-e9a11d2ed96d", "comment": "Malware payload (AgentTesla)", "value": "4ec733b5e9c8f07798d95949e4299e9738e1a7930f56dafb31d197fdc25e1ab3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620194705, "uuid": "614aba32-23a3-45fe-8b39-99edec52135a", "comment": "Malware payload (AgentTesla)", "value": "9ef66f926f9aadf9735977a55d6dd9a3cba6b932", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620194705, "uuid": "313bffd0-dd2a-449b-b482-3526bd8437c6", "comment": "Malware payload (AgentTesla)", "value": "3e71ad40ac33be6133c9515a87ae6e0ee84ea45a8695bda43fc5b159ecaa3517ff03a37a6dc03c63cde149bbe825ae43", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620194705, "uuid": "6cd6d89c-ef7a-4310-88d7-ef6237c2b47c", "value": "C1F423B722A0A810C6ED6677D5FC53E2A33FA4059E96C86C2FF40A5C68E77539320357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620194705, "uuid": "0e7afc9f-2a56-4591-8509-64a581796b15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620194705, "uuid": "38c3174a-2812-4586-9b4e-5eb7db33a6a1", "value": "12288:VyDMsMxweeXhlJTW3wgzdCKgIVkyC59Zap/rIoxks+ukz5xYMVSjFA72X1AeUELh:IQwnRTIwaMK/VkDTap0oAn8Fs2X1UqbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620194705, "uuid": "70b8db14-dc24-4dcb-85e9-7618d3d44fb6", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620194705, "uuid": "1c5849b9-b88e-4bff-9497-811c114816cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620194705, "uuid": "7dde0b66-e50f-4da7-920a-8b12e8600718", "value": "Pay-1334563-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc8ec1d-adf5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255736, "uuid": "1c500a1f-d329-4826-8e06-7f50f76366ed", "comment": "Malware payload", "value": "5d11eb6cfcdb81983dffe10f5ec6026f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255736, "uuid": "a562a6d3-d83d-4cb8-96ae-730cf8600d50", "comment": "Malware payload", "value": "4ed888b4f3b9c65588631961a2ada581e8379c39ff904612ff928ff3025c2e9e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255736, "uuid": "e78b05ff-3661-4a6b-8470-b878efc53f16", "comment": "Malware payload", "value": "71d5102d00301b3553a23b3daaf5c7a8fe53a5b8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255736, "uuid": "5e43b953-1aa6-4cc2-bb7a-7157108a2ac7", "comment": "Malware payload", "value": "5da01c3ed9277139d141aa9344c020ba4055a6bcb9840a6008e4cbbc68eb3bc7391aa3ae78ca36cc32d97a711f3f433a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255736, "uuid": "17f1d02a-816d-4074-ba1a-9a4c0052a16a", "value": "9DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255736, "uuid": "e3ed1b40-eea5-4f20-889e-b3ae6af512a2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255736, "uuid": "1dd86abc-fbd2-4bab-853a-4a185a66454c", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255736, "uuid": "1aa3a3f0-63e5-40ec-a1f1-197d3489e803", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255736, "uuid": "e5e129df-259c-4f8a-88f3-777e36cfe410", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255736, "uuid": "56075a07-7fc2-46e5-924d-e3553ed8413d", "value": "5d11eb6c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c8da623-ad92-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212888, "uuid": "d16a8088-ddb5-4443-81c7-ba53e3c76134", "comment": "Malware payload", "value": "cb05a93595e149bdaad4a238b4325bb3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212888, "uuid": "9448b3c3-30f8-4cbf-ac3b-8c27ae92e74c", "comment": "Malware payload", "value": "4efda554d6abb5da2262f7ef6617b09ad3b6e5b03aa668867dfb452aa6c53b6e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212888, "uuid": "7d8df049-c9e8-4abb-b232-3c4f1961dd4a", "comment": "Malware payload", "value": "1d6856c97be5aebf1491f0bce72a25df556fa596", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212888, "uuid": "7c14a9bd-e26c-4f13-8f32-fd1e652b575a", "comment": "Malware payload", "value": "4a120806da489dd197586faf9d443664f27f8bce2db4de933ddc241eb0fd41013623fe479bba39bbe4325e81893c2ad8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212888, "uuid": "7c0c6edd-6f28-4f57-aa4b-3340b3186b28", "value": "EA2382BA37F688B6C52BF83530AEC8930FE17DAF8F4496A4C3447E0325118E4B5E4895", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212888, "uuid": "b70abb9a-c08e-41f5-ae10-c5bfd575a7c2", "value": "8deaef3e3b3c421e8712f0f1e57b5aa3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212888, "uuid": "d34372fb-fcac-4e67-9b7d-3e4218af8c18", "value": "384:o0ZHgzZSs60UnhidxRmyilYSJaKCEezHXfff/Duz:VZHoUogZQKK3fff/Dw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212888, "uuid": "4e1e07cc-6a73-4a3b-9389-47304a5a10d3", "value": 46504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212888, "uuid": "30a85bc9-bbdd-4a84-8da9-7aea84569a4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212888, "uuid": "6f179c5f-f096-429f-b2ec-d8be165755ab", "value": "cb05a935_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e3bc1bc-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209053, "uuid": "b6506a29-ab61-41c6-b77a-2f77cf3f08f5", "comment": "Malware payload", "value": "95d1d6b2d121199798fdcaa04089105d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209053, "uuid": "29ea2873-dd7e-4608-bc3d-bb15eb36ba37", "comment": "Malware payload", "value": "4f1d30e1092cefc4d31aa257617389dd4498022a51a4766524afe22511f9dfa7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209053, "uuid": "e2ce029e-0740-4a98-88ed-002e5cf82829", "comment": "Malware payload", "value": "46c29acb2e3c4af5dad22e48c7013dc6800e6300", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209053, "uuid": "288f791a-e37d-44a0-871c-4655121f0ffe", "comment": "Malware payload", "value": "3cd0ff7b85c19394f5ddb0fd6fb71d640a3cc1efd07368b8d8d6adf9a98e21834dff5a94f19b530f7e832a7a9b23f836", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209053, "uuid": "a41aa456-bcae-4b54-9c65-18c0142610fc", "value": "74E4E02222B64F0BE24949F1A4BACD4BA59C5673E48CB2D0117F22D35B2B779B34D49C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209053, "uuid": "2fcef862-fc59-4312-a16f-8372cb9fafbb", "value": "4d3283fb11df9ddd721f3f9619b5622d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209053, "uuid": "fa764caf-3891-4251-ac94-2514c5bced45", "value": "12288:hJYy9p50if9durxtIKD+iv70uTr62jI8nLJmmdV38jsWXv:hJ59VFdmzIKDXgmPzpesW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209053, "uuid": "1a9f3636-e628-4058-a78d-206f9253b239", "value": 672768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209053, "uuid": "de37f888-48e1-47f5-ae1b-fa839759c091", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209053, "uuid": "f6949c81-2443-4440-9002-0d302a55ea91", "value": "95d1d6b2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc70ba40-ad74-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620200245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620200245, "uuid": "9f17c2f2-a6ba-4c52-812e-0cb254d7216d", "comment": "Malware payload", "value": "9aaa9213f146a5e6446c0b8ec554c9b8", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620200245, "uuid": "e81c48b7-e90d-4ebe-a677-406fbe999363", "comment": "Malware payload", "value": "4f2139b93e1558d8c4eb57d3b3c54ee1ed58341fddcea7be985922f656c6fd8e", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620200245, "uuid": "f0eee54f-2a32-4005-ba0e-7eca37737ba5", "comment": "Malware payload", "value": "681e0fff563f099beaa42fbf2ee2e697b7589e71", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620200245, "uuid": "673c2c3e-9eb7-445e-905f-54af6bbb34af", "comment": "Malware payload", "value": "d4aa2b79fa9377318d0a94ec720f67b5885965ef9b1ce6a5a80c182bebf87ca0497e594508291fb97c9a8446ef8db6bc", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620200245, "uuid": "ab772b83-dc8c-4bf1-9d1e-92d53f333d42", "value": "020523017A618F0FC2AF517C08E3942D517EEF61A1C2C9BB73D2B24A16BC79749A94F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620200245, "uuid": "7b69e0ff-3c34-48c1-84a1-cc4bb1236532", "value": "24576:KB90mSq7lR4lVrFwLcq2a3yxMZgWCkGC6KW:k9kqR4Wld3yxuKkGC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620200245, "uuid": "1f075be1-44f5-4a62-a110-1ece8f9b8b3f", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620200245, "uuid": "f953bc9c-965c-40b4-a360-c8ee979b20f8", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620200245, "uuid": "eb0a050c-ed36-4624-b816-57335283b6a0", "value": "ROL DE SERVICIO 04-05-21.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f685921-add6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620242180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242180, "uuid": "7715285b-a347-435c-a2f1-69dfa2451c85", "comment": "Malware payload (Dridex)", "value": "19ba6fc44e579b218859d72fe45c3e03", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242180, "uuid": "e7baa9aa-278c-415f-abe2-cf6bc01e4800", "comment": "Malware payload (Dridex)", "value": "4f358b8aec55d0040a3e4b97881d70086760ac1f73b4efc1b27dd63e53590b44", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242180, "uuid": "af0fb5d8-71b6-45e2-984c-6c849af84dc6", "comment": "Malware payload (Dridex)", "value": "aefe4d77a0a905e9b84a4f06df395e3d46832ce1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242180, "uuid": "58d54e0a-0a71-4b2d-af8b-5b8c5f788c1b", "comment": "Malware payload (Dridex)", "value": "9111888f44eedf9c420ccf065d38333c4b80df397c1e022879f1f67685f93d78e02a9fbbc4dd6bcc1962513901c8502b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242180, "uuid": "43637cbf-def1-40d0-b9f9-6bad54422cfb", "value": "3CF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242180, "uuid": "cf812be1-9198-45b3-9615-a23d8829e9db", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242180, "uuid": "393a44aa-33be-4b49-a05a-42483085d84d", "value": "3072:YiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:jeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242180, "uuid": "c66809b9-0e04-4be4-9a27-a53b9bf08ed1", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242180, "uuid": "b954b208-7ff1-44cc-891e-b58257c1281e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242180, "uuid": "d45a344b-e897-4787-8176-1226f231dcc2", "value": "19ba6fc4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "195524fa-adf6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255806, "uuid": "714f462d-e4f2-4581-9cd0-8605c00822da", "comment": "Malware payload", "value": "467bdf29a7c0f0466e56aaa1f35a3862", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255806, "uuid": "cfb60ca7-3e03-4c6f-b3fe-e075cc642876", "comment": "Malware payload", "value": "4f37b61eecc616a495458e86de3fca37adf43c2300feba76b83962f5e8ebf830", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255806, "uuid": "e637b3c6-a4bd-4401-b1d1-e375e55f01df", "comment": "Malware payload", "value": "10ec5b28eddd1bcc111314604adf51748469955a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255806, "uuid": "cd229422-297d-4bee-bdba-49cd6d872199", "comment": "Malware payload", "value": "c6dd8aa2f68a424e490ad681a011de6b2bbafc3b90ec3c86d7494ecd3c62348851b6f9b5967ee13447af696ef2387adb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255806, "uuid": "101ee158-7f04-4944-a2a9-a672ccac16fc", "value": "75F3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255806, "uuid": "975cb3d6-6a65-4fdf-a1a7-d2895d7e8fcc", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255806, "uuid": "f3ed3003-605c-44de-adc6-26cebe07566d", "value": "3072:MK4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:iDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255806, "uuid": "b7e28403-88a2-4ae9-8b7d-55c6e7b2f5fe", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255806, "uuid": "dcf3e047-8e3d-4959-bfd0-357d295e169d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255806, "uuid": "d8708b99-058c-44f9-9025-46b8fb4de9c7", "value": "467bdf29_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad2c5920-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208809, "uuid": "6e33dcc2-816d-42af-8c49-118fc036b7b0", "comment": "Malware payload", "value": "991281f872d6859b6e720f75dccb1a54", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208809, "uuid": "90b4a240-3cc5-4091-a575-dbe45a91042e", "comment": "Malware payload", "value": "4fa59738aba4c6afa8d18c5b82887cd926c502686942aa8cf4335f3b86f00ccd", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208809, "uuid": "61950bf8-3e0e-4aff-99b4-a78458ae45f8", "comment": "Malware payload", "value": "dfc94f19a6b70529265bc6ffe536cf137449d87d", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208809, "uuid": "e8b5252c-48a9-4b67-9227-752b6ae792a1", "comment": "Malware payload", "value": "99e1329a0b5de09768c5699f57b61b3ef8d4b42c34f619849eca864f750a3d6001047edf816b8630802616497fc865b0", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208809, "uuid": "3c3ca5da-fdbc-4e44-8415-d20735eb0f30", "value": "3C13290AD103A4F6CC2B0571139BE7BF4B30E636D820DE85DBA0DE5AAE67C612A1D354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208809, "uuid": "93e465fe-4306-460c-bb3b-3933ae32a2b2", "value": "768:uR7AQOgVSoAaZMAWAuYYHQjzcypdoSrLOBGvx3b2IQglxnitrmE5x5515ZpjfHmA:8TSoAas/Qjrd7bvx37/At1txUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208809, "uuid": "42aa70ce-a83d-4edc-adfb-f943fc60f078", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208809, "uuid": "1fb3d65c-cfbf-428b-b219-3d00a125e3e6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208809, "uuid": "eb1575f6-1640-4bc6-ba8c-98698cc3b514", "value": "4fa59738aba4c6afa8d18c5b82887cd926c502686942aa8cf4335f3b86f00ccd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f49eb7-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201737, "uuid": "574d55c2-10a7-4d82-bbba-22abad317c3e", "comment": "Malware payload", "value": "9a44967a9cf1e3f792eeaff3324e1946", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201737, "uuid": "aefe572d-e89a-4d49-b298-aca1ea5f56d7", "comment": "Malware payload", "value": "4fc2bd2bacfa559b22c7a4b69199fe7d96cc9565dfabec90a9f24d694b2c68c7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201737, "uuid": "0b9abd75-4838-4e5e-9672-6e3533440145", "comment": "Malware payload", "value": "9f4418d4ddea91cc1689e823a0a315f910605788", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201737, "uuid": "8f2f8f80-6329-473d-9d14-f0e630883daa", "comment": "Malware payload", "value": "cdb07d3c39dca3d0d2553141d1b3cb8c9ed0c8308aff8caa5db15963d59628a96a31659e7ae29edefa888ab575d11b8d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201737, "uuid": "c2446f4e-1249-4ce5-b30d-f92c5e86bae2", "value": "CEE4E06D3E79B371CF8A54FF53096604DB8815EC42BF889829B5D587A46DC32F02E872", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201737, "uuid": "3f23457e-5273-49bd-bb7a-31f84d9de45b", "value": "7843c3508d02c118c5e2719f2ca6a5d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201737, "uuid": "186c7336-9f96-435a-ab85-60f90070822a", "value": "12288:7maYLmgEmZAWqm2MDkoE1sGrLK4SNpiK0akQtM8uVnuRgR1I6I9Y3T5o:7maYarmiWqm2LoArLM07KgV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201737, "uuid": "430ad471-7dcd-4b82-9d6e-238fb8b0f674", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201737, "uuid": "1cf110d3-2454-4f01-8d88-5d41780b5ca5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201737, "uuid": "56b7afd6-b803-4224-8691-4d33a104936d", "value": "9a44967a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a9a1f65-adc4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234387, "uuid": "f455480e-f7aa-4cb3-a90a-96ee009fcfa8", "comment": "Malware payload (Dridex)", "value": "efc70cff02f712335abb60d76f46b196", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234387, "uuid": "e83855c9-c538-4d86-9124-4ce6dc0a2a95", "comment": "Malware payload (Dridex)", "value": "4fe0d9863c2bb3dd541fc9bafdad6f61c68089e06ddddae45dfd43cbbf813724", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234387, "uuid": "b86cc764-70d3-45cb-a9c6-3440bdd2fd3c", "comment": "Malware payload (Dridex)", "value": "f284f3534ff8b7fe2fa35b6925b17adad5008357", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234387, "uuid": "1ce5454c-0143-479e-89ec-f618a4c3c577", "comment": "Malware payload (Dridex)", "value": "f78f183b66fc8c9a8aa60a6a291a371f82d872e2ba14d2bb471d18420cae03a0d96dccc5e7858654f51146c92c957db6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234387, "uuid": "7f5616df-7c51-4afd-aaa6-540c81a4e960", "value": "15F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234387, "uuid": "3cfe4038-ec77-47d6-95b3-3e49bb7e9e02", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234387, "uuid": "d0e4cf70-d48d-47d0-92fd-449cd1a1afb7", "value": "3072:8WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:842IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234387, "uuid": "b7adec78-7ac4-465c-b0f4-b8690381f164", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234387, "uuid": "0e8094a9-3a13-4b55-bd07-bb0ef8336836", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234387, "uuid": "69610c8a-64e5-4f60-b6d0-79a89a5e7b17", "value": "efc70cff_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2330ad72-ad92-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212873, "uuid": "3b05a48d-f3e7-4657-a259-68afd4fad7c7", "comment": "Malware payload", "value": "39ad075b6e8aaf9606b2f737c73e08af", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212873, "uuid": "77549a7f-57f2-4ef6-a993-b9d0d4a7436b", "comment": "Malware payload", "value": "4fe73120f577940f23dcaee6ae21ba5c0ea7182128e1381d460b407bffeeef24", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212873, "uuid": "2c26a5bb-579f-45cf-91cf-5356331e613d", "comment": "Malware payload", "value": "ee52bbb98654760a77f44691cd6da4f540047307", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212873, "uuid": "64ca55e3-6cd1-4697-a546-e47615f81c1f", "comment": "Malware payload", "value": "b084e7b93c3b384c3158cbb18541dc237f6d00db7dc7f8ec17cb6425381720aae00d3a78a1cd22c8ceaa1072946814af", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212873, "uuid": "4c9408d3-cf9d-4318-bd9e-1cde5ad52c0b", "value": "BAB4D0F7A6CB940BEA894DB01A4D56CDD5E57B65CDB3CDA81C1E8CC24228BF18AFD404", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212873, "uuid": "d4b4bb6f-dbf3-4a3a-be5c-fbf0883bd05a", "value": "1b688261b8c114a619e42ec070aadf85", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212873, "uuid": "aa35fd8c-d974-4c05-86ba-fe754afa509c", "value": "12288:6eGxbELFewWF+Ejy0LPzORFHbJYVZCcPlZR4ObnmUvTz+fRv:7GxbfwOpLSRsZCcPljuwcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212873, "uuid": "1bfb7394-9fa7-4743-b866-89f7a38ed47c", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212873, "uuid": "9f6fcd8a-2887-4258-a435-05d1c06376e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212873, "uuid": "2e2ce5ee-b638-47b6-959f-c536b63409c7", "value": "39ad075b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841a0c40-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252549, "uuid": "4efc014b-0684-4359-a365-a3ec38036908", "comment": "Malware payload", "value": "f1c64e3f773042bca260c1fef9fb9da6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252549, "uuid": "af0fbbaa-7fa1-4bbf-9336-3784a0206fa3", "comment": "Malware payload", "value": "500edf64d2a0e5502d77da19ceac0732f668bf4b279d3530d443685e98d431cb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252549, "uuid": "0f85bd49-ddaa-4f28-8f65-086f772eb8b4", "comment": "Malware payload", "value": "b79b82a398186dd6fc88600bb1df74fcd0c13eef", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252549, "uuid": "9433601a-b0f2-4cae-b55b-a56c3230934f", "comment": "Malware payload", "value": "2464a11ca9e430268f8b3fd3adae0b72cbd181154d576ab5f5c8ba1957d22e2c15a8eb50c2012b249e2b943ef3369e57", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252549, "uuid": "73207e65-90fe-4ad0-9dfb-8f4d8432a15e", "value": "E5F3C085DBABE87FC44A35399072DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252549, "uuid": "7448e71a-4ac4-415e-8635-d8c1692c3842", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252549, "uuid": "2b4848b0-cd57-427b-ada7-397e5ea86960", "value": "3072:LF45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:54KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252549, "uuid": "ad42a4d1-e70f-47c6-bde9-b61a9b192610", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252549, "uuid": "e7199f96-075d-4f80-b33c-5f5ffff78594", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252549, "uuid": "737b776c-a9e6-4601-b78d-21730c6d8202", "value": "f1c64e3f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfda473f-add3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Stop)", "timestamp": 1620241053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241053, "uuid": "ff811da7-2a8d-4417-9666-38c12f89b4a8", "comment": "Malware payload (Stop)", "value": "6c905b18c6865b7bfa638c7c46620f59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241053, "uuid": "dcd334ca-4139-4b41-a6fc-ae46cd6cd531", "comment": "Malware payload (Stop)", "value": "50164e878b632fdf08b4f0de2060872ede8970238cbcfc55e32bfc1f81dfb4e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241053, "uuid": "555924aa-018c-4fd4-b8ca-6a738b0fedf6", "comment": "Malware payload (Stop)", "value": "c856c712600d862651259e3a13f033ae3e159bd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241053, "uuid": "f4ebc6f8-a7af-41db-b45c-5effcfcb931d", "comment": "Malware payload (Stop)", "value": "6f0ebe56a40fa2535ba633261e04f10641e69a3844a6812be4bb8ce997b4df675c7716fa8bf42fde405967261974a3a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241053, "uuid": "da7906de-921a-4ff5-90b3-b350116c7858", "value": "D605F130BA50C031F8A711F845BAC37D763C7DA09B6550CB2AD4BAEA56345E9EC30E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241053, "uuid": "d8242072-1c41-47bb-be20-477d9ee73f05", "value": "708e215303d0880946ebef0bd0ae76af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241053, "uuid": "a6c1b112-69d1-45f3-9c9a-2200292a28ec", "value": "24576:QnDClUXzj+Y8lL7spFg5deN1m7GB5NyxLBbQCpk:lPck5M+GB5NoBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241053, "uuid": "fcb2adf3-d040-4b56-9042-fa18ccb54d14", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241053, "uuid": "9910f987-9b1e-45b3-b587-31c2a86f6153", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241053, "uuid": "f3d49b10-b2f0-488c-94b4-3c529f79267f", "value": "6c905b18c6865b7bfa638c7c46620f59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd7b98c-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212733, "uuid": "a46843c1-2353-4069-8a3a-8e575c97cd44", "comment": "Malware payload", "value": "1cbc6fad1b650b438a38f99bddf15ece", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212733, "uuid": "b0227ff9-87bf-48d5-afac-07583d8d3894", "comment": "Malware payload", "value": "5052dae8fedabb780c89d1f0251f6b2f3a75e8fd1f37eab4cef9376879b5e305", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212733, "uuid": "68f42f50-71cb-4da1-ab4d-30c1412f34bb", "comment": "Malware payload", "value": "469f5b82859066dbab827b26385554a86b817fea", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212733, "uuid": "6e07712b-6a97-43eb-91dc-4ae74a6e3a56", "comment": "Malware payload", "value": "6ff2ce9b0c27e7ec94e08d3c95d729f03ae37b059cb0dfb9e263e6fc053575fc50f6f83baa16fb608d2dc82d00bae066", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212733, "uuid": "6ea1798a-0e85-4865-a262-b44a827bb4d3", "value": "9DE4F192642AF7BEF3EE36FC7A713146C5581B42041E60381C5DBBA693179EB09C2DE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212733, "uuid": "134ec2e2-b175-46c0-9d57-39287ec0fa73", "value": "c88c5d94dceefc690ec4245a5d0daabc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212733, "uuid": "facef18d-b8c0-41e2-b836-145e4b69d656", "value": "12288:jobhfoWVSS1kixkrZPw8kyTs4sXkV1CMvZL+3a0vC73P41+e:ZFwDxl6ywgK0vie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212733, "uuid": "008bac72-a69b-46a9-b015-8211f38ebdbd", "value": 672768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212733, "uuid": "640a6a4f-56c3-4499-8ef0-49e3c08c01c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212733, "uuid": "97e33725-6d8f-4d50-b11e-8c926faae75d", "value": "1cbc6fad_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1260f5e6-ad79-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620202107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202107, "uuid": "e4c4a6c7-c9f8-46c3-bc6a-4393bdc240c7", "comment": "Malware payload", "value": "e091e59e3d0baa8a0ad35b9605f7da23", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202107, "uuid": "f0493856-a885-4b06-b391-9825bdbcf1ef", "comment": "Malware payload", "value": "5065428bc91f6a12f48944a8c7299d559faf3d53e2c7c47db05bb9103450ab8d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202107, "uuid": "46a6cb98-6136-4d2b-bc6d-3dbaebdfe15f", "comment": "Malware payload", "value": "55ecef18aa6467ce1a31219a2760764b3610ef43", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202107, "uuid": "8904cdba-de81-415e-98b9-3c72da7b40be", "comment": "Malware payload", "value": "2e610242d8c604ad70ef0debdaaadf2f7ff918b60c59275809a7f4688f56c1a84e9546477fcbeee0850ea06c2dc227d6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202107, "uuid": "9b57f741-1ce2-434e-9a66-3147045ccc34", "value": "8C75F217F01C6B3CC6CB4338BC91886E92DE0EA1AE9DBD11555E18AF3B161E06D90EF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202107, "uuid": "6cfe3fdc-84df-42c6-a4e1-460284261112", "value": "bd8218eae1d0f92d8a2d4078829528df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202107, "uuid": "8e37004f-df35-4f4c-a025-5b18c0039b33", "value": "24576:y/DTdK3M3oB7qkWZAAiQgfn3eiBvuFMn7wpgEyBE6zx6UCh6S3epAoJrH:iK8i7q+/DvrefyBE6AUCh6S3LoJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620202107, "uuid": "8b6bafec-1390-4901-8901-e3fddaeea06f", "value": 1601024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620202107, "uuid": "a616dfef-e1c1-4a24-9970-5ed3640d6c77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202107, "uuid": "d9478f95-ba43-4fe4-814e-803df31a83aa", "value": "e091e59e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af3e9b67-ad63-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1620192921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192921, "uuid": "68c81d23-133e-4a61-8cc2-fefd8a858f5f", "comment": "Malware payload (TrickBot)", "value": "96ac4b6f8184f21eadac4e4f719447de", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192921, "uuid": "8821f00d-2fae-408c-b7ff-aea3fb2ac068", "comment": "Malware payload (TrickBot)", "value": "507a6d57570a5774ce656a1b82535a4992e2320c6a760a5e957665263bf102cd", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192921, "uuid": "9b258c74-6e48-4c64-aa1c-d81b6261574b", "comment": "Malware payload (TrickBot)", "value": "e67bb5d1240f2572dac3c4bf673cdfa13a1851c1", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192921, "uuid": "e250c599-cd31-45f0-bdfb-5f0887ebfe46", "comment": "Malware payload (TrickBot)", "value": "be6e66e9ea0a5f802251a8c70f27cc890545b6a37e4642bd5bbf7b96ee16377372a27f4b324ccf44dd186692ab2167ab", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192921, "uuid": "9f285cb1-671c-4473-ab7d-82f84979bd04", "value": "DA54E482B1129564E1585F36E836457C42EBEEAA7B38F18B2C04F3B73B771D23E41919", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192921, "uuid": "32094a80-0c1f-4b63-9ec6-14e5cc39ad70", "value": "6144:acPiTQAVW/89BQnmlcGvgZ7r3J8b5IYJK+nBoOhF:RnOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620192921, "uuid": "ead7c594-a196-44c3-9018-33b00790dba7", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620192921, "uuid": "75d2674c-df27-485d-b80d-5c98b099d69b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192921, "uuid": "5e71b55c-89e7-4e0d-bbe6-3af013eb0a6e", "value": "Documents_52436149_1332453001.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "539c8604-ad81-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620205653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205653, "uuid": "543fcf3e-bcdd-4359-9661-e9790931878b", "comment": "Malware payload (Dridex)", "value": "8e10357e7dfe5645f33bb12339e9a26f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205653, "uuid": "ca6081bb-47ed-4728-8429-9f4473032a52", "comment": "Malware payload (Dridex)", "value": "5091b428cc084f16c1ec9f847ff5db5d14804c97f98dae3277581024233ee8f4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205653, "uuid": "28db85e9-68de-4a15-9720-9f2fe0b06857", "comment": "Malware payload (Dridex)", "value": "7335f726427c2187fb1b65b63b7455a8744f97e2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205653, "uuid": "a380defd-c5f6-400b-aed5-5bab71d846bb", "comment": "Malware payload (Dridex)", "value": "6355b28c18ff9116d4a87daca364dd9b88e418cce2097c6c5ddc78841499aacfe7fa3575069813e1a3b6bece3d6755de", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205653, "uuid": "76895a8e-4300-4417-829b-04b7c2356326", "value": "17F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205653, "uuid": "699567db-b4d7-45a6-9bbf-877b39f6de67", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205653, "uuid": "0c162e1d-1c9d-4d24-b806-ba1c54f18234", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205653, "uuid": "68c62c75-b244-45c5-b6cc-2c46bc3bbfbf", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205653, "uuid": "8b2e74c7-0d5e-4b49-b018-80a26cb41993", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205653, "uuid": "fd71d4f1-ffee-4f0b-9bea-b9e1c884a85a", "value": "8e10357e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b282e533-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241889, "uuid": "a4866d8a-0c86-4170-94d1-1a74874d89e1", "comment": "Malware payload (Dridex)", "value": "0e8aac236c8c516c28b327cba1876537", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241889, "uuid": "579297f5-9336-410e-aeb0-e31422321ef2", "comment": "Malware payload (Dridex)", "value": "50b96c5b83383eedf057eafe7780d138eb544e286786938bbccd7395b2da6cc9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241889, "uuid": "56250c8d-67d5-46e5-8b27-d1534dc9becf", "comment": "Malware payload (Dridex)", "value": "f7d8fa3cb7d1aaf8abd15b7a7c649237898f101c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241889, "uuid": "390bd07e-b3c8-4854-b59e-7164a8bcbe2e", "comment": "Malware payload (Dridex)", "value": "88ad5ccd669012106809b597d022441b8fffd74f76868fc6acdfee5ff623788e14b24200f633f9e478f7d3df608613d9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241889, "uuid": "8635d0ec-ce5b-4d4a-9e95-af34a9ab827c", "value": "50F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241889, "uuid": "b8abf82b-e2d6-430e-8f6b-a363b0d3f117", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241889, "uuid": "fa1e534f-a939-48db-ada7-c2241d7a0e88", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241889, "uuid": "0c45c999-6e3e-44cf-884b-82194d1ba6d2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241889, "uuid": "405d7059-09ce-4146-9b50-d7ed473d35c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241889, "uuid": "653a351b-2f5f-44fd-b59e-af40fbf85922", "value": "0e8aac23_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3dea15c-add4-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620241543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241543, "uuid": "67362290-ea94-4743-9ad7-408df497cacd", "comment": "Malware payload (RedLineStealer)", "value": "0094e9329691b02305afeb49b73ed31f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241543, "uuid": "0af192a2-9ffe-46c4-9027-074c90f83201", "comment": "Malware payload (RedLineStealer)", "value": "50d2b07713cb4e000c40255a46ad201c50d8f8c804f8c227ec1fe74451562039", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241543, "uuid": "574cedf0-eb1a-4acb-b278-be3c2a49572d", "comment": "Malware payload (RedLineStealer)", "value": "e38cd5b500ee6db18594fcffb9e7860911340daf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241543, "uuid": "24209f5f-c3e5-46f4-bf3c-04d5fcb703b8", "comment": "Malware payload (RedLineStealer)", "value": "02399fbb461dbafc8a781e30767f2aaf815b518615c07332657a6bd81fdaa114650c4468f8c0b521f1023fbe181d312c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241543, "uuid": "dd81a266-2476-46d3-979d-2da0bb6fab5e", "value": "DBB507B072F2A6E2B5E13B5AF2757BE6593F3BF09235364C9071600A771460844E87BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241543, "uuid": "8038339f-2242-450d-a90d-560f5c7fbffc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241543, "uuid": "a888c6c7-c9c0-4a27-a42d-423f1322441a", "value": "3072:VT27TCLTkxRZ7tOQ0cJtBL6NM60IHx9kOKPU+0n10yXghxefqBpBG7rX0vIjpNDj:5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241543, "uuid": "ad2ecf09-65e5-4503-a1ee-3fe72a611a5a", "value": 2472368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241543, "uuid": "f93783f4-93c6-4240-98bb-0ab0c82a5dae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241543, "uuid": "3b1f263c-04f7-4a56-942d-bbcf40eea2d2", "value": "0094e9329691b02305afeb49b73ed31f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5aabbb0-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209253, "uuid": "3f07a6b9-3e30-4ed2-969e-4c0a1f9f272e", "comment": "Malware payload", "value": "08423114a40f6ba842b5053b52c8a111", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209253, "uuid": "8098bc1e-fad6-4213-bb1f-2d8568faf1af", "comment": "Malware payload", "value": "50e48f8c01a7a96f1001690abb20f3ea638ee063f6c1776d8f299db48ff29ada", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209253, "uuid": "a225d3cf-fcb4-4d0f-80ad-9442097958a6", "comment": "Malware payload", "value": "12bafcd2dd2b5c536c15b0d6fe55cf6b39fe140c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209253, "uuid": "abaf2e60-1df7-4945-8ccd-d8b23c13d71d", "comment": "Malware payload", "value": "64ecb043101eed9ba696282b86c0fc30eb0f521cf94976d71f9912b174d7713c1a2de82e1112f810cb3070df72b5affb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209253, "uuid": "6bbb9ff0-336d-4a5e-97b2-c44db9bf55c8", "value": "1EF4BFC7E059B8D1E647BF3BD7CE0E3C4530AF4126A64C1EB9A8811D51A8356933787E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209253, "uuid": "bf680ece-f6e6-4b55-b3da-264908829731", "value": "4a329a89df15601c130aa7511c071ef8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209253, "uuid": "8ff48fbe-37e3-4abb-b962-7d267c864fb4", "value": "12288:90PZuOXrXwg4+D3iHfwQBQDgiKk+bUybaptEQbMzSjtcNTm:aTDwgFi/wQBqgMcHWuTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209253, "uuid": "82dbccd8-eac0-4da0-bb5d-b643c446f4ed", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209253, "uuid": "a62e8b64-bab9-4d83-93bc-63952eb0a936", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209253, "uuid": "75e70a53-8b92-4b33-9cfd-d02f99d211fc", "value": "08423114_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36773ef6-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252419, "uuid": "154730ab-dd71-49e7-9a84-820b4082c52c", "comment": "Malware payload", "value": "3d8a3f403bb4b2ba4a88f3a4afb7bef0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252419, "uuid": "e74d29bc-252e-4770-8932-fccab96252e4", "comment": "Malware payload", "value": "513b04ad11c29e87b7bf0cbf8fc23a43fb423770824f03219b239b9d760681bb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252419, "uuid": "853818b9-03b7-4fd2-853c-f7a40abbc88e", "comment": "Malware payload", "value": "b357f1872db2e30ef5bc59c6756e4bfd6aa3ecb2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252419, "uuid": "a93ada77-f1fa-4f8c-aa2e-cd5d5897e32f", "comment": "Malware payload", "value": "5655a8160982ce5627693cdf7a7587334434e6a5f12ab24f204bddf0b8ee0079c14076833db1a2879517f6c10ea80c9f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252419, "uuid": "361149b3-9c17-4a2c-826b-f5e67c2a284e", "value": "44F3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252419, "uuid": "c857ac09-3d0a-473c-b630-fab35cdd57f8", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252419, "uuid": "53f72516-473d-4c41-a18a-50aa9758f670", "value": "3072:F84Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:pDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252419, "uuid": "f7d5d9e4-ba85-4fd0-83c2-7d480cf14cbf", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252419, "uuid": "75a6df86-e565-45ae-b1fe-84720f146f40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252419, "uuid": "0c2f66cd-e15b-41c5-96fe-33f155a65eb3", "value": "3d8a3f40_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19edff18-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208992, "uuid": "bf93b5c6-ab32-47b1-86d7-ac74e1169834", "comment": "Malware payload", "value": "0fcc5631e2f18878ac636c4b5dd08740", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208992, "uuid": "db305dde-e69f-4a6f-8bbf-810957f8f1d9", "comment": "Malware payload", "value": "51926c1ea9d388bf2719472e608482f3b686988b5ee47491084a1e2fb60ca49f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208992, "uuid": "6183a1ef-067c-430c-9e65-d549a73f70d5", "comment": "Malware payload", "value": "40535e21fed19fe5b91be9f9e4bc5aff90f13523", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208992, "uuid": "0c8e7c5b-f719-4318-9d30-4328bfffdbe9", "comment": "Malware payload", "value": "90b80c7033533f0f2fc1b9b165b053a6d3ef4b964641f35fe6f3863e98d8c4466bdac256890081bc02ab329e80f9375e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208992, "uuid": "e48b3db4-ad72-490a-8a1c-19f0bf3c640d", "value": "0FB4DF0DAF30CE98C5CB9C36E94014BCB737517B7D9564FA3EF8A4820D7AEA801575A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208992, "uuid": "d13ba22b-39e1-4d3e-9f27-38435467f57f", "value": "d8213fbdc42339e34906928e26010684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208992, "uuid": "18f06b5f-e5dd-4284-b026-bfadbf0ddfd9", "value": "12288:dtFy3OQjZpemjnCAiQaDPlVv61tSyql9nb:djYfP1ODxD78v0hb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208992, "uuid": "38eb6067-4023-4f1d-b866-13a19ebadcac", "value": 510464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208992, "uuid": "d0aa8fca-17bd-4498-bde6-6653373b2c4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208992, "uuid": "2e01fea3-1cb8-4340-9540-e7fb09e1586d", "value": "0fcc5631_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0033e545-ad97-11eb-abe1-42010a9c0039", "comment": "Malware payload (CoinMiner)", "timestamp": 1620214961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214961, "uuid": "602756ee-6b0d-4f62-9525-4c0b691648f4", "comment": "Malware payload (CoinMiner)", "value": "7f6b8e103f0a42615d90a2b7ad862135", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214961, "uuid": "3fa19f6c-e9b3-45c9-bf05-7325414a03d3", "comment": "Malware payload (CoinMiner)", "value": "51edeab1acc8739d6e419b59c1ea6c1e1a8e783d1a3852729b35781ddb008639", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214961, "uuid": "c5e42071-4813-4628-9584-3b85873de4c3", "comment": "Malware payload (CoinMiner)", "value": "095d2bef8afc9a657cb0dfbe9e95ae467a7364d0", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214961, "uuid": "1f18da87-7e02-4b03-8037-09247be11edd", "comment": "Malware payload (CoinMiner)", "value": "dce9b5e4101121b5765fd327264c5ef73530129eda88a866fce203a087af7abbe56257de858cfb73bdba2348fd827259", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214961, "uuid": "fbd952b4-3fcf-43e9-8861-8f8b863a5f85", "value": "59D5BE17BC4C7D8DF992BAB62D8976196850FC34F628079B35C1B909E4383A7B077329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214961, "uuid": "e09b7a29-761e-4662-8224-23af2f5bb7f5", "value": "eaf850221ebb92188ccb4c061d41387b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214961, "uuid": "24c42e20-082d-487c-bdbd-a70bb0b6e2fe", "value": "49152:PwqJuy10dpFEjZFgwa0aTuyDAkD4qfFqlYCd6/0ihTFjKiq2:7ukoFKAhHcCqJ47hTBKiq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620214961, "uuid": "e14b9c29-58d0-472f-8494-173e99f97ab2", "value": 2901705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620214961, "uuid": "cf8c6307-825e-4126-a5f8-1ccb17a6f676", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214961, "uuid": "0dfbbabb-4fb9-409a-aec8-b665003e7c6f", "value": "taskhost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ade82f8-adbb-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620230575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230575, "uuid": "e95fc35e-a02f-47c9-8a8f-111cf237b4d7", "comment": "Malware payload (IcedID)", "value": "0cd4919a4b60e0d941b865d1dc479e7f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230575, "uuid": "d2b3d957-5146-4eab-82c8-743db3597392", "comment": "Malware payload (IcedID)", "value": "51f20415064147e3eeed504a3c53c5850150840896e91bdfc815cfafd2e5679c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230575, "uuid": "3042d688-5fa0-450d-a235-70f8ca8e9e61", "comment": "Malware payload (IcedID)", "value": "e89b0550749e2f36a4415dfa6c371429de096e06", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230575, "uuid": "a8f41276-0201-40d6-8025-62fcfdb41c22", "comment": "Malware payload (IcedID)", "value": "2faf7e8339bbae93d06e6c219335d58ad06d28aa69dce638398aef42b51f8c9e95a6a0ea73a3a7e2ff142e44f1ec1e0e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230575, "uuid": "6d3527ad-eaf4-4b4f-8c0e-c5924b3d0635", "value": "0C733731AB695B91ECCA78770255CAB1E3324FC4170377EBFEAC764D2B68981482512F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230575, "uuid": "10bd31cb-7fa2-405b-b505-2eba5800f0ad", "value": "1536:icb8jURW1bTDkNnhipFnY5IE2vYjsR0gHg:N+URC3DMInY54vYjsR0Ig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620230575, "uuid": "e16f0003-8a88-4605-890d-9667e916b924", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620230575, "uuid": "0316cbf9-d54d-47b6-aabe-927d13b4d29c", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230575, "uuid": "98556b60-86da-40d4-9173-f2bbe0c5fb94", "value": "0cd4919a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23c41ecf-ad62-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620192258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192258, "uuid": "fbb5ed2c-9523-4c67-af97-0aef9e74d644", "comment": "Malware payload (AgentTesla)", "value": "a561e3b9844d0220e16e7e2707b61c60", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192258, "uuid": "b387f339-bfe3-45ce-90ef-edcdf07a7d0f", "comment": "Malware payload (AgentTesla)", "value": "5256d9c0d3a1dfe9847c183f28404c449fe728133bada0c7c634d826d6580587", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192258, "uuid": "41249328-1c9b-439e-980e-df59bb997178", "comment": "Malware payload (AgentTesla)", "value": "1206c805ee05140bb9965a394b810ce270ac44ba", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192258, "uuid": "9e100046-83ec-49ab-8f7a-81790271cc47", "comment": "Malware payload (AgentTesla)", "value": "2c6a63a481c98049ecc34ec399f5a9eaac9d92b5b9d74932327dbc4348a92b79061edaea4770e7fe41c5b41e139e197c", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192258, "uuid": "71f822d4-ca8a-4a22-8e12-68849ddd4853", "value": "04C4333F109102D86C748ED6DE99F60F83AD14AB25B9783E216D3FD3871ADA445F8B48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192258, "uuid": "0c653ffc-d81d-4080-af47-b0b3e9a50003", "value": "12288:19KHj7J/sxaRcs7C5L/rzv+rhesEP7de9PWtcQa4M1P:1+j72Zs7gLH87W7de9PW26Md", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620192258, "uuid": "f7f7407d-d75c-4c58-bd4f-13cdaa1d9eaf", "value": 557521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620192258, "uuid": "2112d155-e7a4-48af-a84d-43403b7b56ab", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192258, "uuid": "373efd8a-8e5b-4c34-a59a-28fcd726e222", "value": "Shipping Documents,pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdebcd7f-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241909, "uuid": "346a7f21-0619-432f-8c16-6c598cd8422d", "comment": "Malware payload", "value": "7305346337c73d272785d32357c269d4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241909, "uuid": "b3d53473-9dd1-49cd-ba1f-29012a489d3e", "comment": "Malware payload", "value": "52617d99a8b9f33805ec268f38312c16c8e1323285a4884043ccb878ee4be022", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241909, "uuid": "7fb09344-8d93-42bf-92e7-bc11544fa666", "comment": "Malware payload", "value": "d4c05b087b9af8608b2343e2f18ff5ca4f277ee6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241909, "uuid": "f37029d9-d199-49d0-b39f-9185d8633e42", "comment": "Malware payload", "value": "29a525f22c3c8cc292524cdf4be25a686ddbfaf72f72a9a8d53089725db4da15763d656e9a49e3e735843193a672ddc8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241909, "uuid": "6e7f2c89-e1da-4c79-b531-8f3abe55db3c", "value": "9CF3C085DBABE87FC44A35399071DFFB5B388B145250C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241909, "uuid": "1e6b8189-3584-4907-a923-1c314b928689", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241909, "uuid": "5310ad30-8780-4f69-ab5e-63e05acca557", "value": "3072:7w45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:U4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241909, "uuid": "55a6f897-d54d-43b6-8b51-252015a97f39", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241909, "uuid": "977b2b9c-abfd-4f08-aad6-f63d22947656", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241909, "uuid": "8d6bedfe-ca00-488d-8ad8-fd6c504b388e", "value": "73053463_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41158ea9-ad87-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620208198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208198, "uuid": "e94d718c-3877-4002-aba2-63c5afb65924", "comment": "Malware payload (AgentTesla)", "value": "ec0b874bbd9dfa1773386c04a1918e23", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208198, "uuid": "4c95c489-bf82-4000-95c6-2e0f940f0dfd", "comment": "Malware payload (AgentTesla)", "value": "52a2f5a09b78228b44fe6f9dde56cbd8829a5d3d1ebb5bdfc0fce0bd781f1a94", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208198, "uuid": "66ddf02d-94bf-4d79-8f7f-68845e68e7f1", "comment": "Malware payload (AgentTesla)", "value": "a22aced99fd8e5d86b76b251422c0d97fd7c3c78", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208198, "uuid": "3a993fc9-9b88-4c56-8ec0-8de3c4b90473", "comment": "Malware payload (AgentTesla)", "value": "d9da80cccaccfaafad62182880090d731f887cf587dbb51443d5419de32adf5773dabda91402b0ba73eb20f7ea1820d2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208198, "uuid": "3dcc1aca-f85d-4c9c-b35c-fd8e43d03a3f", "value": "98E4231B63381169CB6ECBB5012840A121B8F304E66DCB9D2EDA45FCA9D7113D796FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208198, "uuid": "2824f354-2ff9-4f83-a08f-c3739646265e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208198, "uuid": "a923ba02-3569-43b6-baca-001e1821c817", "value": "12288:zM8nK1MIqBoZnEuUkJ8aFMTI1CAJU8X6ZcmnVDswbWBm6dAiDf24wy7iAQ4j:zFnKmodnUWHSDZX9swCBm6dAyeG7ij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208198, "uuid": "4df88885-4c85-4814-a9be-92a272d5accb", "value": 685056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208198, "uuid": "ee3961a6-a0e6-4c38-8802-78a3df0a8936", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208198, "uuid": "279f74b6-4207-4228-8b33-7e2f25cb6742", "value": "spreadsheets.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c687db2f-adb2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620226891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226891, "uuid": "b9fe9395-4414-421e-a25f-90b890e8f7d8", "comment": "Malware payload (Loki)", "value": "d5c422ea212c924cf5d360500c87ab05", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226891, "uuid": "6faadaf4-f05c-4f61-9544-746bedbda36c", "comment": "Malware payload (Loki)", "value": "52abf462bcbd7f36e4ee8ed1f60273f397be3d914e200f150d320fb5e726a878", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226891, "uuid": "a3adc23c-eea6-4ff1-b234-afabe6ef4baf", "comment": "Malware payload (Loki)", "value": "909fca4f9a7065327f6c158c3cd4d3f53623b866", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226891, "uuid": "389a046f-4a7f-4409-bcc7-b5a8ea546168", "comment": "Malware payload (Loki)", "value": "1b64ca5242fe7943be7c3758f83a81088406ae6d932810272f29eb1077ea8c1ce11d6d041b069f1cb117220842664186", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226891, "uuid": "31118970-8389-4e85-aef2-a1ede57995ae", "value": "0EE45C0027E45B97C2AE43B9E198E63173F5DE05A25AAB8B690BF9F53F7339144009D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226891, "uuid": "f0d7254a-d49e-40c2-b26d-3d866284d73e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226891, "uuid": "156cad56-41b1-4695-8be9-35b362cf043a", "value": "12288:bE1fxhwL8mLAHefRIZtbVqrTwqEZ02wx/NMdN/NaQ:oZyJAH/ZtxqEZhwxlEBwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620226891, "uuid": "554cd1aa-4cf6-4184-969b-653faa537cf6", "value": 658232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620226891, "uuid": "1a9bf1b8-d733-4040-ba80-65866fcc88e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226891, "uuid": "96bc97c3-265d-44ce-9ed3-8d859f81a18e", "value": "Kvinolsz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6469a03a-ad9c-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1620217277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217277, "uuid": "07a59362-ef96-4414-8bec-830282454fdc", "comment": "Malware payload (RemcosRAT)", "value": "99e166082b19603ff6c4cbebd2641813", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217277, "uuid": "da0caeb1-bbf4-466c-b059-4250d3e27690", "comment": "Malware payload (RemcosRAT)", "value": "52b98cca3167f7f97a7ae7729aeddee0b2280a18841d692697bd6dea415f3abe", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217277, "uuid": "793f3633-2d44-4091-a366-57d937c013f4", "comment": "Malware payload (RemcosRAT)", "value": "407f1729ca0abe94a3202789522807683dfe57aa", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217277, "uuid": "d01b7b53-1351-4a04-9dfb-4fb4b9705a50", "comment": "Malware payload (RemcosRAT)", "value": "0ad4b35b80c6f669c51e5ebb03761495ef597d695b7546258faafeb2d3c946db01af4cbbb82e730dd0fd177e93d9a0fc", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217277, "uuid": "70ef4fb1-6ed0-4864-a37f-e8646cee7a33", "value": "93854364A767716BB9B63174DBD440B8031F28C50B7BEA3C2136B49F5BB007A98E6374", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217277, "uuid": "2c0236c7-4f33-4ee0-ba67-bb68d62eaeae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217277, "uuid": "d6362ce5-f6a8-46eb-a8fd-40480073886b", "value": "1536:ydYidCrdI7XCZGvpsa3i4QYAzZvCoDtlvfLdciM4304D/ut2VfnBPXPXPXPXPXPQ:yj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620217277, "uuid": "cd6ad349-ee36-4f9e-ae5b-77854aeecd49", "value": 1762816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620217277, "uuid": "d7a029c9-e1d4-4a4a-bd6d-3270c1b60306", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217277, "uuid": "954c882d-cced-4d0f-81b0-a06fe906a397", "value": "SecuriteInfo.com.Trojan.PackedNET.703.21955.2754", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e70d06-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252520, "uuid": "6f016141-309d-4963-b4a6-ac0e0b06af5f", "comment": "Malware payload", "value": "8b690f65711a82f791acaefb3f1c3ea4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252520, "uuid": "f74eb414-302e-4ebb-a76e-83d7d50a943d", "comment": "Malware payload", "value": "52f69ced400558ee96e75c9132562ab24b441b574c30630e8934270c672faae1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252520, "uuid": "7e85500d-456a-4cba-83f3-f991c523d98e", "comment": "Malware payload", "value": "d77894e2da7902e9fce0b0756905ed7c67175158", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252520, "uuid": "42bcf7b6-5856-4480-b5b1-34a7ee302944", "comment": "Malware payload", "value": "d26d9af4200f87678ac1f4f147e6f891f36b3a823eedd5152830990158ae69b647b5a25457ff031e56eb7f18d1796f5e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252520, "uuid": "bb73810c-9b10-40e3-a2a4-65174cd13464", "value": "64F3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252520, "uuid": "5628503e-812f-4519-b1c4-48c5fca2d12f", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252520, "uuid": "4255f0b6-cced-45ef-8843-39a96b78e725", "value": "3072:4R4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:VDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252520, "uuid": "7cea548e-2534-4e13-babb-1b01ec2abed1", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252520, "uuid": "83f8cfe9-3390-41bd-ac30-092755c8f37f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252520, "uuid": "1a951cc3-55d7-483c-842e-f3290c909269", "value": "8b690f65_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7132c74-addc-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620244957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244957, "uuid": "4ab1bc47-066e-4678-b2df-1d9a64679147", "comment": "Malware payload", "value": "b847565dbc1c9ee09cacf52aaa10847d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244957, "uuid": "68d50829-d8b9-4469-9655-49c95e4b366e", "comment": "Malware payload", "value": "5304e6050ccda180d70240ff3a2379f4056f9d5f055397a4215ed76b92a0654c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244957, "uuid": "a50933ff-316d-4ff7-89a7-524dba2cdd39", "comment": "Malware payload", "value": "6e5341166236f864a10efdc6b58dfb92d52d93d8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244957, "uuid": "7a7588e4-667d-4278-8ecb-faaab7c8c87d", "comment": "Malware payload", "value": "5eb92124642c44daea58b0193c7c1b5f18f798e64740b28e6f22a6eb683f814ac489a180df7fad23467a5a09900ef8ec", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244957, "uuid": "7f6f50b6-3c85-460c-8820-58775cf36e3d", "value": "83F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244957, "uuid": "c3406973-8c3f-40b9-8b2e-3579f2ba7577", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244957, "uuid": "b8b23b93-7bbc-4abf-92a5-0c6781105eb8", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620244957, "uuid": "0a6380dc-25a8-4f48-b8b5-8409e29f69e8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620244957, "uuid": "7c6548a9-c01b-4196-b9d2-2b99c5d48ac4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244957, "uuid": "75766698-40e8-4f94-86a9-7d020313b880", "value": "b847565d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e1ffc52-ad93-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620213347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620213347, "uuid": "a224e3b9-1bde-4994-8940-9135bfe48918", "comment": "Malware payload (RedLineStealer)", "value": "89562d324385eb107254b8af6379426b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620213347, "uuid": "01873d78-8619-4481-8513-f58e8b2e7171", "comment": "Malware payload (RedLineStealer)", "value": "5312f25b2ddb5ca623a0b4aa73a43af58c217646afacf4dbd2995dacafa80c77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620213347, "uuid": "6f636e59-df1d-4335-8982-f11eb0abefa8", "comment": "Malware payload (RedLineStealer)", "value": "bcf7675f164f85d85092cd2c9fe2085aebbcbe7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620213347, "uuid": "1f6e083e-b31b-4fc0-bd5b-ce8fa6e54864", "comment": "Malware payload (RedLineStealer)", "value": "957502689b29089143a63cb060142736005a79b023bd2ad06acad02fc363449a3caf7e6f59ed25f460f56623befc7df5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620213347, "uuid": "40d71408-517a-42d6-bceb-793b95b330c3", "value": "87933D25635C4B14F7BDCBB574B0017647F2D0CF6012EB6E8FC5A4DE6E267832A445A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620213347, "uuid": "38a85d10-55e3-4dec-92a3-a28f9d21ec25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620213347, "uuid": "dd0380ed-3115-4d4d-8a5e-2f6d42b6d227", "value": "1536:CZzQ4i8fr2GlGxAJmv2Mos+umb3A6spofRkGyJpd4isxM1gEiTh:34bSkKpy1tfRlyjd4K1zi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620213347, "uuid": "d8ef107d-6844-4a52-bd26-7220335b88ab", "value": 89088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620213347, "uuid": "94847dcc-4d8d-40bf-a496-6cf7320b3626", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620213347, "uuid": "895e6072-dd8e-4512-9d9c-b9e69c655f2e", "value": "89562D324385EB107254B8AF6379426B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc0782a9-add4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241583, "uuid": "7e143ec8-acb2-499a-8874-7b169c79e432", "comment": "Malware payload (Dridex)", "value": "2d72a5ba107cf4a7c0d583817188ead7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241583, "uuid": "ff8e0a13-7b6b-4016-b56e-b945fe2a76b1", "comment": "Malware payload (Dridex)", "value": "532177b96510c2c47e5f5a207beb4b54561668db4214e597527a9e8e9a204b01", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241583, "uuid": "ed9153d4-e835-4095-92c3-a9da010b87f5", "comment": "Malware payload (Dridex)", "value": "7c297f94168b5b0af15fab6328b38788c206360b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241583, "uuid": "878e4a98-4d05-456c-a74c-4da41cc49e93", "comment": "Malware payload (Dridex)", "value": "153dfe0c8fbf9f9ccd17dd2dc311baac6e9c398584ead2ccff7b051eb637197a7ec47872aac03092204662afefe73030", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241583, "uuid": "67834f26-85b4-42f6-840c-a78dedfd149a", "value": "07F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241583, "uuid": "da903282-76a8-46fb-a7f8-85fcc82f7e24", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241583, "uuid": "495c61e4-ddc2-4ecf-b360-56c1a36960bb", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241583, "uuid": "3e4d7be1-986c-463f-bee9-f138eaeb392b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241583, "uuid": "f3ba77fa-ea64-4aad-a2b2-ee2f4ff920ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241583, "uuid": "b800370e-ea13-4c78-aa72-4275a0cb651a", "value": "2d72a5ba_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "812c0a99-adad-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620224627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224627, "uuid": "b2382ae3-055b-41fb-ab76-76f96e8ddcdc", "comment": "Malware payload (AgentTesla)", "value": "db2d6bd2092907ffc099b467315177c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224627, "uuid": "a13a3216-d47c-418b-a2f6-b8f8535139b1", "comment": "Malware payload (AgentTesla)", "value": "5402e9250c7e91ea7e8c7261e2b3b566706bc7ebf8deaf926c88fd99613fb6b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224627, "uuid": "7a3022c6-468a-4dce-9ff9-3ed4da8787ce", "comment": "Malware payload (AgentTesla)", "value": "1b67ef821bf9c94fbcf3c76fca2dacd22af22ac8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224627, "uuid": "a193e0c5-f709-4774-914b-22e57613c98b", "comment": "Malware payload (AgentTesla)", "value": "b3311da7b50fd9dbd4c74a6e021a20b3955ec9f2705293801bb332f7027cc58ea3ada92de109f53c62ae2074b3a55aa0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224627, "uuid": "a394d2f3-1f0a-44eb-a32e-e3a63f0063ac", "value": "2715023E65097F00D97E2B3BDDA5C1A066B9FC13AA23C62E25E036AF5AF6FF40110115", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224627, "uuid": "cdcbffc2-b00d-4d5f-b928-094890dc6fea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224627, "uuid": "31271ef7-1bcd-4d25-a555-68e6d36a7e4b", "value": "24576:4HIMvpR/H3p4eNzla3FSPRuZ2brGSiEpj:4HIspRBBNQoPR/jp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620224627, "uuid": "1ae122ed-801e-4a36-a8a5-ec56c1e53c67", "value": 934400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620224627, "uuid": "a5b7f525-ce04-4c43-abb2-b62566959b10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224627, "uuid": "6e70ba22-6a81-4854-8629-6ca8d0497761", "value": "TEKL\u0130F \u0130STE_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c358ac32-add4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241488, "uuid": "c1639886-78c6-4bba-993c-7fcd2b4e0a0e", "comment": "Malware payload", "value": "69406ac681532c10903e006da9081654", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241488, "uuid": "b5e3c0fe-e7e6-4ee4-95bf-e441410316e6", "comment": "Malware payload", "value": "541aaf51a1cdf9890486b403d477f9b0150c9612039fafba256813f3966ba79e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241488, "uuid": "14f3ff47-b030-4fd7-992d-925b8f3ac01b", "comment": "Malware payload", "value": "3f6b6d00be4ba8094b21c1e99b09aebcfe007f3c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241488, "uuid": "0cb3b542-b5f0-415d-ba46-9d6c331cb2b8", "comment": "Malware payload", "value": "d2434155d287873813777ed2c168d6429b45ae8d143edd794a93c298a6ef7886c16cb33acf801ae24d556e309dd57a1a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241488, "uuid": "52860a43-b55d-493a-99df-d116c611e438", "value": "19F3C085DBABE87FC44A35399472DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241488, "uuid": "f6a21bc7-0ee2-4405-8d6c-10b9bd644ab6", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241488, "uuid": "bc474ac1-aeaa-4383-8374-6ba588abea8b", "value": "3072:RX45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:d4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241488, "uuid": "377c148b-cf9a-47fb-9ab1-7845813ee545", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241488, "uuid": "98920c75-e3ba-4f20-8738-2d19f0ba6129", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241488, "uuid": "219055de-921c-4a35-b662-4f5aa794b9c3", "value": "69406ac6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14547e13-ade5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620248496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248496, "uuid": "42e3f0a6-8e52-4ae5-94d3-b11ceae869be", "comment": "Malware payload (Dridex)", "value": "ad1a2eb8f36543578c63569aa446155b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248496, "uuid": "abc5ae66-aa94-4d64-bef2-0914a5afa4bf", "comment": "Malware payload (Dridex)", "value": "543cd0985efe56518c631085ff3c0821736133bdbb3d47d9f41e15144d7480a8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248496, "uuid": "1dcb1a4e-92e5-4735-88d7-9abe0652a0fe", "comment": "Malware payload (Dridex)", "value": "55e120ab1b2f338643fcb6d8b1cc7b91949ce833", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248496, "uuid": "270ec8a6-557f-4fab-b403-80a6db61a854", "comment": "Malware payload (Dridex)", "value": "7d0eb490181fe8e8a052d2d4de33b745666a062df94467546a65fadc8a174bc7ff993e68364f6379be6e5444c0b6854b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248496, "uuid": "bbddb90d-a75d-4c4d-8be5-416f3c17d299", "value": "ECF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248496, "uuid": "340db86c-2403-44c9-b026-a35c08279f73", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248496, "uuid": "a83245b0-0c18-4382-832c-f5c47c414ab5", "value": "3072:SiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ReAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620248496, "uuid": "c2239438-f087-4772-a7c1-52f45a6280b7", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620248496, "uuid": "c19a0277-2907-4c48-b0fa-1e985b6c4dae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248496, "uuid": "46fd6719-a836-4429-8052-26580569919c", "value": "ad1a2eb8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2664bee4-adbb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620230487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230487, "uuid": "ecc00000-0cd0-4ee9-825e-7db62824dd80", "comment": "Malware payload (Dridex)", "value": "bbc82993ab0f261fd8967391fb2fbf32", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230487, "uuid": "1ba6e0d9-2686-4a2a-8e4d-c9e48959d4ea", "comment": "Malware payload (Dridex)", "value": "5477196861a6c8c018acc6075ece9b7f197f6ec37fec03108aea49b2394dc3ed", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230487, "uuid": "2a47dd1a-6f5d-4614-bb2e-55aeef9356ca", "comment": "Malware payload (Dridex)", "value": "1953bcca5b64a58e43b10287ee361ab9c4f52427", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230487, "uuid": "6b4c4230-e7e1-4a47-9086-a08511e752f3", "comment": "Malware payload (Dridex)", "value": "4183f1e92c9f09890a6e3f1195db941de250c204314203e960ca798278eb6ba9a5f18d5d408ecb244f0eade72f6659c6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230487, "uuid": "e2392007-d69d-4118-ac73-bc32ecbf9cde", "value": "53F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230487, "uuid": "533c64c7-4829-47fa-85d4-c036d1c3504b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230487, "uuid": "ea8ce492-b024-4d1a-ba1e-b26572a29a62", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620230487, "uuid": "8142dac6-0d55-450d-bb64-649fbe6ecf3c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620230487, "uuid": "e924bdee-f030-4a50-bdf3-89efa0ea5ee1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230487, "uuid": "45c6d1bf-9e8d-41e5-bfc3-13060f655251", "value": "bbc82993_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aca8933-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252345, "uuid": "926b567d-1547-4a42-85df-aaea3c28e0dd", "comment": "Malware payload", "value": "c0341e16f4197ec1237c0ed327df9989", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252345, "uuid": "df58c830-c2ea-476c-82f3-29d72d8e3e2c", "comment": "Malware payload", "value": "549a583d79516ceb4563647fbd5d13eaa6e04864c6e6252b6c4a836071123d4b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252345, "uuid": "144605e5-bac5-4650-b230-82a0b36888db", "comment": "Malware payload", "value": "e3210eda56959ea24810ef24afb7c9cbec1929f9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252345, "uuid": "0baf2fd4-9244-4421-b101-b87c7dc8868a", "comment": "Malware payload", "value": "93c0fe805a323482b4fee53e4324e9fd3391934763232ff8dea3a4e161b699d5d4051ca0ac9e47bfc5a4d50430136b09", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252345, "uuid": "c947e1c6-2375-4926-9cb0-d6546c0db1d0", "value": "83F3CFE89A9FC097E663583055FF3BB6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252345, "uuid": "103706ba-b983-40a5-9294-4ff192a0a440", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252345, "uuid": "ea5ceecc-45b0-49b6-ac7e-173180b5852b", "value": "3072:rf4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:0DBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252345, "uuid": "5772ec82-4782-4384-bfdd-97028693d589", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252345, "uuid": "6bcff680-ea34-4099-b932-4e0649651c11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252345, "uuid": "b73af6bc-72fe-48b7-a45b-4bf398a703b6", "value": "c0341e16_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c835b1a-ad8e-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620211251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620211251, "uuid": "9db8edcf-788d-4236-aea8-b6c8aca6c1ab", "comment": "Malware payload (NanoCore)", "value": "cffe137d6126c6a358d8ab5349ac62ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620211251, "uuid": "a8a98ed5-8b0e-4048-a56f-617ec7e9f612", "comment": "Malware payload (NanoCore)", "value": "54a3c9b855bfdd28ac12cbdf08b0ffe2a29ded7e43059f763cfb755f3442c2fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620211251, "uuid": "27999ccc-7d65-4989-8ef4-b6a7a3160b85", "comment": "Malware payload (NanoCore)", "value": "64048165f2c4986d5c81b28a6ae5da94d83be6b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620211251, "uuid": "972454c9-1c50-460a-af9b-470e7e2853c8", "comment": "Malware payload (NanoCore)", "value": "ceb72e59737fd72af304aa9c374afa2c654e891ad6a8ff0ce4fa61a03e95555ab4f3a85d97840d42cdfed279e1792ddf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620211251, "uuid": "686b114c-b725-4fa0-9d49-b72a15c8d593", "value": "075592AC325031EED567DAA69BE82C24E6203476972F4107962303FD9A0EF57DF245E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620211251, "uuid": "1185d75d-7773-48d1-b5a8-980a23285db0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620211251, "uuid": "bbf96d55-a18d-4be1-8446-1040ec7aa368", "value": "24576:5GT3uAhgsIUoLAesG4BQ5pWLKg0JT5QtNJ:5GT3ukG4adg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620211251, "uuid": "170111be-a514-459e-8bc3-ede84b6df5af", "value": 1333248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620211251, "uuid": "cdde1998-2746-4ad4-ab5f-68941bf2fff9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620211251, "uuid": "4ee1dbf3-aec5-4896-8492-033145e8d757", "value": "PROOF OF PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07262166-ad81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205524, "uuid": "dea49663-af84-44a6-9ca9-6489d1652371", "comment": "Malware payload", "value": "8d460b8accf213a6509699aeaa00564d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205524, "uuid": "99ca3d57-62f2-4e0d-8c4f-f9fe6f443d5d", "comment": "Malware payload", "value": "550b8fec0b67c94a9e01f92d2687fb227599e0af24ebe26a518b5db52db592b8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205524, "uuid": "5414842c-9218-465e-b4cd-9160447d4606", "comment": "Malware payload", "value": "35c6e18de73c1caaf8f31e84ad4f42230611c1d9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205524, "uuid": "11ce707f-9301-4031-a91f-5abf3f3ca3e2", "comment": "Malware payload", "value": "021479426ccc610c4fdaa0c04a5b59d6ad6188521b3656a60db7a1d78161154b8c96cd5759a18580d9056003d6c0535a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205524, "uuid": "6b1cc067-31e3-43a5-9b83-2ea69053f0d7", "value": "7CD4F12AD671C8D9F9C89E38A1F4CE175CD11871BFC70C0BBB089BB552127506929FBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205524, "uuid": "71965998-8acd-49d1-8f97-e8e65054570e", "value": "ce5b45e359d9ad2b9c5618f5a8714799", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205524, "uuid": "311966da-1e44-4d90-8006-de3924a0746e", "value": "12288:MAy+u9jcOp19rUzx8cYDBDtCd9zNv+cK0ru2y7+sh28JBVgIKiC:ML+u9wOyzx8bDdt0zP3r6sv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205524, "uuid": "25e00ebe-11c1-4ce9-a69c-e9adb7523ed3", "value": 651776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205524, "uuid": "1c37f1bc-de68-42d7-8853-b21b106d3d78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205524, "uuid": "812d1523-4ef6-4a84-b38f-cc6b19096a61", "value": "8d460b8a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8384a455-adbd-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620231503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620231503, "uuid": "b5bf328c-9a4e-44d6-a4a9-b80efcbc0c22", "comment": "Malware payload", "value": "2b1b39276d0f7dff4324fb91f10a559e", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620231503, "uuid": "35e05e6f-e3b6-4f2c-a855-bfd88446a59a", "comment": "Malware payload", "value": "551da43eec2156e0439c49d95550d3e1aee42c8caea637b657c456fc63c4cb84", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620231503, "uuid": "7ee0536b-86f6-41df-9723-cf0b89d66e93", "comment": "Malware payload", "value": "a9521f859d6aa73161f222cb5f3aa73569d85935", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620231503, "uuid": "7e054978-bbe1-4708-9806-d2c04b4fc42d", "comment": "Malware payload", "value": "6544a631db5c5210338fbc558c6b966c8a5d29d5d18a772ce89e32a21ba294388f1314da862272b00126783daa295781", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620231503, "uuid": "81b74c74-69f1-40c7-a708-cc031439910e", "value": "E584124B728E2B07FB7F567D0B7559600B60DD1AF336AA6663D4F0CAE534722C818023", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620231503, "uuid": "902978a4-f713-4dd5-96ff-038172296faf", "value": "6144:KpGK4QugOW1A3+KSHjgxPn/fQ1zH6jORg+A2o7wzwhmrBeiDcrVhqGRFv91tLiOM:gGKkgOWm+inQt6jORguwQeOE/qMHeOkl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620231503, "uuid": "efb02d66-67a8-4881-af2d-c0f7d8337ba5", "value": 375808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620231503, "uuid": "586014d5-7776-475a-9877-2c6bf5465806", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620231503, "uuid": "9c477e2f-5037-4773-b08a-216610d65db9", "value": "TT swift_copy.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07487eb5-ad92-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212826, "uuid": "8dc20037-cb29-42be-8019-33c889a0d7fb", "comment": "Malware payload", "value": "ee9fa205e6ad75f69bb57493b40a5e77", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212826, "uuid": "e36288a7-0107-4c0c-9f03-b83ab47da053", "comment": "Malware payload", "value": "552119bbb368c04d0bc93f81ba9162b4a7561e4facba628fc7eb3749d62af6a8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212826, "uuid": "6771de51-0511-4855-9c8f-0134f6ab3f4c", "comment": "Malware payload", "value": "864fa0339c40d4adf1ada3f259d9539114589028", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212826, "uuid": "51fb94db-5716-4d8e-acda-5d7098acbf3f", "comment": "Malware payload", "value": "a137f49287bb59c7b59535604091ef44f4892dd7029346608927d80b80e33cb93138681515e7816380618c70502fee42", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212826, "uuid": "f540e750-77d5-4d5a-8388-d9b12221ee8c", "value": "D8F4C00973753EA1FC95D8B9168C05DA068BC782D49EB3B2FA6780E5C79254C091E8FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212826, "uuid": "5fe648c3-4608-44ef-bae3-d134dc17a84d", "value": "2b4629ab03d9864b819e72931b1b6e0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212826, "uuid": "d674e575-a6f3-4d71-9d4b-7e3bc7297f61", "value": "12288:5pz18HxBrhoQL+OrCGLbYJGrgWizUNCSYXKRC6x8wdIj45mKtHTm:5yxBVo0+OlbYJMgWp+aE6hMgTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212826, "uuid": "b1353d7c-b561-4e01-8027-2512921ff35e", "value": 769024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212826, "uuid": "089dac71-f9d8-4a19-83ed-84dea622106a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212826, "uuid": "5f7304e9-34f1-4b98-b7e6-3fae786d2baa", "value": "ee9fa205_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "050be3fe-ad81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205521, "uuid": "383305b0-e062-43f1-8a89-c3ce7fe5aa9d", "comment": "Malware payload", "value": "d4e34f5fdf552ddef902c7c6da4cfe85", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205521, "uuid": "37c84e63-09ce-412e-bc33-2fea18375e37", "comment": "Malware payload", "value": "55817eaaf77d256f05235bd8cdcef790e0a8a1b6bb4f61a5516759e111ed37de", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205521, "uuid": "d1d692bb-32a5-471e-9756-133a378c71bf", "comment": "Malware payload", "value": "72d754b88bbe38ed455335f55d56fccb8a4d071f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205521, "uuid": "f781458a-bb0a-416c-9abc-78c8474236be", "comment": "Malware payload", "value": "7402373b9acf18f2d535e5d8fabe1c607bff4db7c7eb54e0684d856f5b464c539f633c8cee4bdfc899d04ee7b1f20ac9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205521, "uuid": "aef6fa34-4e15-4137-94aa-94891a9fe746", "value": "03F4ADB7FE387623E510E672B0BA57D0255DF8CAC4C8AF4BA8A742415FB507972831D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205521, "uuid": "4eaf9806-a4ac-435a-b3d3-245d58a42f07", "value": "0d951177934f5737b92bfcc140f1e269", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205521, "uuid": "441ad378-5f5e-4211-8be4-45876059590e", "value": "12288:vZQMs2AcPa/V+fwjbnjBc1QN6eNSPR+52VcrvP3Wdikaowz+jpb33a7zTm:v8ffjBN7NSPR+5jeaX63OTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205521, "uuid": "7abbfc0f-5a6a-43ad-9f9d-0ab1d6541898", "value": 763392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205521, "uuid": "855f579a-cd9b-481e-be65-773904dea3a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205521, "uuid": "eda9332f-b80f-4b10-9df6-f009639a5599", "value": "d4e34f5f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "580a987f-adf6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255911, "uuid": "fff330e9-48f6-4284-b364-119cc6a47f8a", "comment": "Malware payload", "value": "86d8ee11e465021b9b93fccea89c0b6d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255911, "uuid": "aa73b9c3-d90a-42d3-9dbe-b77406b936d8", "comment": "Malware payload", "value": "558dff99a949374672695ce4eb15ce1b7cbfd13db8e01940eb59cb860ed89e73", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255911, "uuid": "bed5aa04-ba6e-4bbf-ab4b-b7415cfa7432", "comment": "Malware payload", "value": "255edf730cb0635f50883d7f1e1b78a94dd6604f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255911, "uuid": "18586f87-7e0c-44f5-b393-e936151be022", "comment": "Malware payload", "value": "ebc7ae3ea78ddee2d8983d967f96a6cfe801503d50aa6731c92b63895bffcafcbf2dca0465dc529f63c8e1dd548181eb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255911, "uuid": "093a7b9a-7a8f-47b4-8175-59036ce99dd8", "value": "D5F3C085DBABE87FC44A35399072DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255911, "uuid": "2cf0e099-4c99-45e1-bf6c-c1cb6d5da568", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255911, "uuid": "f2d4f479-1032-480e-9523-a2ac137d804e", "value": "3072:RB45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:74KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255911, "uuid": "68aeced2-2d4b-4dc4-8e37-a5525472d645", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255911, "uuid": "2e851935-c5b0-4633-8c17-ddac4e1a9e4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255911, "uuid": "c41f3eab-55da-44da-a01f-a3f554226510", "value": "86d8ee11_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae20cc9c-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212676, "uuid": "c3a3654c-c4de-4c5c-ba5f-3f8ecdb16491", "comment": "Malware payload", "value": "b4bc45c2af7967c7011141e34f63cd16", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212676, "uuid": "306db1c7-c4e2-4d2b-bc1c-ce50f161bc52", "comment": "Malware payload", "value": "55ddab007c396604ad98a0cc022e9f5187b45cc601cfcc7ef0cbbe6332c613ef", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212676, "uuid": "7b04d2f8-a028-45c9-a528-8f79d12704b5", "comment": "Malware payload", "value": "7c6bd41a4598a7d5d48836e73933450c21491e44", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212676, "uuid": "26ed49c5-ab7d-4f92-8381-ce35b0d1ede6", "comment": "Malware payload", "value": "8b72bf3265b2bbe2502fcdcdee5b6813caf8a4bc5bea413befb5e3f8fd8372d8982e9b25f2239b82d247d82c50af44eb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212676, "uuid": "ef09ec6e-d95a-454c-875c-7e5b530c9334", "value": "6BB65A7E15B2109AF5E78AB11FD339F4A6B1142533B983DCBE64826C5E1827E087F6D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212676, "uuid": "80f1c663-4556-4f2b-ab5b-7355d7311936", "value": "a64e048b98d051ae6e6b6334f77c95d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212676, "uuid": "dce9a876-bc94-4787-aea5-161ab112d5f3", "value": "49152://LtW1F/LvM/LtW1F/LvM/LxudM/LHlN/LvM/LtW1F/LvM/L:/xgFw5gFwYKvwxgFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212676, "uuid": "92b4f563-bb9a-4ea9-b4d3-c6575acdfd5a", "value": 10497536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212676, "uuid": "42f749e8-e458-4110-8d2a-6febc7c7ce61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212676, "uuid": "8dd4535f-c062-43f8-b730-de1577f9a0d9", "value": "b4bc45c2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc5c4a24-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252268, "uuid": "dd3c8e60-81ed-4b34-84ab-e6fc7ec554a5", "comment": "Malware payload", "value": "02d8b4b2ee16f94a1ece387060c1e493", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252268, "uuid": "6bf40779-84be-4e4e-bea5-75061518a453", "comment": "Malware payload", "value": "560436de82b4a1596f9929091a4ff51d17cf3b390ee9319e4d63c2aacf8c48a1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252268, "uuid": "6f70cda5-f525-444f-96f3-0167f5d8cb18", "comment": "Malware payload", "value": "c78e6b7b0d9c78a0814979f4074d426586e7a4fd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252268, "uuid": "e95c22aa-3d44-4315-81b4-4f710d8dda98", "comment": "Malware payload", "value": "85fdf91b3fc8561a24cd0e0ec24a5d414f77f41d1568e3862cfaa51ae346086e343f94a8d5e85b08e7db5eb414fc43f8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252268, "uuid": "70a2374f-a12a-4898-aa12-3e065bd8ce7f", "value": "81F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252268, "uuid": "2732796a-db2a-4208-840c-c4fd9adf8bf0", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252268, "uuid": "ae73102d-f450-43b4-bb50-9c4b99037f16", "value": "3072:XQ45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:A4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252268, "uuid": "c6283b29-c1f5-4015-9e59-131f7f741e1d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252268, "uuid": "97f0bab3-0001-4ea9-8003-be90b423071e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252268, "uuid": "8a30255c-cc6f-4ede-97db-ce4ffee5385a", "value": "02d8b4b2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf38ff4-add4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241531, "uuid": "dbbe197a-f114-441f-be90-be28b6543650", "comment": "Malware payload (Dridex)", "value": "041134be54f0662fdbf6930bff22f14e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241531, "uuid": "c0eb4d0f-aad0-41cc-a903-9d50d80d4e42", "comment": "Malware payload (Dridex)", "value": "5616ce9de26cac721d68b5614a59a58a4eb17804a61157d82ccb6f75632144ae", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241531, "uuid": "3312a4e5-2202-48eb-8d16-e004eba17b97", "comment": "Malware payload (Dridex)", "value": "44cace45b01a982a7049e078edc2c3e0f3389b8e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241531, "uuid": "7987f708-b151-4582-9355-525939f7675b", "comment": "Malware payload (Dridex)", "value": "72db4b7dff231e526b1ae6c103217e68b3fbd1c9fd1893e6b8b9464b3baa3d6904cb186649ddaca119e9bd89025b71eb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241531, "uuid": "4598c6fb-af32-445c-92ac-feab178ab87a", "value": "7FF3C085DBABE87FC45A35399071DFFB5B388B149640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241531, "uuid": "c8701723-809d-405e-bbeb-1e095295298a", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241531, "uuid": "b16223c9-57ff-4caa-80db-73c5eeb8be5c", "value": "3072:M945bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:u4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241531, "uuid": "6fb2c174-8cc9-4dc6-bfa7-6c511041d350", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241531, "uuid": "3b26744e-be30-495e-bffc-14eaa374ad3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241531, "uuid": "3069bc64-a669-466b-9d8e-1657353bf4a7", "value": "041134be_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32ffec4-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252279, "uuid": "7191c760-f919-4c5a-ac23-82d9f97b48ab", "comment": "Malware payload", "value": "032f8374d777fd43fc141555ce2b1ab6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252279, "uuid": "e24f00ed-988e-48e1-8d96-c58846847893", "comment": "Malware payload", "value": "562837de70cf047ec400e76bc4311399012cfea05bd893396a6e821e0c418d96", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252279, "uuid": "75715968-6c0c-4ed2-907a-d06907263c06", "comment": "Malware payload", "value": "19e292dc5b50bb52decb9926d6dd90fac24ba988", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252279, "uuid": "94a4d6fd-1869-4902-8a2c-887da6ad3eea", "comment": "Malware payload", "value": "1589a680346db7bd8155f24dca783b3857d9cc9d5708f22ab3067700e7b3a1bb00bba1db5622e9d4ea9ae963a90ad236", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252279, "uuid": "2cd88ea8-be28-4c9c-b1d7-08d097effca4", "value": "DAF3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252279, "uuid": "a3adb382-2333-4593-ab1a-129c4b88e1f5", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252279, "uuid": "b4c4b74b-5648-4d1d-b477-4164a3b2b099", "value": "3072:zd4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:6DBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252279, "uuid": "f0dc4867-17c8-464e-b1a8-ce2e5449e791", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252279, "uuid": "aa408821-0c99-4b66-ab6f-292ad03b45dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252279, "uuid": "ad0423ab-3198-406f-bcc4-caa4fb747f35", "value": "032f8374_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb155e01-ad63-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1620193022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620193022, "uuid": "49f4d0fd-7475-4516-8766-cf8c91f6d060", "comment": "Malware payload (Loki)", "value": "42701621df3d04e8ecb5a97d431ff117", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620193022, "uuid": "e7ebda4c-9211-4117-b50d-443b1c61f13e", "comment": "Malware payload (Loki)", "value": "566fe333e3ad3360ed8851ad9111e3e17e169ecd5f540993eb1d70bf4cc65662", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620193022, "uuid": "ddeae9fd-cbf9-411c-b9b3-ddfb9e5bef00", "comment": "Malware payload (Loki)", "value": "b0e044278e2ceb24c0e6e136a143920e6547e737", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620193022, "uuid": "b1fd4c4d-5753-40ab-92b4-9b5fd76154b2", "comment": "Malware payload (Loki)", "value": "30e98fbd03f0ba65721cbcf62d59e61f45bf973d420c3ed14ba72b3ed0c5975c6a1e9ff80ede1aa50efa5dd588ee4915", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620193022, "uuid": "534897b6-6186-47f1-82d0-5b0b11fe52d0", "value": "C0953852CE554E0FD92E13B540214744ABF9ED71A2F9EB8D6DC9B0F9ABF37810B09422", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620193022, "uuid": "f685fb8a-c034-4c6b-81df-6e2c156a035c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620193022, "uuid": "0e58360a-917f-451e-8413-355c54269ff7", "value": "24576:oRSmBeFdV2j61ncKsZ7pipjpzfhyV0Z94HcPBDmITlRj3a1:oRtzW+fGzfhW0foedxRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620193022, "uuid": "21ead195-9a70-4d8c-92b0-83835e99f348", "value": 2001920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620193022, "uuid": "5d2aa98e-53ce-4998-92d1-f219cd16a851", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620193022, "uuid": "d586e9bc-a00c-4e73-a0bd-a9eff3ff2d37", "value": "2ND SHIPMENT FROM INDIA -- CLEARENCE FROM JEBEL Ali.Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc470d2d-ad94-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620214042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214042, "uuid": "5dc0b762-7086-4941-95cf-1d9906140d97", "comment": "Malware payload (Quakbot)", "value": "dace8bbca42cf566dce5d245ac318ec9", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214042, "uuid": "d06f627b-3029-42cf-9b1e-f3226f2469d2", "comment": "Malware payload (Quakbot)", "value": "56b00d4f0f4024914cf657ba675f25ec515f43f13471fa065bf5fa46a5cf1db8", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214042, "uuid": "df6832b4-e63f-47eb-8f29-936b0f214dc7", "comment": "Malware payload (Quakbot)", "value": "47f3abda0722563785f917e646d464cc70dfa71f", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214042, "uuid": "483ea134-fb24-411f-ab9e-4a440a9e35b2", "comment": "Malware payload (Quakbot)", "value": "9559c8fcff8251d6bad73914729edddbb55f394a2077dcb9dc5a821ba66c57406d75a1f8c7c3bc7134c9aa347834267d", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214042, "uuid": "ad562033-e862-497b-bdaa-d2dc47cfd8aa", "value": "7D05BE3D7AD9C13AF257A03C489EC5F25A7974186A1F37CB34CD2FAF1B227904625286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214042, "uuid": "0d0e808f-4714-458e-9faa-3a99781b199b", "value": "58e1839065e68574871fca4d5e191ff6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214042, "uuid": "c5c2e2ee-328c-446b-99f3-5bdac43aa4a5", "value": "12288:B0CIKTA4ZHoeJnCB67crA87npTRQXOjytTr+lnPdJdgdzbrw0SqGEWHqwSIf:B0C3BhdsBmEXpd+xCLWzn6FupA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620214042, "uuid": "bbbadeef-9057-4b12-8cad-317bba19ef6a", "value": 816132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620214042, "uuid": "fbee67a3-85a0-4d0f-8f3a-05e6ce5aac4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214042, "uuid": "42c96b45-78ed-4a64-8622-cfc9557b592a", "value": "0Ye7IY53U4Aws3C34pZ7.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "719d8a55-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241781, "uuid": "75462055-a4a7-4d5f-97c8-b7bb12a44417", "comment": "Malware payload (Dridex)", "value": "09e72b806848b350af66149b87bd3b80", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241781, "uuid": "5a3ad84c-22ca-4d45-a5a1-464fcfee5a09", "comment": "Malware payload (Dridex)", "value": "56d25b830af26c37f60b08104a300f4cfdddb266c26cd1280fbc85b33c8ba3f8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241781, "uuid": "fae1b76c-fe8a-4457-a132-3876fc16a865", "comment": "Malware payload (Dridex)", "value": "fe6eaf0cbf2783d0322d88e3cf2e2d9aab6739d8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241781, "uuid": "e1890ef6-5060-4336-9eeb-f1f9c82f1400", "comment": "Malware payload (Dridex)", "value": "2fe4200624f5726615aa0bb642d6dd46a916e91b30f29417c412f8df06752dda7a667ffa8485b633f46a6382326b643a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241781, "uuid": "655e533e-3e9d-4b4b-9c0b-e1ecae64a7e7", "value": "A1F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241781, "uuid": "81a62a83-13b0-4eca-a03f-7249e0660e6a", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241781, "uuid": "aeeff92b-2f89-4bb1-a8e8-147573705229", "value": "3072:ze45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:i4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241781, "uuid": "67badb3a-c4e9-4805-b205-66e68ecc381b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241781, "uuid": "890ce912-ae34-4a6b-9e78-85bd791847ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241781, "uuid": "87477105-42c4-488c-8eb5-083d001d6e22", "value": "09e72b80_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7b631f4-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252179, "uuid": "d28bd12d-0058-4293-be47-58c5669c0926", "comment": "Malware payload", "value": "ff73334c6ea9176d1a5ae409b10acced", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252179, "uuid": "14e4b79f-599a-4b75-b700-2e17929e20f4", "comment": "Malware payload", "value": "56e57338398a98e2c3ece4736b1b5ee8fda74c0b75830ccc3b8c884a8b72d7dc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252179, "uuid": "a65ce5f7-edf0-4bc8-95fa-e56b2a223573", "comment": "Malware payload", "value": "d1b90c38136c3e08617405a7adff6ea510545b0c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252179, "uuid": "ad32ad73-7e80-4575-9754-b19bbb9625cb", "comment": "Malware payload", "value": "58e1dc9e33eb99aac885949ea29ef9b8df3e07ff9bb38af73248bc9cf841efcd85c1cc27ff62d267b3fc93a3dbcc901c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252179, "uuid": "fe708d40-9247-4aaa-82ec-467210f2c874", "value": "59F3C085DBABE87FC44A35399072DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252179, "uuid": "438e5afa-ad1b-47ca-9ed8-7045ba49f3cc", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252179, "uuid": "c844d1ac-8dbe-493b-998e-173741e63092", "value": "3072:KF45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:k4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252179, "uuid": "7acb6e1e-1385-4970-ac82-167e924f52d8", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252179, "uuid": "ce4a6d8a-b55d-4aed-a225-ad9fb825bd0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252179, "uuid": "fa1faeb3-1a6a-4d48-b7f2-8fee0cacb998", "value": "ff73334c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c84a2f-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212743, "uuid": "8abb072b-ae78-4ad5-9fb9-307845261fad", "comment": "Malware payload", "value": "8018edceae2965ab0387ea13abe36bc4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212743, "uuid": "dce25c84-edfd-4ba4-9ef6-b75e34a7aa08", "comment": "Malware payload", "value": "56f17ae6fba3d315d7c89363408b34cbfa72139cef32feb13163f23673709e3f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212743, "uuid": "accabe4c-5aee-4ad5-9685-ce22443bc6aa", "comment": "Malware payload", "value": "6d48a918eee18f20767a2e476bb6513a710c5232", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212743, "uuid": "83d60353-b185-4dc1-a98e-2f045f141ea4", "comment": "Malware payload", "value": "dfb93b357c7448554637836b6dab6345cd165312437406431b080160f1d5c7e0d28f1b4c73a5695708bb0ef6fcfdc5da", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212743, "uuid": "060f314b-adf4-4882-9751-cb5571890e78", "value": "5FF4F134B933B1B9DB248F7E01FB85052C66B9A8504F6B5323A964F0751B2BDA70DF12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212743, "uuid": "70e9991a-1d55-4f69-bb58-b801e39824f0", "value": "f6c86e806266c3c54cfbead75fa61a2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212743, "uuid": "b48a347d-97d4-41f2-8caf-f849b020d221", "value": "12288:aCSfgMwJx6oD9uBjSIuiZtbJKRg1FJY2zFMsYOKun3Sw/EFOvjzz6HsE+UY:0gMmQoD9qtb2oYdNOK9ksOvjP0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212743, "uuid": "04fb3254-03b3-4125-b2b8-30c7f4a1c405", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212743, "uuid": "84378685-ffea-4254-8392-6d7919df4085", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212743, "uuid": "658b7df0-a04a-4b49-9aeb-8bbf742a2eba", "value": "8018edce_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250769e8-adbb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620230485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230485, "uuid": "b21e409a-2daa-4ac2-aa1e-bbeaac88aba4", "comment": "Malware payload (Dridex)", "value": "b9f55fb8d0ab807d327b998c90e3de1b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230485, "uuid": "6f5feebe-0139-49cb-903c-565916280d61", "comment": "Malware payload (Dridex)", "value": "571cd6ace4a0e2af2539e0fd9853234796099caba7a764531000fec1bd45667e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230485, "uuid": "6c070ad5-ae82-4c2b-a2c8-d7e0d7f67b2c", "comment": "Malware payload (Dridex)", "value": "8e48588e2e17dff129aa315f10b3e2ef74d61aed", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230485, "uuid": "1d791fc3-a638-4413-b9f7-c30a9f84fdf6", "comment": "Malware payload (Dridex)", "value": "09da9890cb22dec5de84d5334a0c5b9d0441bf2bbf017c1ba1f21d8050cbb7e40501f4a69963581570a9db393f6ebbd3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230485, "uuid": "1b0e285f-e7b1-4c7b-b698-b4dad1ddf310", "value": "76F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230485, "uuid": "a73b2f34-046d-4ba3-9ffd-8d43a94c0bc2", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230485, "uuid": "68acd6d0-50f4-4326-9621-90db353c8a06", "value": "3072:aiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ZeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620230485, "uuid": "fa922a23-bb70-4219-a6f2-d64849fc3c49", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620230485, "uuid": "a0a388f9-08cb-4575-b125-0b05051b1c37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230485, "uuid": "2d3b760c-3402-417f-9e08-6c94827abbb9", "value": "b9f55fb8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0fcb3e8-add4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241538, "uuid": "5a729ac2-2379-455f-9ba9-a10da30a3341", "comment": "Malware payload (Dridex)", "value": "4754afe8da8056d79394aa773126ce6a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241538, "uuid": "47dff7d4-37a7-4cbf-b954-f7c6281738f0", "comment": "Malware payload (Dridex)", "value": "5791e20a83169c033de4f036b48482424e02165d5f03a948ebe60baa64ca159b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241538, "uuid": "6f4f91f7-92a9-4b33-b41a-2b886ab1fefa", "comment": "Malware payload (Dridex)", "value": "d5e5a5a3b4b09148b28d008c7fd176052166d594", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241538, "uuid": "97caac9e-022f-436d-958d-71a3381a8dc8", "comment": "Malware payload (Dridex)", "value": "d529e34e3bcc66abfa71813b982870e796b6094ca13dcd04f896a706d26835baae65236072b01aae39319a913edb3ce7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241538, "uuid": "a52a4537-59c9-4049-866f-9fec20cb310e", "value": "6EF3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241538, "uuid": "d9170841-5379-42ce-a4d3-a22f2509d3f2", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241538, "uuid": "3e2939c7-8851-4147-94d2-ab7989ff51fd", "value": "3072:Mx45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:64KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241538, "uuid": "46b41742-b6a6-4381-8d07-7f1a28609aea", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241538, "uuid": "6b769284-758d-4618-aca5-88f8cf10cd3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241538, "uuid": "5c388ab3-0aef-498e-a47d-16a6faf11e41", "value": "4754afe8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f536314d-adf5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255745, "uuid": "2660c051-c459-49da-87f2-daefd88ce4e1", "comment": "Malware payload", "value": "ca24253973b68588904520df0c2f214d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255745, "uuid": "64a1f7e0-b00b-4644-b5fc-663a9f1602ae", "comment": "Malware payload", "value": "57be3d920745cc7f5b2ee2c3d12c44dfb2f791a2d9235e5118ddefac9b115621", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255745, "uuid": "803f84d4-3c99-417d-ab7f-f395e7dd7e09", "comment": "Malware payload", "value": "c0e1752c8647f564464747838e58d57f6d331cc2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255745, "uuid": "01ba5862-7edc-4e32-b0d4-989d50a9074c", "comment": "Malware payload", "value": "ef777344666f8203e0a38f43fd7ed0415c0ded61825b0b58681cbe46b6cb47dfa12dc1b120f4a363b9578607c09a804f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255745, "uuid": "22548447-939c-42e9-b34b-9045c54436bd", "value": "4EF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255745, "uuid": "c915c7a6-aa3e-4895-b4bc-b4abc5349c6d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255745, "uuid": "eded7117-3a2b-429e-a42a-0202b9989436", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255745, "uuid": "b8b13b9f-c2ea-4502-a7f5-47c4284598a0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255745, "uuid": "707e2d9c-c894-49ab-aa39-fb4e4720522c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255745, "uuid": "4fad19b0-47d0-4cdf-be79-128c469132b9", "value": "ca242539_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fadb103b-adf5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255755, "uuid": "5ca1c6fe-ac7b-4c42-b43b-12e616ddb997", "comment": "Malware payload", "value": "536f5695a16ca95966994a3dda8cb247", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255755, "uuid": "00ce24e9-6763-4a2d-adbe-0b01450a9cae", "comment": "Malware payload", "value": "58071b5a8cc8a5755dca177e2ed41ad3399171b97fced2082bf9e7567d66a748", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255755, "uuid": "3bf6351e-f49d-4e4e-a4b1-28cf3c6e7721", "comment": "Malware payload", "value": "a47eb61ab497c39ba9cbde443fd7cb7587830048", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255755, "uuid": "7611354c-3798-4f21-921b-8575c1ab906c", "comment": "Malware payload", "value": "dae113da91563547b45bf175fe56feeb1fc91a1b97048fb39c836ee8510c071a3c67f9bfa3fd6941bb1dd42d93ac044f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255755, "uuid": "96f7fa84-88e7-465b-af0e-a770c5a2d187", "value": "E7F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255755, "uuid": "fb47ea49-901b-41cc-8812-c06959b8be9d", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255755, "uuid": "2cd86a9d-0c5c-4412-aa7a-d63a048af28e", "value": "3072:niFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:8eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255755, "uuid": "c05a0113-e1f5-4f3e-85c5-cac63fe4f42d", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255755, "uuid": "251f57b5-8624-4713-909e-ba408624e515", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255755, "uuid": "b79e9718-4b39-468c-8926-594c3fbb4b8a", "value": "536f5695_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e9ec49f-ad92-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212865, "uuid": "daa315e9-03bd-4e0d-a710-5d00000d1d33", "comment": "Malware payload", "value": "700f606d223f6fce9d75968e1e22a88d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212865, "uuid": "9fbe0da1-a564-4d88-a259-94b64f26a983", "comment": "Malware payload", "value": "580cc1785e0f4364445083a13c891c88b1122350dec3c5c7f25c609eec123175", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212865, "uuid": "868bcc1b-164c-49c3-8772-f48eb355e8eb", "comment": "Malware payload", "value": "30656d2bb3de1d60c69b6e7e3af3e57a907f1df8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212865, "uuid": "a3dfa2bc-73dc-4dfd-b119-d9ddb82841d1", "comment": "Malware payload", "value": "b10019610e41719a99037f739a2d6f7083122bc303d8242051d43c946b338780b3f362309cf369e3fad2ccb98dbbb43c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212865, "uuid": "8ac629ce-1e93-48f2-934c-90ba14bbd911", "value": "EB25BF8679C2EEBAE3D2C26B5E528C3ED5F20118CDC179B80761B5774835F20A7529CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212865, "uuid": "a3e89251-6e01-438f-82f1-d138ae94e29a", "value": "6366c3f62b6cbca5ef800fe7da7803cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212865, "uuid": "8f06c906-4dbb-4d11-beef-8f00ca24a497", "value": "24576:Ht0+5D0Tt+kW7sAluz8gmdnaRFUoRnZ/62GT8bd/vI6+iMC23OSaVSfm4QaCh:Ht15D0TtjxADhnaRueJz+5Z3OSaVd+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212865, "uuid": "9dd5186c-1358-4914-af8e-2b08543826c5", "value": 1044992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212865, "uuid": "fe831050-0eb7-4b5d-9f28-88db724cc512", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212865, "uuid": "0265a8cf-faf2-4359-8006-3615ad4ae482", "value": "700f606d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0043c778-adcc-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620237725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237725, "uuid": "4a42c17a-0f32-42ae-b1b1-96e0c10e5e9b", "comment": "Malware payload (IcedID)", "value": "ce1137aeccf879e96ceccee6ddfb8949", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237725, "uuid": "07665f32-eac9-4d82-b570-db56f83e9b61", "comment": "Malware payload (IcedID)", "value": "585229377732e8e8b26e4a4ea5ea805b5f6a655de5dd45d6a6ef821f2211a6c3", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237725, "uuid": "9d7ad331-acbe-476e-86c7-5014a502a11c", "comment": "Malware payload (IcedID)", "value": "1274879269ee2f392464256edb0502e508251159", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237725, "uuid": "10608aea-b33f-4f57-8db6-3e6039309280", "comment": "Malware payload (IcedID)", "value": "2b66d50b14bf72d235abe5393850330a3ee13840fdee0cdf8a5563e0ab296acea19437b04c2b0fd8fe7e9ef6572e2414", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237725, "uuid": "a7eaa38f-068b-4cd1-b834-547a691458df", "value": "593441A789A8E0BDF50628B2643CD745C950EEC05E53DCD6B5F384229FA39F617123CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237725, "uuid": "da391bd3-50fb-4057-a74a-3f5d7e0ff111", "value": "e0533e6b0ac9b87b7ad9ea052e7fa74b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237725, "uuid": "b134f694-c91d-4f9a-8092-dbd428641059", "value": "6144:LbG2zudGcUvOSYQqtlyh6aN6RJ7MQH6+kbgUG0DrUOs2T:LRzuMcUvOSYQqtlyh6aN6RJ7MQH6+DU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620237725, "uuid": "f0400cf2-59b9-4b7b-8c72-4814d0324044", "value": 232024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620237725, "uuid": "d0cc0460-67df-451b-8406-f9a2edb9e869", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237725, "uuid": "fe972e44-eab4-4ed3-9f09-ddadceffb099", "value": "ce1137ae_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f697e675-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208932, "uuid": "db2c6303-c1e2-49a8-8a1c-6838725795cc", "comment": "Malware payload", "value": "19b6fbe0d74200b0514e1194ba0214e5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208932, "uuid": "a79b14d3-b0bd-4ef7-a4f1-6efac34acf46", "comment": "Malware payload", "value": "586241d538ffb7e00cbb4cc12d703e906dbcacb730f99be64766a4852a44e4c6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208932, "uuid": "c58f0241-a02e-4e67-978e-28842430a342", "comment": "Malware payload", "value": "7fe977e728aa85c3f96332046c36cbac93bb181f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208932, "uuid": "c774b7c1-82b8-4004-a157-523abd4141c7", "comment": "Malware payload", "value": "f55dd434179fa42985dcd3b8838c5e0287e430e6b0e16237f7d20f377f92912c2e92184149a3d21ba9defaa86fa5cd6c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208932, "uuid": "8b8d650e-95fd-4ab8-b65f-59c86fae4b0f", "value": "84E4E1B591ED217FF946B8F2CEB060E3C8116E54F7E71E92DF64812FA17A0ED6290540", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208932, "uuid": "0addf4e3-9c17-4237-b4ab-b3b83869cfbe", "value": "47cbdb1d787f5dfbaa485aa7a706e3ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208932, "uuid": "85e2dd52-6fd0-41e4-8516-6f27dec4de1e", "value": "12288:wRxfjr4bZB7cHOlhEN+WUPpZj2XiPfTS/4Qd48+DdoVYfMHl/4A8nVor:wRxfjrw/cwuFUPbfPr+ve3ul/4AIVor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208932, "uuid": "0bff4953-90d2-46e6-8b75-f2dceb5b5e55", "value": 674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208932, "uuid": "f288cbfd-4019-422a-b3cd-c1b73da56a11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208932, "uuid": "9f998f09-1058-438e-96ae-69f129fb26c5", "value": "19b6fbe0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18889d45-ad8f-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620211566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620211566, "uuid": "e32191b6-3fac-4a52-ae51-456ff5030eb7", "comment": "Malware payload (RedLineStealer)", "value": "a581f26565d44c0dfb202873cd9a7e0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620211566, "uuid": "eb375087-3862-4d27-9851-73453f576063", "comment": "Malware payload (RedLineStealer)", "value": "586871a8aa5c08be02631a432daa373d9e40fdd0dd53b80f0210f53b41dbbfb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620211566, "uuid": "3f043ed9-6d27-431a-98a9-5a87c78f7ea9", "comment": "Malware payload (RedLineStealer)", "value": "360a68a465bb314c355cc8b6dff2fc7784086f86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620211566, "uuid": "d648d0f0-9398-40ed-858e-362ed5955b1d", "comment": "Malware payload (RedLineStealer)", "value": "d4d5407e7b170a2efabb590a38c92ff431e5e37c43d6691a025502c21bef7c13a063f13581346b842ad45a4bd804390a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620211566, "uuid": "794a55b2-b584-40b1-a175-0ffc5de701ea", "value": "0C0559BC756464E6D7170E7263CF4C0742652270A92BEA4E9F6013BD4E53F232F3698A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620211566, "uuid": "7ff3fb9f-8104-41c4-8cdf-c0778d977319", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620211566, "uuid": "e2622786-1e72-4de8-96b8-01d7662305f2", "value": "12288:9EoLLoS60/K7yh0psABgOG8mBhgLQl6VHyUD87F7okVDLu8ou:CoLA2UgHhgL84HyUK7VVv2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620211566, "uuid": "ae47e410-b282-4004-ab56-41aa1339f629", "value": 807424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620211566, "uuid": "8cb5465d-6ed3-4e39-9f84-b10971c94cc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620211566, "uuid": "63b02c88-dc73-460d-ab9b-a737bdb114b9", "value": "a581f26565d44c0dfb202873cd9a7e0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a302550-ad81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205664, "uuid": "12f1c97e-bfb1-4697-849f-356255f96288", "comment": "Malware payload", "value": "a6a00fc48c4510e9067a6f1d93ee3fd5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205664, "uuid": "d31de1bb-69c2-4788-b118-292c9db4fa15", "comment": "Malware payload", "value": "587d0dded0cf76690600cbfc757f1032bf5944309969b6502f038ca748ce5698", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205664, "uuid": "82867303-3a84-4763-b99c-1afa12f7d328", "comment": "Malware payload", "value": "a2280ccbbbd8e9cbee047e06dd210c6653b1566a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205664, "uuid": "9f009e00-1099-48ce-a8e2-3fe7a3b85785", "comment": "Malware payload", "value": "8dfd14ec102cf753fa7788603caf9a1589e0613a7008ddef7d5db5337167ca568c0b301fbaff657fdcfec2b89daf7b9c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205664, "uuid": "00bfa8b3-5d01-43d6-95f4-2ea80a8814be", "value": "2BE4EFA770CE2891FE967BFFD0F9EF0FD86FD911CE8F1565888444EB60A84962994403", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205664, "uuid": "87898849-cd87-4a7c-9a95-62e5ff877abc", "value": "efeacb456b51212f2965f1ea95be4b93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205664, "uuid": "fb43079d-cbef-44d9-9ec6-f067681f379a", "value": "12288:w5Wb7FHwy4tSwIg+VF1moveEN0FB8gUE+cQZMKaHGN3l7Ix4zLq1ncXAKD3mL:wahp4wBg42lIaH0Sx4C1ncxyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205664, "uuid": "80388b81-ce20-4079-8ab8-36c7edcfca04", "value": 672768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205664, "uuid": "3128b889-2dee-4277-870e-06de7126498e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205664, "uuid": "4c47ba90-12c0-495b-ae45-2eceb3cf1874", "value": "a6a00fc4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead0aeaf-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212778, "uuid": "99d440c9-17cb-45fe-980a-ea51fd610884", "comment": "Malware payload", "value": "a49789dd2d4bd5bcb8813f03e738d95c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212778, "uuid": "593dd534-2d09-4adf-8991-a764d623b7c5", "comment": "Malware payload", "value": "58c58eec24f583f182194f7a38748ca5d0fa0c0bb0e21d831ba6c706da1cb5e0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212778, "uuid": "3fbfae1a-63c1-4343-95f2-b9f864bf4d36", "comment": "Malware payload", "value": "d6e26b0b077e764c12cb112f7e60813af896f779", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212778, "uuid": "3d6fbf93-05c9-4ca2-8ab8-2000d39951df", "comment": "Malware payload", "value": "0bce15fe6b216ed234652a03bfb6e6dc7d735f0d0bd6bac4b7287e646dbf2e5713d9e62cd4d9fed158266b10af35cebf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212778, "uuid": "7590aeb4-d796-4903-a996-6d188eac30d9", "value": "7AC4E13F174B61B4FAA089BE744A723971E024AE089CF8558E819E40D35FC66DFB44E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212778, "uuid": "358d7bfd-4ef5-4945-81d9-d05b66b86d22", "value": "88eef608e5f0480ec58f98c6940afdbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212778, "uuid": "2a94178d-6685-492b-bc56-0a6cda917795", "value": "12288:FEGbuHI3aXcDtF9ShLy/DhAjF4wnQrX0BoaL1fCyEczvrwybj:ydI3aXcDD0hLu2IQL1yczco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212778, "uuid": "96334e13-ef9c-4466-b38a-209e5f298418", "value": 550400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212778, "uuid": "89b09a1f-f279-4d45-8f26-3c8ab0a5d504", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212778, "uuid": "8f8fd248-65ab-438d-b9dc-cf26b06f2b0d", "value": "a49789dd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "766362de-add4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241359, "uuid": "4a5ebe85-bfcc-4f73-bae7-a3131fb0378d", "comment": "Malware payload (Dridex)", "value": "e1c132a6e3d5c51c62243cf7ba367250", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241359, "uuid": "54661bc5-e69f-477c-ae4a-5fe19f0a767e", "comment": "Malware payload (Dridex)", "value": "58cab3cab6d87f352981b51a7a496abe42a30a120b4194198b889d7ee12d7a33", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241359, "uuid": "0e03ed0f-4790-46db-a988-9db7a1ddb0ad", "comment": "Malware payload (Dridex)", "value": "5f6774b579842574782de596e8596936d595d46a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241359, "uuid": "6262b2bb-9a21-4c9b-b26c-39d38424424f", "comment": "Malware payload (Dridex)", "value": "dc37931a32795a1038d20f5a4a4ef6359aa6de99ac14a169e416a092ed1d3051d32787c2843357e888e845c532cb123b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241359, "uuid": "7f97878b-347f-497c-ba92-0de80d673726", "value": "0BF3C085DBABE8BFC45A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241359, "uuid": "e46ddb4c-7901-461b-a1e3-2885ca2debb3", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241359, "uuid": "5680fa8f-eb0e-44eb-8ea0-bb1c0b7d3d0d", "value": "3072:jx45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:V4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241359, "uuid": "c01d793d-5a45-4ea7-9526-f426824b895c", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241359, "uuid": "810c8b98-6a47-4ef9-9fa2-8c5722e8c854", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241359, "uuid": "b9bb4d66-0f83-406d-8d23-f52e4cb92dfc", "value": "e1c132a6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aa785c2-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212644, "uuid": "e677f4c9-abf2-4c83-882f-96eb84341301", "comment": "Malware payload", "value": "257dd5f02ecb4a7d1ac67d586808994f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212644, "uuid": "717e367d-7516-41dc-8891-89e4da92b348", "comment": "Malware payload", "value": "58efe97ae6d0ed8735205f55a86f569d93517894dee7bf92c2a13918ff9ad10a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212644, "uuid": "38a64c3a-67fd-494f-a013-e3dcb7d92e93", "comment": "Malware payload", "value": "c9ff2efde6c2ddd9daefdc1a1317aad96acd5651", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212644, "uuid": "fa3247b6-7fc5-4005-86e3-1237ed70f9fa", "comment": "Malware payload", "value": "441f24604aae42560746af50be28e67909e2cc9951be4c94733a3c5e6e6d3f2e6bd869d149d875573979d8678f2d444f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212644, "uuid": "9ef401f5-55d4-4373-8251-cda6016dff21", "value": "56F46AADD5AC829BC09DFF27063A9BE651E91D8A910C3C3F97D9264ACD6433CD240F58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212644, "uuid": "53299b38-327e-455f-a1d9-e1158c1aea9b", "value": "b2f4fdbddb0047120c5b50a2a47b5974", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212644, "uuid": "8aa702ea-c37b-4b6a-b467-648a5f296ba7", "value": "12288:Clb5cbsYYYVspELbcFnY4kfw0L3TAtTPe5Q2vX44lLbIxfVMLZIVeTRTm:Cla4C+ELwhY4kJ3bQ2vISLsf2LZImRTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212644, "uuid": "8a1a60c6-1bb7-488e-9c0b-fba67072d890", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212644, "uuid": "c195cfba-3aec-42c2-8206-fc579c5842dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212644, "uuid": "32bbeaf2-a022-4937-97ae-62e3b36069ec", "value": "257dd5f0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c604a68d-addc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620244929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244929, "uuid": "75856b3b-3574-4056-a8b5-b75ffb447ff7", "comment": "Malware payload (Dridex)", "value": "27c2c113f44592ce4f371227a29f7142", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244929, "uuid": "118ad85c-0325-4f57-929b-6bd8941740a6", "comment": "Malware payload (Dridex)", "value": "595dfe65015b4bb11266767b46d9d7912ba65677dc118c60c8af741275d82a7a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244929, "uuid": "4db1c0f7-ca99-4b68-83ee-1d3c07f7f3b5", "comment": "Malware payload (Dridex)", "value": "1251762e0a22e9dc953dfdf318a7f686cd64785f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244929, "uuid": "5a731efa-bf01-4fd6-a7e7-a4d38e7d17bb", "comment": "Malware payload (Dridex)", "value": "db8058c3dd7354043b0a722d01f66c1cc3ea771d8d40e6bd88d10bd8d8363808acc8a83936c5b162299f61f050d1632d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244929, "uuid": "b67c7383-00be-4117-bb17-eb3090950e15", "value": "2BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244929, "uuid": "49165f4d-d7ea-46c0-8b0d-5a17ae5bcbbd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244929, "uuid": "f6b9fa3f-0158-45da-9e19-eeb5547d451b", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620244929, "uuid": "d621ac39-aae2-4602-869f-49662c573911", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620244929, "uuid": "d0e56fc3-ad01-413f-81cb-aa57d9d23518", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244929, "uuid": "0c408622-4960-4cb5-b8c8-e83f9ba18cab", "value": "27c2c113_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427502fb-ad87-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620208201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208201, "uuid": "06d5424b-ccab-4993-9121-02fff44c882f", "comment": "Malware payload (Formbook)", "value": "ca14ee6f98ab550e2e1c44f533302d07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208201, "uuid": "e9b1120e-e46f-494c-b5ae-f0acc0825277", "comment": "Malware payload (Formbook)", "value": "5965d771551e261280e191116d9ed9aeae23eefea54753f2a23792df5e315b02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208201, "uuid": "b8e90a8c-0448-4aee-831b-c20044037fef", "comment": "Malware payload (Formbook)", "value": "66304f4bcc82214ee9cdcfee76f3769be868ddee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208201, "uuid": "b743125d-e050-428a-86b3-e54c32d0b2f1", "comment": "Malware payload (Formbook)", "value": "e0d05584f72a67e53c209f333678e12f9dbc5c1073edc526f0cc5f40b9bbd6a30cbb6a03310b2e177e93bb8ae764338d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208201, "uuid": "6806cc61-9d9e-4987-ab27-99c3c407529b", "value": "5AF42313129C526DCBBAC7730068520222B4F147E7BADF6A2F2F65A93CE73464B14B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208201, "uuid": "ec5f1619-03cc-44af-8a8e-3e8ad0e1d188", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208201, "uuid": "74851964-1a86-4999-93f4-2b432d435cb4", "value": "12288:uMFaY46BTGI7YBhSTPVx+Jhqtdq+HtqBZdGm+Pboc83VqVUbVjcqX4r:uHYTq2YBoTPaLeNaR+p83/NM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208201, "uuid": "9f0b4669-fa51-4380-a7bb-2bc51f62c9bb", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208201, "uuid": "d8bc1b68-9f76-42a9-8ca9-fba39f40582a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208201, "uuid": "e52b4614-6823-4068-9007-88f70db6d6f3", "value": "IMAGE-20210505-2001902818921.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2d3110c-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208899, "uuid": "fbfe6167-5623-4a3a-912f-013310e75312", "comment": "Malware payload", "value": "236c1c3a830d90f5b0b633d342863c11", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208899, "uuid": "75e7719b-1a81-4b29-913c-71efb4e77ab8", "comment": "Malware payload", "value": "59824fa7168390f3e10e63ef51a75974e670bfb7ca49c3fc1c7a9a6c6e951b21", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208899, "uuid": "40f3ca50-4aca-4961-919e-123c7f9053ef", "comment": "Malware payload", "value": "fcd59783f86f27680c3f8f38250e0e5d7f83ed43", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208899, "uuid": "0a5b668c-1a0b-4aac-bb5c-d36ce44c3340", "comment": "Malware payload", "value": "2c9ce27388c061c468f353b90cd15a5cfbb0efd1c61e9923e5803bcb41a2264bc9fc837ecaa431f2a84a8ea3871a883d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208899, "uuid": "4296630a-c3ad-4b31-aefb-824547bbf7ca", "value": "4835D0699404D938C7BD13BCB25499DDE368E7C31E392EEA84284939C0F79E8578643F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208899, "uuid": "ac9bc06c-1128-41d7-ad84-00ea6266c92e", "value": "647635e9c07997257fb80973a02aa701", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208899, "uuid": "6f735cd3-df14-406a-8930-8cfaff7f0303", "value": "24576:Rlq9D5p04tGHTG62THIeaTmKUENgPITSGR:R+u1waTmKHNC+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208899, "uuid": "67452784-175f-4de0-96fa-01db577539a2", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208899, "uuid": "1eb5eeda-9b71-44ed-95d2-9868209256af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208899, "uuid": "fd3cda3f-14d8-46a0-9e0b-c65ef5165f19", "value": "236c1c3a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9147dd8c-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252571, "uuid": "1ab9a126-556a-413a-9645-11505eddf22a", "comment": "Malware payload", "value": "9e70fbc7a8606df81b2b85ddeb8edd9d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252571, "uuid": "da406320-bc29-4ebc-98f3-92bdd519d236", "comment": "Malware payload", "value": "5998ba6bef4d61888a43213a75b78cdf13735906c5b9997f4d41958a513aed70", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252571, "uuid": "0a33ddf1-1ae1-4193-ba5e-1a2b793a1087", "comment": "Malware payload", "value": "75c149bd2bda4c50d542e27ca6d740c7b057117a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252571, "uuid": "dc624d2c-9566-479a-a836-59431e0eb158", "comment": "Malware payload", "value": "aa396b38d7c7df290520ecc090f8cce323980e1bc7ce9947a8b15b269cff14186a240d4bb304e3e2370906e7bc8e8ec5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252571, "uuid": "1feb9e82-bafc-4a43-a370-df4c0465e19b", "value": "1EF3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252571, "uuid": "bb6c7cb6-8398-4db2-bedb-bcec2b47afb5", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252571, "uuid": "d2171f99-82dc-4bbf-b87a-1f3247a0e443", "value": "3072:Gm4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:8DBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252571, "uuid": "9b352682-a9e6-4e73-921f-373eeb4b18ae", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252571, "uuid": "d608ae7a-b73b-4ded-adee-baa3379e4844", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252571, "uuid": "d0375aa2-2cb6-45f7-b914-41462d068fb2", "value": "9e70fbc7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da8a67f5-addc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620244963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244963, "uuid": "db36d5dc-c51f-4d33-b182-5d875cb9ce41", "comment": "Malware payload (Dridex)", "value": "18a71ba01165903153ba0d2344aaa06d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244963, "uuid": "fa026f76-2007-4ce2-b752-6603e79ed0d5", "comment": "Malware payload (Dridex)", "value": "599ac2bc966e14e4cd96ef3d58ed32228d85e61f62aa95e5d98d1545a8e17fc7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244963, "uuid": "2af9d6d7-c3a4-4935-b3e6-049bc43ef535", "comment": "Malware payload (Dridex)", "value": "1b2fe9c3eddef5be778f2386d5401ab6e32aa8f8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244963, "uuid": "bec11667-5da9-4e02-ac6c-1f2a1cd6beca", "comment": "Malware payload (Dridex)", "value": "a0e0248e961c1f08814ecc0db9e4e6de6b779bd00bc2c460ffbaca94fecbf899653c9405402bdf82c40e0ebbc9cb3612", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244963, "uuid": "9375b5df-1c95-4b26-93ba-8d5b2a1741be", "value": "B2F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244963, "uuid": "89c2411d-8745-456b-a9b6-600b95f44df0", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244963, "uuid": "f3a8eab1-c4a1-4d36-8b7f-102ad234cfe4", "value": "3072:7iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:YeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620244963, "uuid": "1587d06f-1ad2-4072-a5b1-fdbc8966f347", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620244963, "uuid": "be2237d9-40e1-4c54-bbd4-b84033a28e12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244963, "uuid": "8485cff9-e8a1-4311-95d3-c47e03b970e9", "value": "18a71ba0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf9cff24-ad80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205404, "uuid": "e0bf733b-3ceb-41c6-b568-ddbaf4302ee4", "comment": "Malware payload", "value": "feff15596f971216fe29f310e5f0db1e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205404, "uuid": "f0374202-91cf-47b7-830d-0bc8b6a3bb13", "comment": "Malware payload", "value": "599c98ee04c74e75f3637405c127002f2eaa712c34eca534de06fbd5565acd49", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205404, "uuid": "7f6bf23b-31c8-47d7-9b0d-359f8dfe9b36", "comment": "Malware payload", "value": "c67bd470fa957cae69f02af55cfeabb75d123ede", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205404, "uuid": "eaeaf6fb-b7ed-4275-9a21-f09561a3ce3d", "comment": "Malware payload", "value": "66a5b972ea849bbabaa6fed4183066af03005af5778165b6c9158e2c77f9b94f44cce1130394d3b43dbb2aef967f9147", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205404, "uuid": "d2d0be16-8c4b-4d3e-8c8e-5820e35eab95", "value": "B2F4AE2657847DFDCB107E3A5A2F13F59650DE4BD4802009960D8AF96E2BC64B38CF9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205404, "uuid": "e9405c81-c919-42e1-982a-a43a417d2e3e", "value": "516538628b68a19bf8df19e83ca83acf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205404, "uuid": "e79bdfc3-46f1-4951-bc0f-d800e9712982", "value": "12288:MSJQugEt9ziBTI7rTkQbyOB5cjbAieryjSA+AKS99pfSAya8Tm:MSJQJMZb7MQuLFCyWuj1tyVTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205404, "uuid": "97d186cf-4774-414e-b335-8f509295e028", "value": 770560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205404, "uuid": "f07d3c19-7ab8-4499-bc5c-8e28c843bd03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205404, "uuid": "1434a9c3-7c47-4012-a209-69d2f8da489b", "value": "feff1559_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3605fd1b-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208609, "uuid": "9b5171c0-c49c-42e9-bf34-78a8a49cd6f2", "comment": "Malware payload", "value": "bc8e684db3bc0910e9585d03018c7d99", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208609, "uuid": "77bad605-e7a0-433a-a5c5-4ee60c0d2708", "comment": "Malware payload", "value": "59ae71442d56b651493c38f5e43b024095b99219c65752e33262419337253ac7", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208609, "uuid": "89a85505-0bc3-4cf1-865d-7a8886a4187e", "comment": "Malware payload", "value": "223ed1caa58ba80db8bc8d97d879c83653f43e15", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208609, "uuid": "45954f2c-cc7a-439a-9d3b-6430651d1898", "comment": "Malware payload", "value": "23538c4322e17127ee9a23b04761fad696be25ff8d32613c71d157e6c174ca6b6674f69805ce66a975db1fbba1ff984b", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208609, "uuid": "929454b0-da1c-455a-b6cb-783aedbabf70", "value": "3:8sWv:s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208609, "uuid": "81d50a65-3d9b-459f-8106-0f140480ba93", "value": 14, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208609, "uuid": "303da468-7ea4-420d-a9d6-dfe918b08825", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208609, "uuid": "f4585b23-f67a-4b24-8935-cb1d060839a7", "value": "59ae71442d56b651493c38f5e43b024095b99219c65752e33262419337253ac7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb58701-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620242016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242016, "uuid": "bdab0002-b523-4a42-91bf-883781084d4c", "comment": "Malware payload", "value": "c86b9588c1ba6325eeca7871ced2bdb6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242016, "uuid": "462ae0c1-8460-40d7-8bdd-e3b04fb5d4fe", "comment": "Malware payload", "value": "59e08ac449d6e057649ea19d24c25eea6d36d0231db61305311f3ee8fa5d4d39", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242016, "uuid": "ffe43a97-9eab-4bc8-9dc9-ea3602315df9", "comment": "Malware payload", "value": "e0932dfb7f7954946e7b02d60d194df39a0d824b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242016, "uuid": "81007d42-63a9-47fa-adcb-3144d2c9aa0b", "comment": "Malware payload", "value": "25ee2987917b665348f8ab06d656210f0a6167153adbe04c683bb85dc694ea6b4852a34779d132611225fdee7250da19", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242016, "uuid": "6ad7826e-301e-4dbc-bd85-935c47b2ef1e", "value": "4CF3C085DBABE87FC45A35399071DFFB5B388B149640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242016, "uuid": "fda27b6f-5103-4fe4-b6b3-93d4f8363a9d", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242016, "uuid": "ed018478-b6aa-424a-b187-b7f3c44083e7", "value": "3072:/945bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:V4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242016, "uuid": "442f28a5-5b7d-4d79-97a8-eaed8074a597", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242016, "uuid": "6e28023b-bc87-4b24-be29-1c99a5c58900", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242016, "uuid": "20e325b3-68e9-4e3f-8207-ec763127bbe8", "value": "c86b9588_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9acad6b-add4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241579, "uuid": "2301d786-f156-44f9-a4aa-e3deb1d225fb", "comment": "Malware payload (Dridex)", "value": "baa71e77c483a2ff99e62ddf02aa72e5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241579, "uuid": "f8c020f2-bc42-4ba9-8dd3-72427d10eaf1", "comment": "Malware payload (Dridex)", "value": "59f0929643ff14dd2e09f531c4009a7b2b89fcd3226836b7be3d589cac92e4d7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241579, "uuid": "4d7582e6-41b8-4be6-9e0b-04d1b15b421f", "comment": "Malware payload (Dridex)", "value": "93746c8ef57100c6445d084762b99e45e272272f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241579, "uuid": "3ca2af9f-692b-4942-907e-a9fe83049a89", "comment": "Malware payload (Dridex)", "value": "2d2ed0766136b00cb223d4d910b778289b8126c597f15fa6324f1178bb155fff581bd2bf72c5cd874fb05a78bfdddccf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241579, "uuid": "32ef7db1-92c1-4ba3-8f29-fd743f575976", "value": "CCF3C085DBABE87FC45A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241579, "uuid": "85af7033-ac9a-4c1c-9b79-2c691921fbc6", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241579, "uuid": "0b10a8c5-e050-4117-8238-524d0c16eccb", "value": "3072:qx45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:E4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241579, "uuid": "21d5fb53-8a49-4e8f-8036-bcb864f14fd2", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241579, "uuid": "4882104c-fde7-4cc0-a210-89fa252f01c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241579, "uuid": "6f7f8045-feba-4584-82ee-b8b2133b28fb", "value": "baa71e77_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "393b8cc6-ad4c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1620182845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620182845, "uuid": "efafb65d-926d-43e9-bda1-5af7e116be41", "comment": "Malware payload (AsyncRAT)", "value": "41115f48907e279dacf12984cc0f4384", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620182845, "uuid": "f3046e3b-8fa3-4940-bd7d-1524f2dafaef", "comment": "Malware payload (AsyncRAT)", "value": "5a07afab2821db456cbe3b3331fa08e36dc050ceb3cfe71fa79c9a6c3e429626", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620182845, "uuid": "12a22455-ed84-4b7d-95fd-163a59f3e645", "comment": "Malware payload (AsyncRAT)", "value": "a36939395b2e94a4ef902286ec1733ec1362e9ef", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620182845, "uuid": "a23d811a-a475-4bc9-a796-5c9dfacc0261", "comment": "Malware payload (AsyncRAT)", "value": "109c0ada364b6be2cf9e52a0fa700e021d3046182a906797eca95dbf523b1b2aec547e1f6bf04a00afd284b166b131c6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620182845, "uuid": "26e89f40-8fea-4523-bac5-1383dc8bdfae", "value": "B7230A003BE8812BF2BE4F78ACF26145467AF2776603D64A1CC451D75B13BC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620182845, "uuid": "c4694fb1-905e-4944-984b-f1a4a715a3fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620182845, "uuid": "05f5d6ac-3333-4626-8fbe-3c171279c960", "value": "768:MuwHvTpY8oiWUUGyKmo2q8Hlp5ElMOPI0azjbTg4iukeo5Kml0IBDZ2x:MuwHvTpTf2TWM30a3bMVzrUmGud2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620182845, "uuid": "2b53b67f-437a-45e7-9a03-4a137ecc5425", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620182845, "uuid": "5a383a99-fb5a-4854-9205-ae0c7ebcc97f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620182845, "uuid": "852eb357-f7ee-45a8-a317-bdb7f6cdc870", "value": "1YyuQvKv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b0ad9e-ad92-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212855, "uuid": "8b53ee6c-3429-4eac-90ef-ad0cce247747", "comment": "Malware payload", "value": "101ba8e57692cffc2f1d2eb1e9fd9261", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212855, "uuid": "531ea8c5-123a-4023-a3c6-d6595e9d44c3", "comment": "Malware payload", "value": "5a80233b31f527a80f250bf17fbd25bc522078e831b93b5bd2f4f6d8e0746441", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212855, "uuid": "44284b4f-cd53-402b-bd56-494f762e3c62", "comment": "Malware payload", "value": "d0957a27120a26f1717a4b72672bfb7d92733385", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212855, "uuid": "fe24d921-be65-4820-a0af-24e3e127814a", "comment": "Malware payload", "value": "f98bf8eb881d618c0d4d9103f80c0d2809fe52ef50469231be93db215e2778cbb08263e71a02fabad78e2756bd8caa64", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212855, "uuid": "232171d9-2526-4774-942a-fa067173ce23", "value": "4925C0DF5301EE4F94788D76EBE56C98F1B3F89E012A4C1F91181AC13174AB476AE29C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212855, "uuid": "6559cc3d-a67e-4f7f-9683-5d46dddfa3d8", "value": "f2b72ea98d306a4f872ba57b764c51b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212855, "uuid": "21835279-a024-4599-a4b9-6683763d82bd", "value": "24576:d4Uflars+gW067tYPE8g6N0L/NH+FNkN/0/an6rk+r4Mi:d4k+z37tYPHcNHTJ0S60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212855, "uuid": "eadf564d-50b7-4275-975c-f869b9042b34", "value": 1042432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212855, "uuid": "719a33d8-f2e8-492c-90a6-690a7c7b8e3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212855, "uuid": "560455f0-6505-4e35-948c-99e1dd9f8f19", "value": "101ba8e5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "374924d4-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208611, "uuid": "74703bb5-2cca-4bf6-8f39-ce083e2aefa0", "comment": "Malware payload", "value": "7962bd6235fbdc50f1bd31388f68a278", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208611, "uuid": "18df0cfc-3e54-4248-8ff5-5b4f83e04643", "comment": "Malware payload", "value": "5b0ef68f823deaac9870e18a7d9208fb40e8b707abaea18717f8d1370b7a5517", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208611, "uuid": "eb1b37e2-bd72-4807-9f23-926270b81b01", "comment": "Malware payload", "value": "fa411cdbd44a36fc2051f6332c2f16fe69c0b7e3", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208611, "uuid": "01cc105e-3d63-41be-97db-edd4e61a3c53", "comment": "Malware payload", "value": "30c1a8611a993d5b1685098448fb2c14c54c32f5d71ed8166a53ebb35987e9b9dffe6e62a7c1e4a780476f74502cedb1", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208611, "uuid": "7e9eecbd-edbe-4a96-8cc3-61d6c390df68", "value": "8361EB94D11848C634C9DAAE77BBA49ED7D8C3CD126F0AAB88932C3DA000759D147DC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208611, "uuid": "23db78bd-7695-4e90-8b20-b3bc493d5ad1", "value": "24:THa/cFnHreDcckwreDc+JQE/reDcMcxcreDchLfreDcmmKreDcZllLZreDcMUgr/:ba/1mIaZYA7GWWGq0TgwD9q9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208611, "uuid": "25392f7f-1e3b-4512-890e-800049589b69", "value": 3297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208611, "uuid": "5ffc7bf2-fd03-4cf8-a3eb-93e3438ac0c0", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208611, "uuid": "98b45410-577f-471e-b677-972e7b5ae905", "value": "5b0ef68f823deaac9870e18a7d9208fb40e8b707abaea18717f8d1370b7a5517", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3cbc957-ada2-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1620220014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620220014, "uuid": "e2de954c-f368-44e2-b3fe-59546c0d0952", "comment": "Malware payload (AveMariaRAT)", "value": "ec4fb9bcd4d0f04bf52462fc9251fab1", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620220014, "uuid": "10e7042d-a4b6-4ac4-95b0-93129ad611d6", "comment": "Malware payload (AveMariaRAT)", "value": "5b109baf5c27b68041f902d867bdde2a260cddbea90ecccb09037751ab2bd032", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620220014, "uuid": "8c9dd7b8-7438-4932-b379-fb1ceab274b7", "comment": "Malware payload (AveMariaRAT)", "value": "d7fb12bd1f18910586fbdf63b7520474044c06c2", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620220014, "uuid": "2029d520-a606-4651-97cc-093f5b727bdf", "comment": "Malware payload (AveMariaRAT)", "value": "7e7f0221e927681d84c3ab6b537ab26ebce68f2f8918e7be868aec8fa83f53550210d9662839c710993101058cf7f186", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620220014, "uuid": "96868422-6ad5-445c-9e18-b67adc4995cd", "value": "E115850119D49A5FF1EDFB361797A36282FC8EB08B2509C710CE85618D5DBAB75BC30A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620220014, "uuid": "66c07153-eb08-4fb3-afaa-12ee19903990", "value": "5c9396c31a930ae3723c9642f72eee10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620220014, "uuid": "a05f10e4-d237-4aa9-a26b-2f0031234b81", "value": "12288:7qh52lqanWk9/6pRUbeV1QpqJaY2483C:7SAnWkAMqHJUv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620220014, "uuid": "241c54bb-7b4b-4000-9e8c-a40a46edd382", "value": 940544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620220014, "uuid": "00766f74-b9f6-42e5-a85f-e340ea8a4de7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620220014, "uuid": "26a8be70-59be-46a9-8cac-6ad459464cde", "value": "LETTER.JACKSON HEALTH ORGANIZATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7585fffc-adad-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620224607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224607, "uuid": "4e74fd0f-7d4c-43a0-8be7-25b6c5fb90e2", "comment": "Malware payload", "value": "5f1964042b564ad4301d57681aae1e11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224607, "uuid": "51d9c8b8-0e1e-4420-b8d8-5e543fc35ceb", "comment": "Malware payload", "value": "5b176f06101d1d67572bb59883a227864b3583ebf2d044a1521c276477a9eac2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224607, "uuid": "89e30cc2-be1c-4d02-b531-7827bcab1696", "comment": "Malware payload", "value": "8106eda90acfbeafdda9cc06eba107d8e0f92891", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620224607, "uuid": "59f9054d-a52e-4d0c-8b3d-73b3361f653b", "comment": "Malware payload", "value": "3fbf33c4f03e21a56d476927938baa87d85ae0164e76f4717a59b08d8e2c5440e4f77ad57f159a25bee4dc600fa648df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224607, "uuid": "bb6be915-d920-4c59-9c3e-391b42914504", "value": "0B15122616489A07CDA677F8A964C64127F0BDBA8423E30B6FF43B7749B1353DE40A4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224607, "uuid": "9ca4e7a9-c27b-4f09-bc10-cf55b0cef443", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224607, "uuid": "a873ed33-ef6a-4bf5-89d0-52e42fe0dd81", "value": "12288:mrWlMVLo49hcpfB5WvPBdZ48/WW/F/b442qvC62xuavlpbLFNAnNMXY31eP3bkWT:z29SpKvPVT9Z83qvCT3FNAnNAvXJ8NEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620224607, "uuid": "dc5227b9-0325-4452-919c-0828dd411c35", "value": 876032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620224607, "uuid": "2549190c-6293-4181-9371-aa26138998fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620224607, "uuid": "bb8b810d-d30a-470b-9f18-441f052bf4cb", "value": "Quote 610954398.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae0abf02-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208811, "uuid": "51bae314-edcf-46b7-8a03-9050ed8cc862", "comment": "Malware payload", "value": "6d8281085becdf2cdaa6900a3f4aedef", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208811, "uuid": "fdcae30b-735e-423c-b239-520a711ec343", "comment": "Malware payload", "value": "5b849affd1e6450b94f1e76a5c3d419ec0c395a5a912759b9685f0bb68be5a1d", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208811, "uuid": "3900b789-8e9d-4ca1-a987-1f40e59d4a27", "comment": "Malware payload", "value": "c8bb1d485ffc0fc2a50cdfce0b66cccd4d29a0c8", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208811, "uuid": "472bd49d-599b-4f00-af4a-15cb1b580b92", "comment": "Malware payload", "value": "a33802a27396c655275fddb805f57484d9f4c3358bf8d058214b36e45af91b5f9c2025fd17227e45a857784ee2a72ec0", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208811, "uuid": "42b6e3f1-bc35-4a07-b69b-2a098b1185c9", "value": "3D51866410309E3537452F7AD36EB650A596882306772F1814339E74BDB7DE9A029BD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208811, "uuid": "d68e9ad5-203b-4016-8f26-8492ec53757f", "value": "24:7nCz/P2ubuSzRBcpBg7wHEOYg2Kj/5MSS8hDKW+GKEgZ4HFb+RRwpBawAwF8fOip:6/e3lK3oFbUgBaw38mF/4aLBzKnTYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208811, "uuid": "d986d032-9f00-4b85-b2b1-1e678a82d574", "value": 2718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208811, "uuid": "fe77eeac-da94-41dd-bd10-a5f8ee0ffcf8", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208811, "uuid": "e7eed78b-a69b-4ad7-bbe0-b8854340bd82", "value": "5b849affd1e6450b94f1e76a5c3d419ec0c395a5a912759b9685f0bb68be5a1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "180f201f-adf6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255804, "uuid": "04f40da1-217b-4b0c-b31d-74523cfdf6cf", "comment": "Malware payload", "value": "cfee83dbe3b54481e4436af6ec9808c7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255804, "uuid": "2d7f926b-b752-4fa7-8d4b-b56684b93456", "comment": "Malware payload", "value": "5b911649498b7ca4e0d0d56759c3feaa9010fdffb6c5335c3fd9ee4ec6be21f9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255804, "uuid": "9c8c9272-4686-4072-a5fc-3fe31c7eaca0", "comment": "Malware payload", "value": "afc19b8c952f9077723d3f96996fdcbf2244714e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255804, "uuid": "5f4db89d-14af-4332-a01b-d49d284f87b2", "comment": "Malware payload", "value": "603a0d8bbb0f8d447b095440801aa7b8dc44ab6378a5d6ba4c23d9b19067cab24a037bbd2c38185d802da3f0944a35df", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255804, "uuid": "5d575ba9-a5bb-43df-9620-b878c1b74d62", "value": "5DF3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255804, "uuid": "1cf2ce49-2100-4294-a654-380367acfb9f", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255804, "uuid": "83d3c357-dabb-44ca-b0fd-ec4c250457aa", "value": "3072:hK4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:LDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255804, "uuid": "15974cd5-b5bc-406a-8450-4971e217f4b4", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255804, "uuid": "663752a0-a712-490f-a132-2945abcf29ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255804, "uuid": "e0069e3b-9e64-42d5-90a9-815e4128f54c", "value": "cfee83db_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d2f5a91-adc4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234311, "uuid": "6b8c64c9-58b5-43dc-9090-5a28b17d8d97", "comment": "Malware payload (Dridex)", "value": "cf383330d1ddd10453bb3e3632f6d31b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234311, "uuid": "d2190f73-53c9-4f52-948b-42aeffd3fa42", "comment": "Malware payload (Dridex)", "value": "5ba164c212f5e0cd07b82287ce00d985dbd235b5071afb208e80f545a98802f9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234311, "uuid": "c9de5d81-2c80-40f9-956b-5d0a688fca33", "comment": "Malware payload (Dridex)", "value": "32015fede93f0a2d4b3ddad2d117b685a103686d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234311, "uuid": "6f5f3652-d313-4af6-9b9c-852017091ee8", "comment": "Malware payload (Dridex)", "value": "53b5554184c1e046fc2d325c1795418afe1ba247be42552e69d8f7d0589b43c48c631f7dffabb8476c85bc5e00c11296", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234311, "uuid": "4f3aeb94-3bbb-4e77-9320-68d7cb53c43a", "value": "94F3C085DBABE87FC45A35399072DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234311, "uuid": "194bc70a-7415-4953-b41e-7d948acb5597", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234311, "uuid": "5007bf5a-4c8a-40c2-89b5-294b5a912065", "value": "3072:Oz45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:u4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234311, "uuid": "6e1d0515-01e8-457c-8927-3ee184ee6028", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234311, "uuid": "84785838-73b0-4e50-a0c7-b6818f75716d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234311, "uuid": "8e84351f-7510-4238-b0b8-25fd31f3ab72", "value": "cf383330_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d43bdba4-adb2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620226914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226914, "uuid": "d296f3fb-1a7a-48e3-83a1-c3e4cfd521e3", "comment": "Malware payload (Dridex)", "value": "25c200e18c8245d79f3cec4f7ed15a1f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226914, "uuid": "26ffa50f-f3ea-4261-9f64-610d4192a0f2", "comment": "Malware payload (Dridex)", "value": "5bc2e135813c1bc308fb93b54d585477f9359cf19c9bec34fad89e6d8e5b0c10", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226914, "uuid": "7682d147-822e-455b-853f-815eca60cad6", "comment": "Malware payload (Dridex)", "value": "dcb1ee597d36b95d475d9214d3139e61ca82774f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226914, "uuid": "7aa5de93-2578-4e1e-8cd5-0943a468c101", "comment": "Malware payload (Dridex)", "value": "f4990c64ce88469e62b7baf1e357570679593459a2d415213638ea0ff8b4a23bca220db69c13906ff4db1bab8cb5d437", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226914, "uuid": "745054cd-0fb8-4ce7-9e9d-ccfef8d8f591", "value": "68F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226914, "uuid": "d961aea7-ca17-41a9-9a82-9f8f1255b5da", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226914, "uuid": "eb57a31c-f946-4f1b-80dd-32c522d05f7f", "value": "3072:2mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:nLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620226914, "uuid": "52a43f3e-120e-44c5-b71a-a0663d62f92a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620226914, "uuid": "0f5e62f2-3b13-48ca-af4b-bed5eec5e8d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226914, "uuid": "775093e9-9073-46a4-9e1b-dac4a5e5189d", "value": "25c200e1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62799ee-adc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234165, "uuid": "4fb5ceb8-58b0-48b1-bd80-25403e33dce9", "comment": "Malware payload (Dridex)", "value": "106f6b93341e7f9aa67dadcf4f3a917b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234165, "uuid": "996f613e-a049-4c10-a78d-0803c4958a1a", "comment": "Malware payload (Dridex)", "value": "5bc452a6396fe5aa8d4b1d0e548f392dbed9ac194afaeaa769e75fe52660bc35", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234165, "uuid": "9e39886b-f6ff-486e-9391-25abb038ce22", "comment": "Malware payload (Dridex)", "value": "6c53b77a2b097101f68bb9e14da5d1d94b9b7c78", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234165, "uuid": "42d02725-2054-4fbb-a10d-c487950b9db5", "comment": "Malware payload (Dridex)", "value": "218ed9cbcd27f664f7dd761bee2bb8be5c67503fc8e0536c740b238f07894ef066f955a9673457ca82b994e181eb1d26", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234165, "uuid": "b2261738-40c7-40cd-a701-5cdfdf817511", "value": "0DF3C085DBABE87FC44A35399072DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234165, "uuid": "3e535756-daa8-4d45-8658-69f9899e2627", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234165, "uuid": "3ddba75b-29c5-4fc0-927a-5bba55beac59", "value": "3072:3i45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:y4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234165, "uuid": "fa3b8230-dba2-4172-a8fa-0ed8f60a42b7", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234165, "uuid": "1acd87a6-984d-4f2f-95ef-78d9ffe5005e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234165, "uuid": "8654ab2d-0ff4-42ec-9fe7-a7359ef92c66", "value": "106f6b93_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f864a0-ad68-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620195161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620195161, "uuid": "ca2bd6ec-24f0-4321-a287-c30352dedf25", "comment": "Malware payload (AgentTesla)", "value": "716aaa840f98c88db01ec67883060d27", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620195161, "uuid": "49d14c6f-06d9-45c2-98af-f7bc4632d9be", "comment": "Malware payload (AgentTesla)", "value": "5bc75f887b90a748c280df9a51775d1e3371c38c87147e20a3fdb181ee855bde", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620195161, "uuid": "2cfc7384-6b3d-4aed-a448-69eb230740b6", "comment": "Malware payload (AgentTesla)", "value": "fe6c1701c8fc3adf4895d179cf0158fb7afbe38c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620195161, "uuid": "09790739-b9db-4bf1-a626-4e8db9e650ee", "comment": "Malware payload (AgentTesla)", "value": "79957a2e3e2e706ee46cb127b9c8783e6f600e618cb0a46285de604c28815747fc0410695f3789be62d28f95394fec33", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620195161, "uuid": "c4401cc1-f101-4636-921d-af34362866fc", "value": "E8354B6832681BE1F27B5FB663DA1C0183B92574653EE50D8FA013FF5962F031A35A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620195161, "uuid": "0b4ddc7c-2571-48d2-b5de-06ad9146df83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620195161, "uuid": "aef007aa-9696-49d3-823c-79157a95791b", "value": "12288:pTbB4fWXY3Ot6InK1sLuNp+dM0kKg0D75wAPG+zETi/Pih2CV5R2DMa46ZSLmFb/:pI6ZSF5oLASn2Vti0WOq3fAq/VFTzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620195161, "uuid": "172870b0-dc6d-4775-b589-a551ec1f7a96", "value": 1106944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620195161, "uuid": "0d6a1f0d-216d-4aca-86e5-1ada949e487d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620195161, "uuid": "41aa00e5-eb38-4b18-ade1-65860bdc277e", "value": "#8007645.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06244ebc-adef-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620252767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252767, "uuid": "1c4875be-64ef-4d6b-be18-1fc41b51516c", "comment": "Malware payload (Dridex)", "value": "fbb20f1276d201c085e6624de16b9e51", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252767, "uuid": "aced8cc3-97f9-478e-b99b-4164fdbf327d", "comment": "Malware payload (Dridex)", "value": "5c1eb81ad37ce94f722bf2d2615b10d9460fafe3401400bd5a82023a7ea3bc3e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252767, "uuid": "fd248212-53f1-416b-b647-f0079b62a04f", "comment": "Malware payload (Dridex)", "value": "1e54ff446adc5a3f8486c9e4b7475320f28053b5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252767, "uuid": "10094832-efd5-44fc-a25a-1ef4851bb67c", "comment": "Malware payload (Dridex)", "value": "fc6f7bd1db4e549bcc396a3773e71542950892a8f66ef59daa2ce53053bcf82a689cc1dae8c6dd08f0d663b3b4d0d701", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252767, "uuid": "65d0d510-71d3-4c83-ba8f-19fd67319d0a", "value": "18F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252767, "uuid": "19d4a93e-a238-4aef-bb2c-d11bff4af615", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252767, "uuid": "105e1bd7-aa30-4f32-b80c-bb4ec4377bd1", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252767, "uuid": "a0b2d6b8-e9d2-476f-91c1-37821c94b76e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252767, "uuid": "a6f9fa7e-edf6-49a1-af5e-3d8428846232", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252767, "uuid": "998821a4-bffc-4ec9-afaf-587572a4cfba", "value": "fbb20f12_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c1f5f93-add6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620242067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242067, "uuid": "f9d21c2b-9cd2-4273-99ae-320a9bf1c05b", "comment": "Malware payload", "value": "f1a39968e42fcadfc514406975523dea", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242067, "uuid": "7271a34b-f5f0-45fb-ae9e-b6e39eb6c6ee", "comment": "Malware payload", "value": "5c5fbaef4ce01fff33aaa6c79544232ec81f36af22a3d15ad479b9d91485ec94", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242067, "uuid": "d4cb407a-8ec4-4ec3-b442-603ce1a12b9c", "comment": "Malware payload", "value": "9bbf968d135a1954f5a9b842c85e6481277c2fa1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242067, "uuid": "c8d4cc6e-3296-4a64-b648-9dbf5ee531ae", "comment": "Malware payload", "value": "ce46e81bfebca782c2c837abff175b6da6a1fd073e4ea6b6fe913f9563d02793d53c1e0b19eac0343bea0c8ebd89e0ca", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242067, "uuid": "e0b226b9-7f22-4b1e-8ce4-808e806583f2", "value": "B2F3C085DBABE8BFC44A35399071DFFB5B388B145650C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242067, "uuid": "308ae92d-3945-4a3f-a845-837a6d0f7291", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242067, "uuid": "64b6c0ce-6ac1-4d5d-95ac-22da552fe7f0", "value": "3072:pM45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:a4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242067, "uuid": "c9558057-9e39-4bc4-9c7d-58d5f299c746", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242067, "uuid": "d665508a-a618-4b75-9ec2-788a5b84fe4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242067, "uuid": "b2ea57d1-412f-4463-bbd9-ec64c0d17a98", "value": "f1a39968_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c86c2830-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252234, "uuid": "41254edb-fe1e-41f3-b41a-297d61d96cd9", "comment": "Malware payload", "value": "5f5316243358be9d69082b615fd3e5eb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252234, "uuid": "6431e893-cc75-44b2-a731-b62932bb0d95", "comment": "Malware payload", "value": "5c6867840c51c2f6b9902398f3b0d8fda7008a4d69e83436ba399a7e227ba137", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252234, "uuid": "f1c96095-ab26-481b-9949-99fcba76e7dc", "comment": "Malware payload", "value": "2513d7249d4b15d528e6b62b6fc154b6dc7eec00", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252234, "uuid": "7f376b96-643c-4dc4-b842-9c592505220e", "comment": "Malware payload", "value": "61dabea6b48c0b09aa016c7077e79779f3a93167f181c83e7673d6e03e60315bdaf1e5f0a1c3c7b561b15832b957f867", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252234, "uuid": "87658cec-aabd-4297-9bba-61174894ef83", "value": "45F3CFE89A9FC097E663583055FF3BB6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252234, "uuid": "4eb395e5-7c40-4912-833b-f64db23f3446", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252234, "uuid": "b623ad30-0ae2-4c6b-a1e1-71da3c9ca464", "value": "3072:Tf4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:8DBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252234, "uuid": "5ac43197-9a52-4cbe-877a-369342c881a8", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252234, "uuid": "2d2523de-27de-4ea7-b01d-8f6f64743521", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252234, "uuid": "3a4c075c-5e05-4588-81df-db43420afba5", "value": "5f531624_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c5b8a3-ad95-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1620214117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214117, "uuid": "70125481-bb58-4dc2-a0c4-b974820db863", "comment": "Malware payload (njrat)", "value": "e01ecfdf5cb0c7763775666b3bf86cf0", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214117, "uuid": "776bfd59-7bf6-47d0-af07-c6fb9a9e51d0", "comment": "Malware payload (njrat)", "value": "5ca40fcd8d38a1526647c9f4bf71d41fa3ef180155567e2ac41a596bc7936aa9", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214117, "uuid": "06004487-0002-42d4-9d1e-1663e941e8fc", "comment": "Malware payload (njrat)", "value": "cd8fd36d97bc0e483c9a94161d1656fc91cc4bde", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214117, "uuid": "a43440bc-1fa2-435d-bf01-cdc492054d29", "comment": "Malware payload (njrat)", "value": "89a8ccf05441e461bf91cbdd3c53d827562117511e0f1c68d9d1ca8715fd16aee1679b745f424ecdabe6b6ab33002cb5", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214117, "uuid": "e9778143-e1da-4b56-93e9-efbda21c0fbe", "value": "7213D78CB784E175D5FF8BF1B492B2990B71901BAC02930F99F154E94BB3AC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214117, "uuid": "ea40c6c5-3728-4474-8634-b609397dbec3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214117, "uuid": "4efb79f6-f8bb-40ca-852f-fdeeab0fe7e2", "value": "384:qZyY9VsVqb08yPYpHOhuSIMQVGcR+9D9O5UE5QzwBlpJNakkjh/TzF7pWntTgreb:o99Vs8Y5PYN+xEV/vQO+kB+LS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620214117, "uuid": "9292f39c-ee28-41d8-ae84-cbf0b76ee589", "value": 44036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620214117, "uuid": "efe2d4a8-b251-4379-82aa-d62972e5241c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214117, "uuid": "328658a9-b979-4a8b-958e-9ba2729426e0", "value": "62cF5P83h7SK1BLS68Q2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e2a39dd-ada0-11eb-abe1-42010a9c0039", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1620218958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620218958, "uuid": "3df9e350-9804-4209-bb4a-4cfe3a497e90", "comment": "Malware payload (CoinMiner.XMRig)", "value": "4930920087503d221d8bb13e1514620b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620218958, "uuid": "83101ec1-d785-4069-979f-5c659596ec84", "comment": "Malware payload (CoinMiner.XMRig)", "value": "5cf202837c24442de4f09ee9a152c77f911b405541fd30567bcc370ef61f5f75", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620218958, "uuid": "6d6bdfa7-c397-41ef-b0fd-6f633d9a0551", "comment": "Malware payload (CoinMiner.XMRig)", "value": "07e2d9be6cce22e6b1b44992acf2d536c3675e07", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620218958, "uuid": "32b13e5a-a992-417e-a5f4-d2431d1e0e33", "comment": "Malware payload (CoinMiner.XMRig)", "value": "a9569e8f31b8ef0f34842374f609269bb03ec2d290eed03aab79c5584065527d3a5452c09b80bbc3ec56fcda2d771d43", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620218958, "uuid": "12ee8236-0080-4b02-a820-f6fd9c09da1d", "value": "7CD5BE17BC4C7D8DF992BAB62D8976196850FC34F628079B35C1B909E4383A7B077329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620218958, "uuid": "8f5b0298-5dda-4a4f-ab29-22937a812243", "value": "eaf850221ebb92188ccb4c061d41387b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620218958, "uuid": "da305792-a047-4397-82e2-29d41f1b264f", "value": "49152:7wqJuyv0dpFEjZFgwa0aTuyDAkD4qfFqlYCd6/0ihTFjKiq2:vuuoFKAhHcCqJ47hTBKiq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620218958, "uuid": "ef7141d1-25c7-420a-a4ae-af05b29bc029", "value": 2901705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620218958, "uuid": "fac3bce4-2ce2-42e8-848b-f1c17f4b9f70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620218958, "uuid": "33f4a704-a54a-44ad-a3fa-b1e3e07e55d5", "value": "notepad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5421ac61-add6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620242161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242161, "uuid": "f9ab95b7-31cd-4e6a-aa7f-22f55fe3f6bc", "comment": "Malware payload (Dridex)", "value": "7ffa68d90827ec61c762ebe3a492b52a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242161, "uuid": "bae83d4a-6810-4641-bd33-f860d1205d9e", "comment": "Malware payload (Dridex)", "value": "5d4eb87273ae69e60f099125640bd88d939b9485e3d10ba80770a3a1acbdb945", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242161, "uuid": "f383378c-d30c-4b9b-8981-54b311b550df", "comment": "Malware payload (Dridex)", "value": "8a53a42683a960056aaf7161af12dfb0b345206f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242161, "uuid": "365ab4d9-2273-4505-bd9b-0cbb6344c253", "comment": "Malware payload (Dridex)", "value": "c88cb93dc902053eff96d42b2b8f960524ad6bb7b3193db37dfb4c8567cb9b754eafa0a0b8c20fd2e9904cbd22b326cc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242161, "uuid": "752fab35-a544-4a03-a891-9e194bf2b88a", "value": "ACF3C085DBABE87FC44A35399072DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242161, "uuid": "8a047d6e-b720-47c8-9b88-a5cb64dc82c7", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242161, "uuid": "b5e13432-80c4-4abe-9355-f4af803e14f5", "value": "3072:qi45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:z4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242161, "uuid": "734b8242-1a5d-440c-a847-7f114507b309", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242161, "uuid": "5984fe23-d961-4ca7-a925-3d96955e0f5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242161, "uuid": "56458d52-acdc-49b9-add7-31491b6dd96f", "value": "7ffa68d9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb67d919-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208914, "uuid": "568a55cc-0376-4dee-a7fb-6669275705d6", "comment": "Malware payload", "value": "0b00a512c6dff3e3de6ae214a6695068", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208914, "uuid": "d76eeb05-0f77-4a31-b800-e66e67d0eebb", "comment": "Malware payload", "value": "5dab8978ce0e52c2fc76267d34af29655352ab762323dac14752f5dae8094358", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208914, "uuid": "ec4a409a-e97b-4bfc-a58e-0ce1c50abd58", "comment": "Malware payload", "value": "6e6d2396b9940dc8f957cb407904add1cdf20e78", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208914, "uuid": "b3b4b6d3-6bf8-4b13-86f6-927787366062", "comment": "Malware payload", "value": "77cc798e08f66d2d4cdae4c40689c93c4863db4c93d01c57c97dc6346a9ffb455c9c0827c988be171d5798e0a6455ed2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208914, "uuid": "bac35860-0f09-42cd-b720-6b92d01fbc55", "value": "FD75F1CBE85337DAEC440037937DC7109172A49A3D610BAF2C2655DA798E1BDC46FBA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208914, "uuid": "a8a7ddf2-41b2-42f1-a96f-314111307316", "value": "b6e5ce7f643afa548c962339e27a8b91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208914, "uuid": "bb0faefd-20f4-4fe2-8ffa-ce7c3aad9ad0", "value": "24576:1cVJUsDOw5R0IoDt3nTepyt/JX9J0sBYWlKi3vFLWt:CVJUdw/5oDt3nTeC/Z/hBYWDv5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208914, "uuid": "e13cb7fc-7953-4cbf-90f4-43760460c988", "value": 1598464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208914, "uuid": "9c97c692-a59b-4162-8d9d-f623a6ff8938", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208914, "uuid": "738eb79a-9887-4e61-a9c5-1b8f66ba2bcf", "value": "0b00a512_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb88182-adc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234285, "uuid": "b6d1c93b-dc8e-42b3-88e4-00cdf766cb1b", "comment": "Malware payload (Dridex)", "value": "9a6b5f6122cc9238d9d23854002f767b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234285, "uuid": "7a142f2f-1e1c-4aa9-bbed-a12dc5cb42b0", "comment": "Malware payload (Dridex)", "value": "5dac45fc7d0d2f1d3c10613a29347dd8b97d22ddbf5a3553f60f4c7648d05215", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234285, "uuid": "020348f3-eb85-46a0-bfbd-40c0fb0b0f4f", "comment": "Malware payload (Dridex)", "value": "9b604b2629a28c0a8899b1aba2c0e23bfbe06f22", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234285, "uuid": "9f6e75c3-f66e-4a01-8b6f-17176f803be8", "comment": "Malware payload (Dridex)", "value": "e2fc1bd985c10a98dc3acf12157195590257e9ca87cfedbe9d004b4607719af3bb959e569be4ad7ca62526af8fa5abda", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234285, "uuid": "02bc315d-ba14-4cca-b0f4-1dcd2f17920a", "value": "9FF3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234285, "uuid": "373dc101-cb75-4c49-a090-13e5d1634869", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234285, "uuid": "d2f20696-dfef-4326-a56c-c66ce2e798cc", "value": "3072:wPi45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:wa4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234285, "uuid": "3c09e327-a18c-47ef-8a2d-fe24043b63bf", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234285, "uuid": "f5667caf-4e17-42f2-81ec-a1bee87b34c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234285, "uuid": "b6cec12b-316b-4773-8f70-0ae3bb247662", "value": "9a6b5f61_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a8322d-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252337, "uuid": "e8a5d75e-2199-4f49-8af1-7e48b67204a9", "comment": "Malware payload", "value": "19c3779bcb0e9a4e4c287d998df78a87", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252337, "uuid": "9213e5d7-ec4e-4e29-a927-543b293d363f", "comment": "Malware payload", "value": "5dbe729009376076d99fce758e25fbc57a0a0f2471c4b98440f0aef5d12ac050", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252337, "uuid": "7ff24e99-7beb-4a30-ab38-f5983479c254", "comment": "Malware payload", "value": "9193944bda8331f12186bb80014db4d1fb79be8c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252337, "uuid": "916ad142-4ac5-465e-95b0-c74501236445", "comment": "Malware payload", "value": "61b0b6f4d8bd178dbcc3c19b11519cdbb20444865cd74993fc259916ffb9dd6ebe08db95a242d5506109ed50b5a4f9d8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252337, "uuid": "3908fa1c-e9c7-4278-a522-a9e054284c24", "value": "13F3C085DBABE87FC44A35399072DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252337, "uuid": "bde9203d-29df-4823-8d4b-12e5f45ffcde", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252337, "uuid": "d0918134-4ab7-423c-b5fb-bd98d6d65671", "value": "3072:RB45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:74KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252337, "uuid": "eaf677fc-6103-45a0-adaf-48016f7cd4d2", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252337, "uuid": "8ef4ea54-4c3f-4292-b3cd-b280f0fd3c12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252337, "uuid": "4240648d-6157-4e4b-be9d-d28121d0b1ed", "value": "19c3779b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3c8e41-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201778, "uuid": "b94155a8-d333-44f1-9aa3-7b1d101d96bd", "comment": "Malware payload", "value": "603e641b7747dcd7e27639dfb87e6942", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201778, "uuid": "1903a5ed-22c3-4fe9-aa7e-bc412acde282", "comment": "Malware payload", "value": "5dcbbdb1d5a8b47a50a05b2cf13963139075616f4b6de2db2232aa73bde800c1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201778, "uuid": "d16d3e11-5194-43f7-bb9c-7a888988a2a5", "comment": "Malware payload", "value": "c7893026f6c09a79edca1819170a7e8aa6dba560", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201778, "uuid": "e0881d5b-caaa-4d46-a192-4dcf20557c54", "comment": "Malware payload", "value": "7cc1a8a4434370a06a53e7cade330c22db2c0b269273647bb84dece6e3087d9843cbd9a5d388ba95a3f0b1bb67f17eda", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201778, "uuid": "1df85961-a0ec-442c-aeb6-61a5a1e43134", "value": "E385F10A25896F69D96108BA46D4EFB072DCA3B1C14FC93E34503009ADA16DEF97BC5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201778, "uuid": "e32ef43f-50ed-4770-a78a-12443b98cde8", "value": "15ae74631a448b60d988819585873cff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201778, "uuid": "7a0c7018-e587-4de0-ac47-69b94e0fac15", "value": "24576:rVbP59u1rQAccfyiIsOVsBWRLizyDJ+INB1RBHYspN6jdBbpP/n1wZ:rVbP21ac6BsGsBW58yfX1RBHYDLbB1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201778, "uuid": "2af51118-0e6e-4530-a416-4f0a99665c15", "value": 1726464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201778, "uuid": "453c3a9f-c586-40ac-a354-0ab3e77801a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201778, "uuid": "f3d59f0a-cabb-4559-9b0e-5d85ab0b6b0f", "value": "603e641b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c4951c-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252545, "uuid": "8e3a00c2-699b-44c8-9af1-36aaa0cb2fd5", "comment": "Malware payload", "value": "afbe0611d5d0ae49408dfdc40dfda181", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252545, "uuid": "09be2a9a-6a91-4bc4-891c-0a733676fa31", "comment": "Malware payload", "value": "5e412e40af2e7aca2f70ebbfbb2a546d1cbf660b943e2089797d343358159162", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252545, "uuid": "058227b9-2aa1-44c9-9a76-f904df590990", "comment": "Malware payload", "value": "ac874515b73da905dfc30a1bb0c76b7083671727", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252545, "uuid": "c8a7d885-1e34-4e7c-b67b-d5e43c4b566e", "comment": "Malware payload", "value": "62f23c81bb780317ec2a2da3987642f787be31b6bd7ddeb37be97f34088026d7515052e537d96b2c04e951f970d09dee", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252545, "uuid": "2f7cd4bd-eeaa-4f51-9fee-142f70171bde", "value": "AAF3C085DBABE87FC44A35399472DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252545, "uuid": "a0040efe-b57b-4789-ba87-5afbdedbca55", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252545, "uuid": "1120cf4e-aac7-4620-b733-31276067ff07", "value": "3072:px45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:r4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252545, "uuid": "bb5f5e55-685a-4a3e-ad46-6ad747b57670", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252545, "uuid": "8123ec9f-f70c-4045-91cb-1aae699a42f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252545, "uuid": "7d0a0373-fbc5-418c-a972-d26ad71c1091", "value": "afbe0611_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f46c8da0-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620242000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242000, "uuid": "d38b7f41-1bf6-48d8-9345-6c505ee6a215", "comment": "Malware payload", "value": "977ca623907ea9e8dd7f666a396bf189", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242000, "uuid": "e6f10882-4426-46fd-b7da-0a1073682ccf", "comment": "Malware payload", "value": "5e74e49e42b8aacb00e2dbb101887af53111c6757e55bc5dc648c06dfdec6445", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242000, "uuid": "f43f313e-69db-4bac-8e73-bd9fa196f2d2", "comment": "Malware payload", "value": "9089f6a53f81cd50f132572a2b28de4d851d9038", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242000, "uuid": "634772d1-a33c-405d-90d8-5df134d233fe", "comment": "Malware payload", "value": "bedad2bb6ebf3fdab09d225359b5285c360c7db3cd2d5bc7acd35204cc9b54556cfadbdb6a922741145248ca4cfa67d1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242000, "uuid": "d68cd459-7007-464e-a71f-bff3d342e7c1", "value": "CAF3C085DBABE8BFC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242000, "uuid": "d416a348-6730-4ec7-85da-3639952918f2", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242000, "uuid": "1d1999c6-36e6-4f8c-8582-c33be16eb7b0", "value": "3072:yi45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:r4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242000, "uuid": "124c3fe2-9851-46ec-98f1-1635a9d18f5d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242000, "uuid": "7c4f9238-729b-411e-a63f-2565edfd5249", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242000, "uuid": "db1647cd-2357-4789-aa71-a1f437e133be", "value": "977ca623_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a6a558-add6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620242111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242111, "uuid": "00e37876-c349-4db5-a747-f277021a43e4", "comment": "Malware payload (Dridex)", "value": "082b89d3e0fba452dd91bceeabef3109", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242111, "uuid": "b0752e59-1fc4-42fa-8b85-c5b6dca7e737", "comment": "Malware payload (Dridex)", "value": "5e79c23c6fbad7495698844031f3f76d32004ae0df158a094a89589ab1227879", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242111, "uuid": "3cf93d7c-f8d5-40aa-bb2d-bda6c209716e", "comment": "Malware payload (Dridex)", "value": "87b3af2b8301094349f2aee9093936778a0bb8ba", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242111, "uuid": "45ba7529-af32-4222-baa7-c822c9fd29c4", "comment": "Malware payload (Dridex)", "value": "49b59266f9c15855b4591add81eda43152ed97daf54206de8cef617a9668f2c0be41299594afbcb1724db4f9eb43fae2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242111, "uuid": "90a8c203-1331-498a-baf6-af74c1e80871", "value": "1FF3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242111, "uuid": "c9d20edc-a958-41b6-a6ee-1f47e96d820d", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242111, "uuid": "75ab96a7-6266-4e73-b2f8-456e1670393e", "value": "3072:Di45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:+4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242111, "uuid": "3522c0bd-01e5-4117-8908-26398de837b6", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242111, "uuid": "461e5ac1-2635-4585-88b7-c990f9341991", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242111, "uuid": "12e08f45-3960-4671-8615-feaf73fe45d9", "value": "082b89d3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9275786f-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209194, "uuid": "620f31d0-021c-4e65-8dcc-f4fe73ed6b8d", "comment": "Malware payload", "value": "69ff241eb6f7c1d1e46d301012bd969e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209194, "uuid": "4c400408-64ca-425b-843f-5eb2740d2e3a", "comment": "Malware payload", "value": "5eb3653cb7eeae620550db5add263963438512c97d3f93e922a96e55f903eabc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209194, "uuid": "2cd3d097-b3fc-46a2-a3db-ac4df00cc9ff", "comment": "Malware payload", "value": "cf83e550e4111eab74a694d7d588705458a85e84", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209194, "uuid": "5a48b4c2-943b-4cbe-9f7c-82556a086285", "comment": "Malware payload", "value": "5fc8d10088739a756d0ed0a52f25297875f245cd56195f67160a57664c7e3798bd149ec50b63766c41e0fccae3010ec1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209194, "uuid": "f60163bb-2fb7-4a08-830c-354233e62829", "value": "C5335B0BDAC180B6DC1162B004BA9777EFBB425F5172835BAB2CEC667E72690D43D385", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209194, "uuid": "58540a1a-6b7e-4c08-9dbe-0b0c5a1a7cdb", "value": "f690849beeb36157d49229f8d6a809cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209194, "uuid": "979bed01-c8d3-45c0-8fba-94ab344c3491", "value": "768:ZjQn/FRr4+xu33pRAmQTlYF+i756cvl1:untRr+5q1p0ocvl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209194, "uuid": "dbe90aca-b60d-4e78-9b33-91cb2607beff", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209194, "uuid": "8770e347-3c25-4584-a013-0e6b51e7f01b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209194, "uuid": "ed7d3dec-5f36-4cf8-8701-a6ce3acb5cab", "value": "69ff241e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125fe85e-ad92-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212845, "uuid": "7925f996-1476-4df0-a758-e481a574b55a", "comment": "Malware payload", "value": "aa625b8479b7874ae21cfce7f0bd6de1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212845, "uuid": "7a9f8c24-804f-4c29-af35-822a3b57b2f2", "comment": "Malware payload", "value": "5f32ef9a224027930381255b1ff7d6be7af83f4886006243effeee31ec775b6e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212845, "uuid": "bf6c4720-d75c-4d34-b58a-6edda6a6aa63", "comment": "Malware payload", "value": "f5906108c38dd0ff1a5f846f80cbc648f03e5f0a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212845, "uuid": "8d8f1762-a381-4497-88c4-ad9c51e261dc", "comment": "Malware payload", "value": "13d7050c88e3b339bc65ad253f427c26ffa524532137f5b4d1aaa38af82cae2d91cb764cef665ef77ffe0224d2f05adb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212845, "uuid": "c9fcf3a2-144d-420a-9579-54e56462fb0e", "value": "25C4F11360EBF08FCD790F7817492BCAF75063E6A7CA184F6518E4A76EC8D050AC9799", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212845, "uuid": "760ab30b-9937-4867-956c-fead7abb911b", "value": "7e779988895dab45295a9c1b5461bf0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212845, "uuid": "9773ada8-a9dd-4717-b686-9e07a5df9adc", "value": "12288:r4ComBUiyhTrakH/4fTsGcArvqsY+G+IWRuVc0fHn95uIl:cCfBUiyhTrwLG+IWEVN95uE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212845, "uuid": "d0e8192f-2f62-4d3d-9c13-46b56d51a6cc", "value": 546816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212845, "uuid": "ac81a0a5-9ec6-430f-a1f5-4fdb17f88f00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212845, "uuid": "eb5998e1-ff62-4c5f-9c3d-00e47b24183b", "value": "aa625b84_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "496fb4e6-ad81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205635, "uuid": "1c757f58-4392-4069-86c3-4693479fa1d2", "comment": "Malware payload", "value": "bf48d993c260b3c5ced1d28cd6184234", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205635, "uuid": "e950d682-6217-41a3-8a62-04ed5fd9bf2d", "comment": "Malware payload", "value": "5f37a5eef35b96840920f797cbdc7a038efe7be0c0daed0b8a352c671c9f2f27", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205635, "uuid": "8c1f684f-ecd1-4236-ac0f-45b34aec3323", "comment": "Malware payload", "value": "b738f7f08e0a41026f246470a77495df16d3afff", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205635, "uuid": "0b196790-7351-4f69-9b36-db06d3cb872c", "comment": "Malware payload", "value": "fe57dd55ad4ed2b76daab846c34eab6c64dd089f98fbbf39a094173e0ea0bb677dd6c5ff8fe59f98739c87c88cf8dcf5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205635, "uuid": "b54acad1-b944-4ddb-bf57-d7ef579fb067", "value": "84B4F198DFAB1761C6EE5C3CB0CC2D19F0E4351035CD41AA472262D6A67EAF9D22DDB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205635, "uuid": "29753cd9-885a-4ced-a1ec-917bd6b80bdc", "value": "d66917e67b699e046b9e1f9da189ddab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205635, "uuid": "ea58f259-83e6-4c3a-ba12-06805058da66", "value": "12288:XKcMeFVPU6SyND0w08SA8mfTHnuOYlWDPmGXJK9tU:XKSvNDs81CG5Kk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205635, "uuid": "9bdb9a01-26ee-443e-871d-6028e307771f", "value": 540160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205635, "uuid": "f45fd6a7-c674-4706-91df-b1fa569a60de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205635, "uuid": "1b1d8218-7dcf-4e33-bc72-120ec95851f0", "value": "bf48d993_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fb6546c-ad6e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1620197566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620197566, "uuid": "5c5229b6-0552-44ae-840c-722b7b83e881", "comment": "Malware payload (Gozi)", "value": "4e5819432aed64b49d97f83894cf2445", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620197566, "uuid": "b22e624f-75c2-43b6-801e-162a05937cc3", "comment": "Malware payload (Gozi)", "value": "5f92ad3a3ad50bb01575cc7fb57ea1777280ba2d9c87cf829bd0197c6c0d85d7", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620197566, "uuid": "0da0ee3a-d2e8-479a-8327-0db4a1be51bd", "comment": "Malware payload (Gozi)", "value": "15d4d4b6819f932ab0d4781c6d4625ff31f7daf5", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620197566, "uuid": "49963368-2901-4cf9-ab58-20db212029e8", "comment": "Malware payload (Gozi)", "value": "d16f07305a969ad4011535e1cd23d3169905e5a72d5378ee55e7d7f5e8ff94a7e72c8dd221a4203430adcff10e525da7", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620197566, "uuid": "a59104fe-cba5-4f4c-b920-68f845808a7d", "value": "8AE16D63EE816851D2C1583B363196EFF8E89CEC4777865302901AE4983DA453FD30E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620197566, "uuid": "dfbf15f2-f745-4067-9fd0-e5f10f5627c6", "value": "192:DJtU2jaeLkUgY6N2lIJz4LpE9hqd9GOyIXe/:DJt1LkUf6zz4pE98bGXoy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620197566, "uuid": "0438e397-5dee-47d8-8457-bace1a8f3709", "value": 6839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620197566, "uuid": "39c830bb-add5-425f-b215-44fec8987bdc", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620197566, "uuid": "6574c5b9-4a20-42d9-ad1f-d8cf13bd8efe", "value": "presentation.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d43a257a-add3-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620241087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241087, "uuid": "9f1551e6-d910-44fc-9948-0a8d1ebfc564", "comment": "Malware payload (AgentTesla)", "value": "bd44905da49d1dedf79d5f18f22fcae2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241087, "uuid": "51468a49-befd-46bf-baf8-5994f43fbf5d", "comment": "Malware payload (AgentTesla)", "value": "5f95dbb3fb16c1324276a4c2e1cece189ac2a2a26030362c4137c2d1b3f06fb7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241087, "uuid": "d1d2faf0-71a7-4410-ab9c-efa6c0a570eb", "comment": "Malware payload (AgentTesla)", "value": "923eb9a55bd58c682f8bec38c036e85f861650fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241087, "uuid": "e66ebc34-b8bd-490f-a76a-5929b6e72d58", "comment": "Malware payload (AgentTesla)", "value": "2e67097cf85ec895c793fe6eb5cb1b40a381c30c7fa4a49725c7fa67b6726c217d4ccef0492d5e877770cf80d20c2dfa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241087, "uuid": "cb3d91ec-30c8-4d0b-a1c9-a3ff7c1c4657", "value": "B805123922884A56D57E473D7438C50067F57A2AC7A3FB0E7FC021BB6FB7B019A25660", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241087, "uuid": "f39d282e-1c44-4638-bcfb-61ee722f9213", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241087, "uuid": "24aac55e-b0a6-4844-bfa2-1095bc6fc334", "value": "12288:Rmtkfl37EAEMqGTeFhkpTL9o0E+XX6jP2AznW6M1FGlcOENWx7DtJ6pXkJ6x+PIa:DJERGTegrTrXOPPLNgQEGcUfgR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241087, "uuid": "0840c2a5-2b03-4983-af2d-0b99ee581343", "value": 807936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241087, "uuid": "6e960e42-cf61-4242-a9f8-50f142ea1285", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241087, "uuid": "5aef8ad4-4f64-4741-9a9d-c2007d909077", "value": "bd44905da49d1dedf79d5f18f22fcae2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3efc1713-ad81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205618, "uuid": "71f24277-9656-4ad1-b4fa-b703f43afda0", "comment": "Malware payload", "value": "513206c3b6dcde952c2a6ea7f9b41ac9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205618, "uuid": "928546c7-d76d-4d5e-9660-9a78ab07cde7", "comment": "Malware payload", "value": "5fa7743a5e6aa3bf35aef1e5729259bd6a56904caa2f3fc3318652d87bc9f86d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205618, "uuid": "b48c1e4a-8ad4-489e-ae47-76956cff21f6", "comment": "Malware payload", "value": "6c148413202b9d13f9e1b8e052d347def31fe442", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205618, "uuid": "2eb43636-9c82-481a-b6fc-7dafa0edaa06", "comment": "Malware payload", "value": "183d70990a2d886ea1441753342430a12f2dc93e1a048a319a7b1a4b15f7ffaf309ae3818628e6aa89522d5eb7572e15", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205618, "uuid": "301ee4a9-8b80-4f59-a671-d239618cbafc", "value": "79F4BE42B45831ADC1EF99F8AD9B1317139307AB7D4AD5B33673E828643512249FE0EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205618, "uuid": "6e37ea07-803d-41d4-9db2-13045566fb15", "value": "2e7b70db0b106d119448eac4a3292cdd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205618, "uuid": "453ba2cc-1df3-4da2-9501-1c5345802cc0", "value": "12288:p4eVLszr0TUkfoo+e7APiSHT0uQ3z8fj3gliTm:p4SLszgT6i7APiSHT0Lz80liTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205618, "uuid": "737b6354-507a-448b-8abb-fabf399196bb", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205618, "uuid": "8d22adfb-98b4-4ca0-bac8-16ac2dc7a7ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205618, "uuid": "ede9d64d-af31-46dc-b091-ff96444b4d03", "value": "513206c3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f2eb63-ad77-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620201338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201338, "uuid": "a6b2da70-d275-4320-bf17-8bc502ba8482", "comment": "Malware payload (NanoCore)", "value": "697f887608bd0bcaf13290479a9a6935", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201338, "uuid": "597a6299-706d-46ca-8765-39847b17db3c", "comment": "Malware payload (NanoCore)", "value": "602030a970c421267dee98de2dd004e17dcc1543e6a41c6eafbbf1a9ee2c8779", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201338, "uuid": "c5c900b5-0b8d-4843-81bf-d507edbbf42e", "comment": "Malware payload (NanoCore)", "value": "77bea28b6a72afd461aa759a0e0a800b0cb35a4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201338, "uuid": "4e3e1be8-0959-4270-b945-14d6d5d2a1fb", "comment": "Malware payload (NanoCore)", "value": "eee75a0b45ee6663f7124f7b511297aeac5d3dfcb80bdc77ae019be24031496f26aa3dabe6c2eb6fb812e1c25a01d295", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201338, "uuid": "c1f14b89-5ece-4bab-8a80-1647b1426d0f", "value": "98F4127C735CAF6BC73E25FD0004694136F6C412AA2AFB99BE8551C087EAFD98742607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201338, "uuid": "42c81c34-2e62-4799-bc0f-0ad65e4326c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201338, "uuid": "e9d99fb5-91bc-4607-ab89-fa7635a81f5d", "value": "12288:1rsFfond5wFjiN6lN5fGk9bdt3ZSCQSOLgZEhKztnK9nmNdYASe+WU2ZRiUqjzEa:1ofond5ajXFfd41Lgmgztnqcd1SBMZRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201338, "uuid": "fc201ff1-b426-4562-9b4c-82593ca79744", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201338, "uuid": "2199d250-fe68-4039-9def-3f40abfc50b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201338, "uuid": "d5673e4e-befd-4900-bb3d-44bbf928ef17", "value": "697f887608bd0bcaf13290479a9a6935.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03cec50f-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252334, "uuid": "188f6af0-3770-4122-853c-c165ef558231", "comment": "Malware payload", "value": "09afc5278da48aa2035ba08892a8f9f2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252334, "uuid": "a186a6f2-a273-4084-9802-50d95ad9d7b1", "comment": "Malware payload", "value": "604eeb3266ad164ea1a0ab9e489b7b4831149accf718a8b98fb587de2305e1cb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252334, "uuid": "89441762-bd82-4354-b8d9-a8dbec25fd54", "comment": "Malware payload", "value": "671157126b67d0dcf6db70683a1a8e9af9ada7b6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252334, "uuid": "3fe7c735-f573-4274-972b-23d3d4ccf917", "comment": "Malware payload", "value": "dc329ce283858769069f40e6ffa2b97c0ca7e5948596710891b7eb59367647538f4aad24f15a87b6af8930d62ee640cd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252334, "uuid": "3539b66c-8c31-486e-a412-71f7358679fb", "value": "13F3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252334, "uuid": "22473be2-c7bd-49c3-8ac0-939664b26f2a", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252334, "uuid": "cfa0614c-4582-4edc-b02e-3824c70a9265", "value": "3072:RK4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:7DBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252334, "uuid": "9004c90d-b957-4e0a-8227-94ff8300bd65", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252334, "uuid": "071dd07f-1e1b-4576-95c9-5ab12d2b7f98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252334, "uuid": "f22d8b7a-ddbb-4152-a998-3fbf43ca514c", "value": "09afc527_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19494bed-adc4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234331, "uuid": "86734f8c-18a2-46a1-aaf7-8fe0dd0b690c", "comment": "Malware payload (Dridex)", "value": "90ab9675d977a6bc4281b37c76ba64b4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234331, "uuid": "94878cd5-d72b-45e0-b1ed-f21bffea3e1c", "comment": "Malware payload (Dridex)", "value": "6066d85f9c9e2b1e7aa2acc89b936dd0ee16daffa6ac71edd229b386cd9052e0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234331, "uuid": "e3860127-6fe3-42b3-816f-d5fa31fcaf5b", "comment": "Malware payload (Dridex)", "value": "708623911e57084b070eeb8e89012ea0ec6cad6b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234331, "uuid": "9876ef19-d4a8-444e-aaec-62632ab39f1e", "comment": "Malware payload (Dridex)", "value": "96c5eed77dbb3c47eec4e43e172cc0fd4539944f9b06bbb79e4d28ee757c223d79a444b1543ec8ac46ea857928834bba", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234331, "uuid": "109eea11-5f45-4635-a006-403d6a5c868f", "value": "FEF3C085DBABE8BFC45A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234331, "uuid": "b6fd1b50-275e-4923-86fb-70effd5860c4", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234331, "uuid": "20aeacaa-398d-4f0e-8114-38e8bfe441f3", "value": "3072:Wk45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:Z4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234331, "uuid": "31ae9a2b-3edb-4987-b11c-fa2eedfe02f7", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234331, "uuid": "871542e4-de69-4784-9e17-00888a5f8486", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234331, "uuid": "441215cf-74ac-43be-b5d7-e95013c2ebca", "value": "90ab9675_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f5cdad3-adcc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620237750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237750, "uuid": "274f75b2-ff97-4bcb-8837-1a36c4670fb2", "comment": "Malware payload (Dridex)", "value": "1cf9b6a921f4fca26e127445f182b1a3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237750, "uuid": "8d46931a-aa51-4391-b964-4f275b5c3d70", "comment": "Malware payload (Dridex)", "value": "60762d277f211cb1b255d7e6272da1816dc53acad0bb2fee44c103b1212a5958", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237750, "uuid": "2e009df1-5c9d-406f-b2c7-cdcbd29451c9", "comment": "Malware payload (Dridex)", "value": "6ed5aef775f9eb4c81978a27863f019181f9a465", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237750, "uuid": "bff98f09-f4b1-4a6a-baa1-c468792b05ee", "comment": "Malware payload (Dridex)", "value": "238efedf235705d0d89faf2835e10c052e34758bd23893a896f693ea0ff2f19c27276604b473f3989d396da35aec0aa5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237750, "uuid": "1ebc28c5-fea3-4925-acbf-f8ebc0fd79a2", "value": "F1F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237750, "uuid": "807683cf-ea38-4306-baa6-22f19d807280", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237750, "uuid": "edf48fec-e5e9-47c9-9298-e0c0926c6328", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620237750, "uuid": "6cffa545-1f43-4df9-b906-3630f98348f0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620237750, "uuid": "7fc44a1a-3a6d-46f0-9502-27b16700de46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237750, "uuid": "92425c55-a4dc-4a1c-ab12-dee0d08f85f6", "value": "1cf9b6a9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b6e1247-ad92-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212833, "uuid": "f605cd44-fca3-41ed-8f25-b48ca7bb4e2d", "comment": "Malware payload", "value": "93b037874c3313621039bba31c52c2bd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212833, "uuid": "aff127ea-db24-4ec1-88c6-94d0896259ab", "comment": "Malware payload", "value": "607d0fc98261aa322af8a0cec950eaa5a1d14e7c9c94d962e45498400cbe5924", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212833, "uuid": "9ddaf7ae-ff7f-40cd-94cd-86a7a46abba0", "comment": "Malware payload", "value": "c4a440434a9abc6ad2670211138e80198f217593", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212833, "uuid": "ff9fbde6-8914-41a2-a1c9-ffc98e29b6ba", "comment": "Malware payload", "value": "f50ff497c50d5e7738720b871f2a791c95c7771d1d6b8c814cedccd2f9da5f10575da18d98771fc5f05e227850bb954b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212833, "uuid": "a4db8f3d-2784-4a5c-8c6d-2d085b3194f9", "value": "3AD4BD9DEEBC16EAEAD8D97D8AD0B94547B84E404243ED1E7DEA00681FDC2803D709DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212833, "uuid": "caefbc03-efb9-46ec-9cd4-4c0430a580b4", "value": "0fa723abdbab2dbec22bc3c9688fe32a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212833, "uuid": "1b88d18c-441e-4037-b23c-78fa63b45ca2", "value": "12288:HkWrfgakBJKVb8dAHZZA/4vv0uZlW85Fp1KErN/j/rLzTm:EWr4a6DdAHw4vv0uZlW64ErljTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212833, "uuid": "b299103c-a22d-4eac-80b8-3cb8449ded60", "value": 640000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212833, "uuid": "023e74c9-b78a-48fb-b0e7-8875864ea89a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212833, "uuid": "3b3c1d09-4b78-413f-8f59-3b899f5448e3", "value": "93b03787_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5fbff0c-adce-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620238889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238889, "uuid": "bf5b67fb-0e3f-498b-9404-1f00d746745b", "comment": "Malware payload (AgentTesla)", "value": "77db2e367079dd5f83e6c45c692c5871", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238889, "uuid": "8f2ae422-d559-4343-b054-475e5b9cce1c", "comment": "Malware payload (AgentTesla)", "value": "6093d62cbe100ed991470634379aec43c5de51278e6b9bee688e7f45062bf6e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238889, "uuid": "2c57daf2-28e2-413a-9a38-ac8e8c2c7cae", "comment": "Malware payload (AgentTesla)", "value": "b23371f85c6b8b3b78c7eed0b32fd745a4600cc2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238889, "uuid": "1e3370dc-bd7c-48de-99cb-d6ef0645db62", "comment": "Malware payload (AgentTesla)", "value": "fb93cc12ab2a4585b644ca500f17f81ab33be4fa82dd1aa0fea18e97e24e4df0001516be772ac161c1fff25174dbf00f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238889, "uuid": "62a1d9dc-5d38-4bf7-aedf-332dee9df482", "value": "D225C09C3640B19FC827CE369EA85C60FA60B47B531BD307A59322AD9E4E59BCF150F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238889, "uuid": "412d2663-ebd2-4bbf-ad5e-039302a5438b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238889, "uuid": "1cb8dc6e-7861-4034-9315-fe17642ad156", "value": "24576:WlfrqkHpnA8S7Eg1vJLKWDFZiFKqwQqEd:KrlaV/1vxnDFZsKHQqEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620238889, "uuid": "79d209bf-5b52-4ed6-87e7-ad305d8df00e", "value": 982016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620238889, "uuid": "f4a85d26-6160-4c6d-ae4e-7a0ad49eb2d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238889, "uuid": "5a2254e5-413d-4a8e-b66d-95c029d64a6b", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68826d5a-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620212560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212560, "uuid": "f4dd8652-9b21-406a-86a9-fb66f8e3d238", "comment": "Malware payload (Dridex)", "value": "b1e0f7123ece0aeeab0c6e90b04dd2fa", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212560, "uuid": "fbeab64b-d6a3-46b8-9799-95135c40df13", "comment": "Malware payload (Dridex)", "value": "610d93e429f4f65077d3390d8e51d5d137f2092b093ea1f3ec74a9ccd0e21faf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212560, "uuid": "2b28b91d-2ac7-463e-83bf-ac036115f850", "comment": "Malware payload (Dridex)", "value": "3f7d8df7b724bfbb61a5bbaa87b1699308be21b2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212560, "uuid": "24555783-948d-4dad-969a-89ad28ebee5b", "comment": "Malware payload (Dridex)", "value": "5f74074bd212e609e05f6b5420664ce354a2632998f0a3df38aa447e795e66203f6da2892d76be2715aca892303a1d16", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212560, "uuid": "37f08d54-ecb0-429f-a294-9c52877413fd", "value": "59F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212560, "uuid": "266de1fe-0ce1-4d89-851b-52cb1fdd3537", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212560, "uuid": "5f0a76e1-adc6-4c28-815b-50d3a061ca18", "value": "3072:nWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:n42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212560, "uuid": "9182ab4f-1dd8-491f-ac45-f937a0be261c", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212560, "uuid": "f653e233-506e-46c5-9c5a-8321ef31f04a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212560, "uuid": "e8576bb5-7a3a-468e-a9f7-5df7cd353eeb", "value": "b1e0f712_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e78061d1-ad94-11eb-abe1-42010a9c0039", "comment": "Malware payload (STRRAT)", "timestamp": 1620214061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214061, "uuid": "a6ba2368-1307-4795-a6f4-ab08dc69b10a", "comment": "Malware payload (STRRAT)", "value": "963aadb080a728a4e063fe02a987e5e6", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214061, "uuid": "0a0b9726-32b8-45af-a3b2-c8107997f837", "comment": "Malware payload (STRRAT)", "value": "6118ade23797866d38b1981cc1b3601b85458ebe27523486d1fd994599ea9508", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214061, "uuid": "da5bad09-1ec3-4ef4-83ef-ff69abf4697d", "comment": "Malware payload (STRRAT)", "value": "067823949d75c32e5e97ffe8e5da88635e253454", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214061, "uuid": "99ab2453-d9fa-4fd0-8b16-8d187f3a38d0", "comment": "Malware payload (STRRAT)", "value": "8a21312fa5c0115017d549541d2936b5d0170f69a19dae70773fed9a0e217e0656c11de54bdb25e333910c8332287ab1", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214061, "uuid": "dd567bde-16d7-4e44-a93b-71f1fa80d4db", "value": "A9A3CF1AFDEBC1BAE40B80F213119237B5DC81D4E19E922B2AFD54870D75D694B129CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214061, "uuid": "a902a9da-a31f-4237-9d7b-8c47c207cb71", "value": "3072:jFw7tHNyeBZvxk8cNpWf7N9v+7w5oklv97jMt:jFw7tHHjtcNpe7NR+iv9st", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620214061, "uuid": "745afc46-ac6a-4696-b3cf-27a4f29f6437", "value": 104068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620214061, "uuid": "ff80d621-4db2-4ad5-99ca-e3c2c541fc6b", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214061, "uuid": "3648b4d6-6dcb-470e-abe3-88284477d6b8", "value": "RFQ 664120019.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de6a233d-ad47-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620180975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180975, "uuid": "2ac9bc35-1961-42d5-b0b4-6d1749e982aa", "comment": "Malware payload", "value": "39dfe89874120bdf56227afb8c881c45", "object_relation": "md5", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180975, "uuid": "d4ab98ea-5e87-4034-8e2c-dbf1a60c9f6f", "comment": "Malware payload", "value": "611afc357385174b0cb055e227730ed00d1826765c1b552c05f973e2852cdcea", "object_relation": "sha256", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180975, "uuid": "bea443db-92c9-4f2f-be47-81dce257e383", "comment": "Malware payload", "value": "e77b40544caaecc5ab70292195c08e27e88d5b25", "object_relation": "sha1", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180975, "uuid": "d6b3204d-8374-4069-adfd-d20976820db1", "comment": "Malware payload", "value": "24d3e55e5294ccf86e9749ff4dbb2644e87aca78498e9946d70f0818449749e827d66ab919e684ba64382d68ee2913ae", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620180975, "uuid": "04bfa706-c0e1-436f-8672-a2a6a1541773", "value": "64B3D188879AD8E7D5E27EF42807F46686A3CD6C10E3B9D525DBFE2C3431191089DB93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620180975, "uuid": "a2617542-0d4f-4f63-b470-5dd28fa6701c", "value": "5932b570a5feb5cbea054f78d4403601", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620180975, "uuid": "76d6c283-6d42-4348-a4cd-45bdf492a362", "value": "768:cM+multHxr1P5zdO80kW0R/I8V43Vh8ac5eyzdA8:cM+3ltHxr1P5zdOjApjVSyz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620180975, "uuid": "cdd40f32-fa82-4bec-82ee-cb4bf3d115e3", "value": 114176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620180975, "uuid": "b82b0ea5-a90b-4c1a-8d63-e872ffca9d0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620180975, "uuid": "abc8bf07-0c7d-4f3c-a6ca-f84523f870e9", "value": "611afc357385174b0cb055e227730ed00d1826765c1b552c05f973e2852cdcea.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71043aa3-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252517, "uuid": "841e0488-bfc9-4d6c-9ea3-48b603298866", "comment": "Malware payload", "value": "e8785ed9c2e5282c30b8722de6d481af", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252517, "uuid": "88078f30-b02e-40e5-81ec-93c51851c7cf", "comment": "Malware payload", "value": "611d768c5af493370a7c88ea53d1d2d10ebe453fae814e72a5147fda692680db", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252517, "uuid": "ae366c8a-972c-481d-9995-beec0286b51d", "comment": "Malware payload", "value": "c030bf79203e8859014f9fdd9d1bf6bc910eb97f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252517, "uuid": "8d56f53b-3f9d-4c19-ab60-8765cbd3bc97", "comment": "Malware payload", "value": "89f2f185ef0a101f5035a6264041a8dbd984c12337d7fd14427b1ad8182f7c71d80be150a6863889476d7ea7503f61c4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252517, "uuid": "81221aeb-36a3-40da-b0a3-a78001a233ae", "value": "5AF3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252517, "uuid": "4927ad3c-cb80-4a7f-b8da-b06809682086", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252517, "uuid": "c1b63ae4-2885-494f-8c79-12244bf96fb0", "value": "3072:4B45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:W4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252517, "uuid": "b194a2fd-e3d3-494e-8459-109a16d13c81", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252517, "uuid": "8fe62e55-4975-4eb5-905c-62ca69737db6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252517, "uuid": "2452f68a-df76-46c9-8669-2be573f97875", "value": "e8785ed9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc53c414-adaa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620223491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223491, "uuid": "17ec97d8-c7dc-413a-b62f-150656774792", "comment": "Malware payload (Dridex)", "value": "3db452342915b9a5603921535424e694", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223491, "uuid": "11cd5519-8908-429f-898a-869ccc73caa7", "comment": "Malware payload (Dridex)", "value": "6135ebb8fb31d7b19462d9d65c1e87b8b2de4e5dbf8711f8021685bf989dca02", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223491, "uuid": "d1752aa9-8d07-48d6-87ad-e0c4004778d1", "comment": "Malware payload (Dridex)", "value": "b6d96526b557e218c07241fb991993028e7eb292", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223491, "uuid": "b98770a4-b96f-41d1-bd93-c784ecd2cf3c", "comment": "Malware payload (Dridex)", "value": "c34d5147d34a1c79772d8764a48ed2db2316ef1fccfac4139732c5b657e6f085c8d15d706bae0478179d1d2ad80c648f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223491, "uuid": "219688fa-302e-4249-ae32-a18628abac04", "value": "38F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58FB4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223491, "uuid": "1abd0d7d-c77a-43d4-a16b-013007f7441e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223491, "uuid": "b266e4da-c156-4c6c-b4b8-f2a44515ef0d", "value": "3072:rIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620223491, "uuid": "6f1cdbaa-e527-4066-8473-57ca821780ce", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620223491, "uuid": "433b6c85-a75a-4d7d-9988-685632338caa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223491, "uuid": "cde153c3-1551-49c3-9e61-d99cbaae550f", "value": "3db45234_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef20d555-adce-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620238985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238985, "uuid": "77651198-d98a-494b-ae46-8650ac98d774", "comment": "Malware payload (AgentTesla)", "value": "d53a842ff2e75b4d2c46515c853d3f74", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238985, "uuid": "6b1c1404-0df4-4519-9069-971d55aaefa4", "comment": "Malware payload (AgentTesla)", "value": "61430ba679dea029ae4d4d726e3b894d254d3f54011f64993fe0de8bc9f71078", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238985, "uuid": "f5e7f89d-3eb5-43f0-963e-b4d3e8248614", "comment": "Malware payload (AgentTesla)", "value": "91274aa14beab0954da35bb4234aa943a8fdedb0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620238985, "uuid": "5c898714-9264-4f62-b9d5-4d7b763fcb56", "comment": "Malware payload (AgentTesla)", "value": "d54f8695e75b8bfaec554def2a30f7d2cfc3819f400e480e11c87aae990a9ca83db4b37fb510a7780656848e96de5267", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238985, "uuid": "85926119-d92e-4014-b097-80f3ebfaac42", "value": "DCE46CAC751469F0D35B5D62A3CF0C0683651274A93BE90A8F6013FE1A67F173E3998E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238985, "uuid": "397ebf93-4061-446e-8fce-c3adb8090735", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238985, "uuid": "93300ba2-256d-408b-875c-d2966e9e8bea", "value": "12288:lZNOYqoLLoS60/K7yh0w2uDJ6eHQ8NRcpSAH5fTb239FkyNNK/UO:nNOYqoLAw2uDJNwi1o5fTb8kyNF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620238985, "uuid": "12a3e962-3799-4ced-ab56-b5f118c314ff", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620238985, "uuid": "997a3eaa-e6a1-452d-b356-5355b3fdc468", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620238985, "uuid": "c0e1408f-61d7-48f6-824c-b49ebb757dfe", "value": "1STyZQU31dWqcMq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0694d1b5-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241601, "uuid": "e3f7340d-bd39-40f6-a5ef-72e288d4c8dc", "comment": "Malware payload (Dridex)", "value": "3067a09b310d52dcb92d9e65f6adc997", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241601, "uuid": "e533fa92-a2eb-48ad-bdcb-fce5304c1cff", "comment": "Malware payload (Dridex)", "value": "616d799d2adb6e5d329658080db6c2d61256a7959b8fce9d8274416dd5f4e6f8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241601, "uuid": "16047166-0451-48a7-85bc-1111d89f146f", "comment": "Malware payload (Dridex)", "value": "2432ed6254725720ba69cad1bf3d72d81eb02fac", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241601, "uuid": "498e8609-ca2e-47ce-8273-b9c253f0cce1", "comment": "Malware payload (Dridex)", "value": "72d14417b6f841997c5b50557af5fe672405498f35657367bf4109fd46854173dcb76fc918a88a4e96e2d24b55c63cd0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241601, "uuid": "74c477ef-96dc-40e8-b519-c8a9b721d105", "value": "93F3C085DBABE87FC45A35399071DFFB5B388B149240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241601, "uuid": "c6a83793-e109-46f8-8c9b-b9823dc7764f", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241601, "uuid": "ca35fe24-9a89-42fc-80c9-75c66a4ea1d9", "value": "3072:E945bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:m4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241601, "uuid": "d8f2afaa-0828-47ed-9cfc-27e021fadb76", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241601, "uuid": "bb3ed1e5-3148-4a20-83d9-22ab5ac3cbb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241601, "uuid": "cb4de3e2-1e40-44be-ab82-7c6201095b7d", "value": "3067a09b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cfbca7f-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208621, "uuid": "b9f9679a-c9d7-4d9b-a3a2-9d53babd897f", "comment": "Malware payload", "value": "7be6b5bc70337cae04de5a8ac9f8300e", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208621, "uuid": "52baeca0-d095-4dac-a1b6-93f4261cb454", "comment": "Malware payload", "value": "617ef3ca3826339bf272a27633ec66582ce185b292447f6e96fad7b2269c7c31", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208621, "uuid": "5133e15b-0a60-43fe-b0dc-a9c257fd460b", "comment": "Malware payload", "value": "191efd65a244df398c0e8744a4389ad8779d92d7", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208621, "uuid": "7115f57f-754e-4255-a19f-ac6de1ced0c8", "comment": "Malware payload", "value": "ab446694b83e32193be59ea8465d3b073f8469b1a6bf96209217d5d7a729c731c578f0d4dd2ef73e7b49d02c4289b821", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208621, "uuid": "653c240d-6ad2-4358-8f0e-1a025805f89d", "value": "DBE23996E842C8B2F96781F0656EEB20B7B3F0776019D827E3521838FC65A84D64739D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208621, "uuid": "4aca5ef9-989b-4090-aee3-8313d7c7f36d", "value": "768:vnGDwU8ihP1aCteH9Y2OQqgm8K3c0NfzYcFDBkbOHDA21Dbx:PGDwKhg4Y/aRsEflrQOHDpFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208621, "uuid": "fa131f35-9112-41c2-87e5-6658e967dd7a", "value": 33812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208621, "uuid": "33e0e232-b063-4150-b45b-91dfdf6dd49b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208621, "uuid": "86444b35-5668-424c-a3de-fc12145b291e", "value": "617ef3ca3826339bf272a27633ec66582ce185b292447f6e96fad7b2269c7c31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbcd5014-adaa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620223464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223464, "uuid": "8802c47d-e4d7-4090-9cfc-fd08ae40cf56", "comment": "Malware payload (Formbook)", "value": "d33fe8287df4e625a37dfa5d8729d8db", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223464, "uuid": "87657610-b0ea-4a87-a706-b09b5d2a1572", "comment": "Malware payload (Formbook)", "value": "619a462b761e8188e285d4122fe80ff0c3b2fca9cf491dcb5830a38f03d6610f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223464, "uuid": "702106fa-8659-43de-8a38-387e4d2ac798", "comment": "Malware payload (Formbook)", "value": "7d35ae1531f796784efd84ba29867a66fee518fe", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223464, "uuid": "e76ff168-7c14-44c1-8405-0ccc396dc94a", "comment": "Malware payload (Formbook)", "value": "a377f4acddc135f47026877ea2fafbc25119503ba0c85d95fc0ad5cd36d8fcbd3cf4460037410943770bfe248190e0ef", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223464, "uuid": "f439f5ad-292a-4883-8045-4c20919a6694", "value": "E4C42313FBB4A97E0DFCCDB08ED6C6F2C994834C2ABF65E51056B15E2B043A5EB10256", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223464, "uuid": "ecbfb1b0-39f9-40a3-b1e4-95266373bc4e", "value": "12288:zB41KLyIYby9Co9Np+LuRiLrmsE/7KKavq4IOpI88XsE:zBDLJd82NIL5Lr3E/7Ax45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620223464, "uuid": "9b18b589-2b97-4f47-aeea-547dd4d5de18", "value": 545375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620223464, "uuid": "b06c25aa-941b-4551-ad4d-ddf055e3520c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223464, "uuid": "8f328a4e-46fb-4be2-8a12-1ba888189dae", "value": "d33fe828_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aee2c2b1-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208812, "uuid": "3c81f7e4-84ce-4245-8c99-2009e4d525aa", "comment": "Malware payload", "value": "fb0ce90e561b65ad11494760a572a59a", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208812, "uuid": "3d3a9ea3-bd38-488a-98ad-2c4dcf827eab", "comment": "Malware payload", "value": "61ac13407b4d454a29027909a6f1bf1a75aa8a468aad58967204b392f63f48bc", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208812, "uuid": "8153607f-bce4-4fd3-ab24-8eef74505bc2", "comment": "Malware payload", "value": "1ac2d79601181d10bdb3eedded41d8a0d8e4694c", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208812, "uuid": "5252a2e8-80eb-47ff-960a-c62db4eaae62", "comment": "Malware payload", "value": "9338f973832af336eacb32bbbb4567626e37bd66c30c80e749cb0bcae0fd0b2076d9c3dd71cb0fb5c2936478ee695310", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208812, "uuid": "af9bca1d-8f9e-412b-b2bd-3224fbd6e82a", "value": "51A1E850112C1AB17246597AD26FFA52B50EC81B0A777B358473A63C74F5DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208812, "uuid": "2f1c3558-2b37-4ed8-9d28-1565cf27be87", "value": "96:TRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:TRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208812, "uuid": "b434549a-411f-4c1c-88de-c5f0190dee39", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208812, "uuid": "ffb9577d-a463-4da7-ad78-3ffc5123da20", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208812, "uuid": "4e4e8f2c-e0f2-43ee-aaa3-a632c6778481", "value": "61ac13407b4d454a29027909a6f1bf1a75aa8a468aad58967204b392f63f48bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1d811ca-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252706, "uuid": "380b4b8c-fd54-41b0-a65f-fed3d4850867", "comment": "Malware payload", "value": "a7471569cf29b34799f1745d05a56a67", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252706, "uuid": "d9e74746-6ce4-4411-b0fb-71605842e7b7", "comment": "Malware payload", "value": "61c84fcadbe1391db02f50adbb6ae8b63c2e236ba4eb37ed982275d71ab28fd8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252706, "uuid": "c861be3d-e357-4636-ad30-38cbb07cbfb3", "comment": "Malware payload", "value": "15296a4a0488a470b6d3b89abf47f9d694410a92", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252706, "uuid": "ba3855a9-97dd-48e9-a614-cdcb0ccd8467", "comment": "Malware payload", "value": "c1536bc8e84a28fdfd15c0d1292e28e14b565ff80aab98f14c0bb7ce594620ee871eadbda3dfd274b64927d1363fcf8c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252706, "uuid": "f32f2ea9-0096-44da-84f7-ed84008b4cc9", "value": "81F3C085DBABE87FC44A35399472DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252706, "uuid": "fc4a0507-c317-4217-ae08-aa9b79058eb7", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252706, "uuid": "d81df9dc-6d0f-42fa-9550-cf87d24cd21d", "value": "3072:LL45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:v4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252706, "uuid": "4cc0e1b4-9f07-4705-8112-7fba4ae86b13", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252706, "uuid": "55647afc-86a0-437e-8b81-dd3a62be7f99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252706, "uuid": "d25848d9-6284-4b42-849f-949660c1a70d", "value": "a7471569_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a73eea90-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload (Downloader.Upatre)", "timestamp": 1620209229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209229, "uuid": "d06195ef-9894-4239-a48c-d0ebcf6f5dbd", "comment": "Malware payload (Downloader.Upatre)", "value": "d138ae3246c968e269279336cbd51a59", "object_relation": "md5", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209229, "uuid": "ed7b68ab-cf99-474b-be98-3e937beaebd8", "comment": "Malware payload (Downloader.Upatre)", "value": "624fcc1f265d0fcd675e4c6e43cf430e0d4c6831f4d99027fdb9fe59cacdbfed", "object_relation": "sha256", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209229, "uuid": "7aa01637-b46d-423e-8cc6-61809c3baf9e", "comment": "Malware payload (Downloader.Upatre)", "value": "2ef63b3859ca1773ebbafce625f30b4cb6db3ada", "object_relation": "sha1", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209229, "uuid": "a7f21cb8-f9de-4da0-b100-2ea875dfcc9f", "comment": "Malware payload (Downloader.Upatre)", "value": "f48e559c335c83125f09f7f33f25b071c84dbb990f3708ab9ac4e88ae8c2d040693c111cf7713e0ae7c1c391dc8c2112", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209229, "uuid": "de138e25-d6d1-44d5-9828-2ff0163854ce", "value": "2C23B53A7BC445F0C62A84F799F7F6415566BEB312D78E9C5C89BAC80032E806D22C1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209229, "uuid": "655db376-55fb-4b09-b041-8916df95182c", "value": "4151cd924e8ed7250ac0806a96812f54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209229, "uuid": "2a5038ce-2415-47c5-aae0-86454caeba3b", "value": "192:GfI6ftyhXGpmyKZZ2chBA9zy1GFqrvsqDsTDJRbQjE2fC3Po5+IIZPwNKm/8FKUC:Tsy07Tchqyc6VEKDh5LqmHk4UC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209229, "uuid": "b2784071-176f-4947-8a28-994e76ca7871", "value": 47364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209229, "uuid": "ef9fec72-4009-48dc-af9f-eeecc8e73b4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209229, "uuid": "4f8ac063-cb44-4ad9-8fec-8bd74e8832d7", "value": "d138ae32_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe67aca-ad80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205432, "uuid": "42cf08c8-b56d-41f5-ade0-ef83513925e0", "comment": "Malware payload", "value": "3fb28b39d5df7e3e10865278c2865567", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205432, "uuid": "0a7f5719-288b-4857-ab25-4a078369c331", "comment": "Malware payload", "value": "6279abde41ce2445065fd31b0762774da7a532e622d4e144ff47a5b4eda34fc4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205432, "uuid": "6e5e33df-9019-458b-a7bf-cf93260babf8", "comment": "Malware payload", "value": "3cc5eb50dc9f7cadb758db7df032ff4d4f9da5d0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205432, "uuid": "b5440285-1e5f-4783-aa18-d5fd33b2f08d", "comment": "Malware payload", "value": "158d8d60b5abfdbd8a317c37537b85a48fdf4e98084c8ac9ed7a51b8e1d549d196242c3f9fcdbbac14bd61ff15f307e8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205432, "uuid": "c88cd58d-f50c-46df-b18a-a1db00d60ae6", "value": "9DD4E0B2F111218FF39E9EF2EACE7247D69AAC791353629B9C1C5C20770B60E41859CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205432, "uuid": "d52dd15d-fea5-44d1-91a9-d96d8261157a", "value": "395b650a668f1495d5b0f616749e5d7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205432, "uuid": "cc8642dc-cae3-47a6-aefa-3619fcaad35c", "value": "12288:ixPXBlSm9JxUs0LoymXypIMJkVk0pMiY2zCGUUfRF51:SCAJxUZLoyAy6iwQ2zCGUUJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205432, "uuid": "e1cabe58-23b7-4c77-9b89-5d049887c4e1", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205432, "uuid": "b1d2517f-3817-4263-b13b-1ab8b29711ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205432, "uuid": "bdb9c90f-f12a-4eb7-bb01-06792eaad5ec", "value": "3fb28b39_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a69dd72-adb6-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620228400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228400, "uuid": "e2d81784-22f0-471b-91f9-2ede7699589b", "comment": "Malware payload (AgentTesla)", "value": "5cf808a93aefa3f38c9fbb3b304e15bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228400, "uuid": "46107768-12b8-4f65-bcf2-40037cb58b9b", "comment": "Malware payload (AgentTesla)", "value": "62a683343429ed214262e3462e897e21e3d74843687cdf559f8b464f13d7d119", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228400, "uuid": "9bf28c06-c61e-433b-8020-4095f0830d67", "comment": "Malware payload (AgentTesla)", "value": "efe1804fd125d22b6df3a8ed3f4645e6c18cc78b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228400, "uuid": "b479a129-a73f-47d1-8e71-e2b646101d3b", "comment": "Malware payload (AgentTesla)", "value": "0cfa8252ca5d827e4e737ad5853a7400745faac881a6b6027b8e525613059c9a53c1e36387282aa7634b17f9932d2e60", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228400, "uuid": "8a4265ab-c915-450c-ad09-196e87209d5f", "value": "BB05127827855655CD2F0B3C2978D0412BF4BA2FD6A3E70EBFD025BB0B736524631AA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228400, "uuid": "805261da-6531-469b-a192-cea5bce1bfe5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228400, "uuid": "076d6670-fd08-4c7e-a68a-4c7ff845f1ac", "value": "12288:OmtkfK3R6QhFozxuJ3WBQdzac1zjWMn8vPMCXPYX35XjrJr7JNC/Fz4kvxMnM:vyx+mBQP1fr8sCAhBr7Jw/FU4+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620228400, "uuid": "227758b1-fcb9-43d2-afea-f4ea682ddd2b", "value": 799744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620228400, "uuid": "1a07ffbc-1dea-4569-9d6c-1436973d9e68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228400, "uuid": "f4e1a671-4689-4e28-8788-c4d5dd83c523", "value": "Payment_ Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f653f52d-ad9d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620217951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217951, "uuid": "26c6d320-31fd-42af-a3b0-894a68ffcc30", "comment": "Malware payload (Formbook)", "value": "d4e8a046510a7bc5b0773bca157df201", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217951, "uuid": "f2206592-96f9-4d84-a7bb-1510058f0148", "comment": "Malware payload (Formbook)", "value": "62d55d20a1df423315c5d295e105983a484c691490acb709b9579aa246eadd52", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217951, "uuid": "5eecd1be-4f71-41bd-a368-4fd6ebd78a5c", "comment": "Malware payload (Formbook)", "value": "f2ffb84c5c95cd2c9d8ed5f059a6eef4cb67a321", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217951, "uuid": "ec61ffdd-62b9-457e-bcc6-01b9debae11e", "comment": "Malware payload (Formbook)", "value": "8dc1360a19e87913d8ace87468292529d79978d8e34a3c0639c5e2ea673256fd73283d55b226b3a68612bf5a6ad0cc8a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217951, "uuid": "4c1e6c1c-c608-4d3c-b50d-e383464c903d", "value": "92F4230108CEAD53758DDBBABCB4D03DF921C5ACD868A88B00FDA5656B435C35CEDA93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217951, "uuid": "44e67e65-0471-49df-90b9-be6603acee99", "value": "12288:Exioz/x0hou18BYza30k0TuYPLo/n+g1mtPoxf9OdUQOd9RdrEdnrcL:EzlTWza3D0T3Y+SWg9OW9PrWr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620217951, "uuid": "921763ab-8168-4d5b-83b9-a8b32ae01179", "value": 735260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620217951, "uuid": "a0c355d4-66ac-4ca9-879c-8a8a4464b987", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217951, "uuid": "f318a8ce-a4e3-498e-b70c-0eff67dba8c9", "value": "Purchase Order-070POR044127.r11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50d157c4-ad95-11eb-abe1-42010a9c0039", "comment": "Malware payload (OskiStealer)", "timestamp": 1620214238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214238, "uuid": "55ea6d82-8285-415d-b4ce-281650cb250d", "comment": "Malware payload (OskiStealer)", "value": "93d1db10e708c676866a7cd1dba55b68", "object_relation": "md5", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214238, "uuid": "7f602b95-7a4e-48e3-be07-4a6d3a95dbac", "comment": "Malware payload (OskiStealer)", "value": "62ff4acb82aa8f8e187d10029882cc2864f7a091bf1ff0a4ee1475119ba6ad9d", "object_relation": "sha256", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214238, "uuid": "046afee2-1370-4a5a-8a33-7ccc544fa5df", "comment": "Malware payload (OskiStealer)", "value": "eeb55b51a51ba0e0325397eeae08b332b5724b45", "object_relation": "sha1", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214238, "uuid": "6f9af3c7-82d4-46b5-b88c-e56dd46c8f81", "comment": "Malware payload (OskiStealer)", "value": "848405d2b65601ff7edb2b6805c5cf431b6e912b01377370035e052901335b5e86507792fe070d66d380633fe4868588", "object_relation": "sha3-384", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214238, "uuid": "40aa9e95-3be9-42ba-b548-303295c59bbb", "value": "DF15DF3272A467D5D23CA7389D21D17053E33E66E201EA6FB9E4BCCF35753A20876912", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214238, "uuid": "9e908022-7cae-4607-9f7f-fb3aa4b3102b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214238, "uuid": "72f743fc-f275-47fb-b7b8-3e5358e788dd", "value": "24576:Bb69vowwoXYXB8VzVfLRlahu3EHYjA8++++4+++++++0+++++++i:ByowwoiB89BbQu0H4h++++4+++++++0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620214238, "uuid": "4b93aac0-892c-4bf8-831f-60b3ed956db3", "value": 889860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620214238, "uuid": "16a597e6-5fb4-4415-a38f-571bf7e94b74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214238, "uuid": "9be0eff5-35b0-4293-a033-976b36d5fe8d", "value": "h7tfR29LuPk1YuPJO199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afbfaaa9-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208814, "uuid": "7977b46b-bd8c-416b-90a6-67fffbc7f0f0", "comment": "Malware payload", "value": "04fa3c808a642761206e3930650950de", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208814, "uuid": "755894b0-8389-4227-8298-455497878711", "comment": "Malware payload", "value": "6300f7def3f49c36d0d6bb2bad5b0d3d32e8f33d5a5c6b60f0c8866f929c91fc", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208814, "uuid": "fb292e74-d40e-4740-82b7-bbbb722d43b3", "comment": "Malware payload", "value": "7c455812a3eae12a20c33382c48c4fd5bf2123aa", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208814, "uuid": "1afd018c-4f5d-462d-b71f-8f4d4c7ccdfb", "comment": "Malware payload", "value": "951e972b92c4c4fe3f1bd711b12954983a316cd2b4bda7627c0d96b485c2299d0546dfdebe0c7a069969a97dcf5de482", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208814, "uuid": "2c91bf7a-47da-41cd-af8d-8f3011f6dd53", "value": "C9A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208814, "uuid": "c55d735a-8f01-4d76-b43b-9dbf4484b456", "value": "96:3RYZxQOBpLyxIcymLKY8M991wuIaQPYPW:3RJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208814, "uuid": "d40d9b6b-351d-447b-a918-e4a15c92f395", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208814, "uuid": "eac22c19-8824-445a-9f65-1d7e3d75839e", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208814, "uuid": "6c3f5de2-1ba1-42ff-ba9b-b170c88bd8cb", "value": "6300f7def3f49c36d0d6bb2bad5b0d3d32e8f33d5a5c6b60f0c8866f929c91fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fdb86e2-adb6-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620228463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228463, "uuid": "eebc1b77-b52c-4d1e-a471-19c2ce5e8ca9", "comment": "Malware payload (AgentTesla)", "value": "700f9ccbb505a24ee0913d548534dc35", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228463, "uuid": "cf618b41-a05b-4a68-a99d-2e00a13da8f8", "comment": "Malware payload (AgentTesla)", "value": "6314e23cf0c6ba09f3d8fc6b7dd093d8ba1b27ad0589327fb181b907dcc4b9b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228463, "uuid": "b00d7709-41dc-49cf-83f7-266c830d8126", "comment": "Malware payload (AgentTesla)", "value": "824bb9b3e12419048caa1479e08925335780d4d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228463, "uuid": "53340cb2-03b5-455b-9673-0d7d2e2f75b1", "comment": "Malware payload (AgentTesla)", "value": "32221ff93cd08a31435a9d35e6946a622aa54e855f727d044d6d4e30df03e8498708e966ae0738196472ce438193d91e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228463, "uuid": "1be89127-f609-4772-be61-0f5f237fe9b8", "value": "8505123C27444A52D93F5BBC2879D0001BF4BA2A9663E71E7FC025BB6FB77505322662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228463, "uuid": "182c81fe-2a13-4dd1-825e-16fb03e675f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228463, "uuid": "d1712dee-2f0e-4a15-b81f-263595def9ec", "value": "12288:emtkfz3QDMjMeJkBxu2DuqahVvYxhJaLii4XfGNCj8px3Oumjd5Qh8cOrJ8JW6w:DDMnERVaLAh9OWax3Ou65QecOrJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620228463, "uuid": "99fb1552-554d-4427-99df-fcb3c6b130c3", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620228463, "uuid": "1def8996-cbfd-40b4-9743-dc9e037e63ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228463, "uuid": "f6422eab-6b9a-41bc-9376-2edc1bd6754a", "value": "PAGO FACTURA 3802.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82f36e5c-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212604, "uuid": "807502e3-d9ab-46d8-a7f4-0980512dfca4", "comment": "Malware payload", "value": "43a6b263d0618add17a610ae72c61b73", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212604, "uuid": "42d15511-f5df-4f20-b161-8e3210d4bdd7", "comment": "Malware payload", "value": "6316b87f6532471323dd0d2148f89cc2acc76b80855c27afc97562848b111eca", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212604, "uuid": "dc2894df-8fad-4143-ad75-2e14dc5b525a", "comment": "Malware payload", "value": "b2bf045fc93d507e25d6d719e8abf4c91d3cef73", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212604, "uuid": "9acf9dc3-2c93-499d-87d2-04d081f859bd", "comment": "Malware payload", "value": "cfedeb4b5440c9cf2b959da065aae3add7053eee3383450c0600981d34f8e705fc066ccec1a96096be6d05db53a9628f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212604, "uuid": "eadbc567-7667-4d81-ab9e-0465c52285be", "value": "77D4690BEB9670E0DDD752BA4664432194F8C2D0537A87CF19758A77A94F0FAB6223C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212604, "uuid": "f09ba656-7cd2-439c-bc87-5d7306fbc25b", "value": "e3cc9000ce0a468dc576796f3e19f24a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212604, "uuid": "da1bb26c-5bc8-46d5-98c7-b8854750bf37", "value": "12288:P0sG9CoADwLTgytOi+GM7jYc/hkKmfPMYtZ7s/sFFluaTTm:ssGUoAdyt6ccQMYtZA/AFpTTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212604, "uuid": "418b88bd-8fb7-476f-ba32-b85a0170f0b8", "value": 637440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212604, "uuid": "a22be975-0ab8-45e6-8c3b-299e5dc3f91d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212604, "uuid": "4c316ddd-9884-4292-aacc-f3ca144fa06d", "value": "43a6b263_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01812d1a-ad81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205515, "uuid": "3d2b45a6-cf1a-4871-a25c-c96b3326a527", "comment": "Malware payload", "value": "ee72fafa025edec01652d81b87a4fd53", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205515, "uuid": "b18d4ab4-771f-401f-99ff-4bb57ba4202a", "comment": "Malware payload", "value": "632c52592db110ee4331df029901c565d3ba574ac46506c0f0435acf47d0d758", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205515, "uuid": "56e7e621-6263-4b70-9213-44b43294096a", "comment": "Malware payload", "value": "e2cb28fb0b8d4aa7a21c832e50845bd8f4c9bd7c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205515, "uuid": "b82fca3c-81ee-4ad7-aa4d-fa9bde928520", "comment": "Malware payload", "value": "157eb10f5f476ac101751dfb09046efb651961571a679146638cca32f222254952a116dfd16f64866feb1ac29d493f4e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205515, "uuid": "432eecc4-cac8-44a9-bee5-c5b8f47c926e", "value": "AAE4E009DFB697ACD06CDD3C8786C051A5CE887EF099860124E8EAF1D9E11CE5F907AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205515, "uuid": "13427566-d76f-4eb0-8e9e-e6a3c2fefc95", "value": "8a1bd2011e4d5078b5f3bf7a216d4f3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205515, "uuid": "4a8fee17-b43b-4810-8c6b-d4414d6b9523", "value": "12288:xOjiaohYI87ItLfBEWS9Bd0VOtf3+kb/d9/mx8MhBeakXl0xBAQqk8v0n:xOj4iINudbd003b7/mx8MKakeY3z0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205515, "uuid": "302c9445-4d66-411f-aede-6a546daa24ad", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205515, "uuid": "c1688796-54bf-41a5-b997-e8ec49a2c7c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205515, "uuid": "22b8f251-f539-474e-89e0-93dd1cb097db", "value": "ee72fafa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf686b1b-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209269, "uuid": "81e26e0e-1833-4b2b-ae9e-4f4fa817e857", "comment": "Malware payload", "value": "ab3cb3e8bef2b670f30ee4ede8eb723a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209269, "uuid": "7eb18e8e-c0b8-40cf-a75d-056e7057654a", "comment": "Malware payload", "value": "634aa6a7c5713be4207cdc35027e81d68d6b9c959f8be545fb8a483c42479dd2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209269, "uuid": "a4912844-1451-408b-9c0f-ea7357194c60", "comment": "Malware payload", "value": "06ce21a3672d5e777a54db783e7127383e41fae1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209269, "uuid": "ba3e3055-7cf8-43e7-9705-55fb42c076fa", "comment": "Malware payload", "value": "3669ccb97782864aad2109acce4ce604ded3048a0974a9c80f5f065817fba38bab28923f1f8c5bf7e5cb569a5783f732", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209269, "uuid": "eb981a9f-2aa5-40b1-8d5c-4e3b3a4335eb", "value": "92E4E0B4F51F10C1D430003DD76526193FB4299605A9CD3B679ABEB0A8E3E6C19ABCBD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209269, "uuid": "6e6d9333-a8b8-47ab-9177-ef69b34a11e9", "value": "6249a91ea77c7492792792dde907e4cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209269, "uuid": "b79cf71b-f3df-4abd-bb5e-d85e3df0e755", "value": "12288:5/oiu7uGrurEknN44gd5w+4cD//aD1J+gAquSHUDGXa:5e7uNdgd5w+TDXaD1J+QOGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209269, "uuid": "d4b44dae-71d4-440f-92a5-34cd520ec7c9", "value": 668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209269, "uuid": "46a78132-ceaf-4f77-b242-e5c4dc962936", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209269, "uuid": "e2fbafa3-0264-4fc6-9b43-5b5cd5e5997b", "value": "ab3cb3e8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d913d3-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241630, "uuid": "446d7805-e76a-4fd1-8cf4-aa0ba1b7ac88", "comment": "Malware payload", "value": "77d0870b0802528b7e70291f3f71eb86", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241630, "uuid": "20ab6ab1-09ec-4ecd-b9ee-b4c1447ec902", "comment": "Malware payload", "value": "634d5436c366be5ff9e307c39f6d73b2ac0427fc7d564e6ad5125cb1c88a18f9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241630, "uuid": "2b42ef90-e336-45fd-8643-4ba58970e863", "comment": "Malware payload", "value": "a060cf4bb6a4e1c68070b125fee3c3cc61887e60", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241630, "uuid": "078e4e43-26a3-4426-968d-28e4abd83167", "comment": "Malware payload", "value": "eab548578f99c5cd3c94fe61dae9721ad6dcb396ea0fd0412b1301d9f82d13e25996af34d0bb75d5379448b903afa85e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241630, "uuid": "d33395d0-96a6-4bb5-85f7-ca7ad3a05d6a", "value": "31F3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241630, "uuid": "3b70c487-f4cc-4499-a1da-9fccbc72be11", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241630, "uuid": "f570874d-797d-4915-89a7-cd8ad7d81db5", "value": "3072:9w45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:+4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241630, "uuid": "504edafe-a144-4955-b96a-c8bad422ec9e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241630, "uuid": "c1ef1e0e-5ad9-42cb-b1e7-79e3c37970d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241630, "uuid": "7c2e75bd-6028-4772-8111-6b5029e11ec7", "value": "77d0870b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163f11a2-adcc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620237762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237762, "uuid": "aad96563-00c0-49df-931c-06d11fcad143", "comment": "Malware payload (Dridex)", "value": "9eac9b7616a9c5d6d214fec9c7858fcf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237762, "uuid": "b71fd599-0d2b-417b-97df-df3be89fb7e9", "comment": "Malware payload (Dridex)", "value": "6357ba409e79d5c044fae4210f6ac0ef3958a7d2fe13a308c3ba7fe9137a2bab", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237762, "uuid": "d5af3233-ef3c-4baf-ad25-db1fcb4888be", "comment": "Malware payload (Dridex)", "value": "517c590059c0de6738582e6f829717c3e6461ab4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237762, "uuid": "462195b0-b3e9-44da-aeeb-22b8261b57d9", "comment": "Malware payload (Dridex)", "value": "a875eef57165ec9c7d3bc24f4086eae55954a2e5ca6164f62e1254a2a499ef6aea76e1a668f99e54a986aa324a8497a8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237762, "uuid": "1efc3d04-6863-4c92-aaf8-d27995d6973d", "value": "C3F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237762, "uuid": "bd3ff875-22eb-4048-9694-f4dc2a6698cd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237762, "uuid": "811c8f8c-5e03-4a92-83e2-709cb268e481", "value": "3072:OIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Xc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620237762, "uuid": "533ea0b1-97b2-4c7b-aeaf-a049e611ff2c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620237762, "uuid": "f1d34ad8-a0a6-4291-9c7c-1dfd71faac85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237762, "uuid": "38c397b7-f41d-4f9f-9805-e8f7d4174d42", "value": "9eac9b76_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b13afe9d-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252195, "uuid": "0ffeb048-8cea-496d-b398-00af0b9aae82", "comment": "Malware payload", "value": "19510927c4679744a38afe725bbff29f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252195, "uuid": "692c8f58-0695-4631-a2fa-4dc7075a9131", "comment": "Malware payload", "value": "635bda46af22563c2c46cbd6d4768f6544758876e8e8fdf859f73730dd7a4112", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252195, "uuid": "0de02070-5eac-44e2-9cbb-8d39172050a7", "comment": "Malware payload", "value": "5393d0eede3d242f08185f428e3713be8c870d01", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252195, "uuid": "4c32879c-5350-45c9-89e3-1145f4ae0dd7", "comment": "Malware payload", "value": "252eb6396a2b6cbc59c99278bcc5d69631246e4b497a2f1635b747172358408f6602a075ecbdd83e46ea21293ee113f2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252195, "uuid": "2cdd624c-d2af-4999-85bf-c4792b9140db", "value": "22F3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252195, "uuid": "f3851318-8785-45cb-9e76-f0296d50b5da", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252195, "uuid": "d88fa64c-ebac-452f-ae82-7a11e5f21904", "value": "3072:zv4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:EDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252195, "uuid": "46a881d3-d2c2-4206-8190-c6252031ed94", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252195, "uuid": "e7039514-467a-4ccf-ba02-ce9aab2eb8d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252195, "uuid": "71f035d7-130a-4d21-a55e-54c647423ae2", "value": "19510927_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54aeb34f-ad7f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620204795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620204795, "uuid": "4792c688-4819-4cf1-b973-623625dd60cb", "comment": "Malware payload (AgentTesla)", "value": "640a998c05a633aa0cd5f3802f7e3bc6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620204795, "uuid": "901fd030-f293-4bdf-a91e-3a37ecb4c788", "comment": "Malware payload (AgentTesla)", "value": "6365defc7e122656c0791f79fe3ae48a59c7d403f1a99fa1b7d5118cadd6b1fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620204795, "uuid": "6f048f78-381e-462c-b7db-2fe5fbc4d437", "comment": "Malware payload (AgentTesla)", "value": "4f352189518c3d25b0ba6971b7ecf1531cc7eba4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620204795, "uuid": "6c7b78d1-3d2c-4284-9a27-072bf3ba7403", "comment": "Malware payload (AgentTesla)", "value": "e912a5220f1ef1cb1291e5c705938e1a049b4e07289df8be77e6f25dcdf87ebd4bf181c6e72b9245edc1ca0086b53a0a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620204795, "uuid": "c590de35-f993-4e31-855f-e4d4e1ab2d17", "value": "6615022323985752E93DA77B58A5415103F5BC02FB21CB0B7DE871DB6972AC80366FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620204795, "uuid": "86b80b0f-83f7-40cd-9d8e-12df5bd8a961", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620204795, "uuid": "243908d2-4f69-41b3-b7e1-12e6ba58d9e6", "value": "24576:ajV1ZqoUYk7MiAgSpCVS1xSmMW39dTjU:GrZqBYkIiAFpCVzWfw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620204795, "uuid": "c3f3052c-77b8-4c48-9545-003d4826cbb7", "value": 879104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620204795, "uuid": "4f7afac7-b3d1-408f-818b-4c8b7b4bb590", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620204795, "uuid": "27fe4b7b-74bb-4af1-933a-fe1497fc270b", "value": "Img 333038763863330039001981.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e201537d-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620202026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202026, "uuid": "15ea9def-aeaa-4676-b350-36f4811ea540", "comment": "Malware payload", "value": "e6888df316a46a17f0f01a5f383ecfa1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202026, "uuid": "765adcdb-a501-4c10-80df-833e15d786b2", "comment": "Malware payload", "value": "6376146377fe78ed0748227260aee112e8e828882567aec364bd7df00319c574", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202026, "uuid": "1f944915-68e2-46d2-920c-7cf96c1749f3", "comment": "Malware payload", "value": "662d4b326bdd4b12fad6d841aa3c281af72b3745", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202026, "uuid": "bd572988-3def-46fe-8ef9-4ac2d25cf0b0", "comment": "Malware payload", "value": "6935bb4e1bd1a626ad19facef1786816d5c008154645748cb1a7ca8b6e2c0511f713a31d3d6dbf0c0ec0f3a8f9a63146", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202026, "uuid": "23ef0fe9-2965-453d-b949-2d940222b280", "value": "C7C50161F5848437E8665C711A2D5F29C8AA6C60077EA1CBF3DCC13D98E5AD0F632E36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202026, "uuid": "e4d26a44-b82c-4fc0-a76b-263587e5df7b", "value": "36a4c2b71799b389941440b23cc06409", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202026, "uuid": "fd60d6d7-a42d-4353-bf2a-eda575bbfde5", "value": "24576:F10bnaaH9zhLBisMmy/B1Ktv+mZ/5I6qOVtFZJRw3WkHgMvrDOzN+6Olh:gbnaa/tisMB/B1g/5I6V6bHgIHOzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620202026, "uuid": "a2c565fe-0fc3-4dd6-95dc-bd3a2dcc2c06", "value": 2613760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620202026, "uuid": "d96af330-f144-4f03-a886-bf86a4aa63ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202026, "uuid": "fbba417f-d4e2-4230-956b-37fee0b598a3", "value": "e6888df3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34271b29-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241677, "uuid": "9c7a030b-5b9a-463c-9875-5e9a542a9281", "comment": "Malware payload", "value": "f9a0e623a3b7087ff54e57e76aa1a2fa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241677, "uuid": "fe893d3a-9e10-4f07-abfe-a6bad1ed1190", "comment": "Malware payload", "value": "63782e334da3ddd05a802517cb16627f2d76f2f2b88dd3115edb6f66e1a744f9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241677, "uuid": "4780f031-fe1c-44ec-8530-c4116f7cf670", "comment": "Malware payload", "value": "c9e676f1ce67129dacfc305720fa6f3eb948d94b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241677, "uuid": "0d63e718-e543-44c2-afe1-70d8f45770e4", "comment": "Malware payload", "value": "8b98b9f444a3030c414ba6cedb7025a4b1bd3ca430de35e052fd656a50325f67a603af936c5f0483cd12477807800f44", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241677, "uuid": "621f5cd0-6ba8-474e-825a-36419f3524d7", "value": "C8F3C085DBABE8BFC45A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241677, "uuid": "4a7c7cc7-bb30-4bad-9eb3-8e5079102ca6", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241677, "uuid": "83178e19-a603-4f98-9659-6f4fa236fbd9", "value": "3072:pS45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:o4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241677, "uuid": "40cf66de-c003-4e3a-ae54-12e8ae83337d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241677, "uuid": "d47dc15c-9484-45d1-9aaf-c4e10a6d615f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241677, "uuid": "c2fce000-6fed-46b2-836f-72a1b448b998", "value": "f9a0e623_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4125be1-ad47-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620180984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180984, "uuid": "47a95635-499b-4857-b2fd-4590cc9bb848", "comment": "Malware payload", "value": "2801ed4cd323e8af429ffb31395729e2", "object_relation": "md5", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180984, "uuid": "e3abd805-1a3d-4041-8916-33aa4d358334", "comment": "Malware payload", "value": "638c14f53ca39c9572bee12adc1c11194b84e6abaa08b0ff30977aa56ec9ba6b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180984, "uuid": "44f758e2-48cd-4b03-aeeb-421417a649b9", "comment": "Malware payload", "value": "e452f7f5190d0f23f2df039d4dd5424dc7dd6722", "object_relation": "sha1", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180984, "uuid": "077e1ca3-11ce-49bf-bc1f-e31f6a2527e2", "comment": "Malware payload", "value": "e644aecbfbacf233f28723fc71cdd0f3e7a7c9ff37f2489549e1782b0451c98adeb5438e3ec3a753d11ae7e5d4a7809c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620180984, "uuid": "f6b6483d-821a-485e-ac4e-bce3d81b00f3", "value": "DDE3BD8C8386D8A6D4E3BEF11907B16A864BDD6D10E3E8E576DBFD2C3070692048DB57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620180984, "uuid": "53020d40-4f71-4f6b-a4af-c8b61d0b6b97", "value": "84245f630674d6573306664292458cd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620180984, "uuid": "6ce4e09b-ceac-408e-b1c5-152b5586db1f", "value": "1536:H3icGgKEuISZ+SsxcWRMyEWr4SW55M+3ltHxr1P5zdOjApjVK9eP:5SCcWRMyEWr4SWLM+Ckpj89e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620180984, "uuid": "00cda20f-8bcd-4477-877c-066a220bf788", "value": 155136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620180984, "uuid": "b51e3209-c0eb-4f9c-9092-0a40f9b995ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620180984, "uuid": "620f82df-5072-44d6-bb33-ce38a1859564", "value": "638c14f53ca39c9572bee12adc1c11194b84e6abaa08b0ff30977aa56ec9ba6b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c073d7-adf6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255802, "uuid": "948ef711-4e57-4b5e-b69b-650f77ada66d", "comment": "Malware payload", "value": "b00567f60f50552e0495bad9ea3b54f5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255802, "uuid": "94b8bd7c-fc4d-4113-8748-a23e968b110a", "comment": "Malware payload", "value": "63aeacb804d5cc11609434c424dfcde03f825512da9838fb9c259690b8d7242b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255802, "uuid": "7fc4bd87-01e4-4869-8e2a-b0e12df8fbd4", "comment": "Malware payload", "value": "8daeca69993db6ed7c78c320e95488b8ccbda1d4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255802, "uuid": "ed3a3037-4bff-4073-a653-1157e15398f7", "comment": "Malware payload", "value": "36cf252b7c862402a317f1f854803de66b8251d715a4f19161f21becd71d641712d381158d26d5dd9aecc9d534f2c8d7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255802, "uuid": "827de41c-eba8-468b-8e08-3827b79d7fd6", "value": "BBF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255802, "uuid": "2e5cde0f-548f-41f4-8731-f6a641019547", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255802, "uuid": "b53dda9d-b1fc-499c-bf82-3a50394a37ae", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255802, "uuid": "3ee6fc33-64b8-4107-bcfa-48567f1ba757", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255802, "uuid": "5d3b54cf-227f-4fc6-9593-9568106d89bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255802, "uuid": "22821373-8373-4691-a630-1926d15c3dd9", "value": "b00567f6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c495e748-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201977, "uuid": "e1dda656-f60f-41cb-861d-f48fd76a131a", "comment": "Malware payload", "value": "c8d452997f29594fa67bb57cf4f4f0d2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201977, "uuid": "ef719b38-a8fd-42b6-a58e-d4199129d36e", "comment": "Malware payload", "value": "63b67f69203cc3de3cc1e17eb5c3d5ec3bc72a0129855c12810ca476598af801", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201977, "uuid": "e255fd32-44ab-4c2a-9858-c35be701400c", "comment": "Malware payload", "value": "16b29c9310d51c3afc0ebc7c573da42e283b0f66", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201977, "uuid": "47930d65-6835-43f3-b3ce-9979ddcc01d1", "comment": "Malware payload", "value": "1be53112aff8899b8330cc01b79383813d1b67a3c7efffc13ee6c5235fc5d0b1e683e3d52d4a62ff7ba45f9cfb3ac045", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201977, "uuid": "1e4c5e96-0446-4656-810a-9fcefad709ce", "value": "6753F8834BDE5CF2F691117108794AB9927BA9D4950EBE9FBB90CD150037292E53A10B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201977, "uuid": "641e5ef3-1c06-49c1-941e-2a84c35e9846", "value": "ba23a556ac1d6444f7f76feafd6c8867", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201977, "uuid": "8354252c-a961-4696-8fe1-84a62ddc2bd5", "value": "192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwGnY04/CFxyNhoy5t:vbLwOs8AHsc4sMfwhKQLroE4/CFsrd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201977, "uuid": "957cd92b-ab36-47b7-82b5-c39958f9d5c4", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201977, "uuid": "2c7ee98f-8e41-4a0f-8779-c1723b43600f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201977, "uuid": "7becdb1e-775c-4a0e-a399-e7e151d803f2", "value": "c8d45299_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac124cd-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload (Worm.Ramnit)", "timestamp": 1620209235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209235, "uuid": "0d5ef385-8374-49cf-8d4d-a5d6d321ef54", "comment": "Malware payload (Worm.Ramnit)", "value": "0227cbdb229e67a2ef044dc152454f51", "object_relation": "md5", "Tag": [ { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209235, "uuid": "a6167679-82bf-45ad-80b4-36feb39bba9d", "comment": "Malware payload (Worm.Ramnit)", "value": "63d05e539ce789c454fc5765092323fe62fee683e1382d8d4d54d001cfac8457", "object_relation": "sha256", "Tag": [ { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209235, "uuid": "47eca9a5-7901-445d-a10a-ca8fd98c7033", "comment": "Malware payload (Worm.Ramnit)", "value": "08459d52fb430bc1bb262595edf2c6ca3d54817e", "object_relation": "sha1", "Tag": [ { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209235, "uuid": "f5518c70-71b9-4dcf-8035-385a2dd724c0", "comment": "Malware payload (Worm.Ramnit)", "value": "980ca274b59379ad88bcc92f7fea07473418787ca7690b2909014536c955d3706bd3b96bc8cc5d362a966ddc259def5c", "object_relation": "sha3-384", "Tag": [ { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209235, "uuid": "88ed5cb3-d18b-4e00-b88a-e8df3f0c1b2a", "value": "47538D217A50C072CC4A24B04429C2A29F7FB4315AB5D557BF950BBE4FB13D0AA3E36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209235, "uuid": "3a6630e8-027c-451d-b706-5dd58fdd200b", "value": "e3f0d90110e8029432dc5e94749f1390", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209235, "uuid": "0afcfe69-e868-485a-b4cf-922e1b184456", "value": "768:S5qn4NX7+MbT1y9EG+HOkHmopjtWO3ZCdZP1f8SvnHH5/jQGPL4vzZq2o9W7Gsxl:8qn40x9kOkNpjWZP1Vn5/0GCq2iW7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209235, "uuid": "c26d0bbc-07b5-4afb-b776-0050f8cda5dc", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209235, "uuid": "5ae6be19-b087-4cf8-977a-83514e35265f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209235, "uuid": "789e7313-007b-4597-ac0c-c443f0322da2", "value": "0227cbdb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a66e7dc1-adc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234138, "uuid": "8f366a17-1bd9-4eb8-ab74-a73102d0e281", "comment": "Malware payload (Dridex)", "value": "ed65d6e5e9bbf46f1e62957aa60f3cc1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234138, "uuid": "92ed636f-b788-4ebc-bb69-f0c6cac10e88", "comment": "Malware payload (Dridex)", "value": "641ec82d8a9935ba3aa4007db16d94e227f39ab968796dbc7b6dc0add9449361", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234138, "uuid": "3e125818-4410-456e-92f1-2ef56c97a889", "comment": "Malware payload (Dridex)", "value": "fd6a78523919f9c962b46acf3e128615b8185de1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234138, "uuid": "7ff4dbf9-d3b8-49c4-aab7-80a862851fd7", "comment": "Malware payload (Dridex)", "value": "052161ec772118ca8107fd67b18499ac2710d11ff36fad380c652fc490568924d022b77e4bbdc075caa529b8cd14f4cf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234138, "uuid": "8543875a-1a3f-40f3-8af0-71058c54d59b", "value": "BCF3D088CBB3E4E6EFB3D37966F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234138, "uuid": "6dfb9a2c-8e77-467b-9b72-8a9c18f73caa", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234138, "uuid": "62de621b-5558-454f-a9df-321a42fe1236", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234138, "uuid": "d29527e8-27ea-4a8d-9ef7-00ac41919a5d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234138, "uuid": "ce27b5f1-1df8-4722-9138-55f2553e3b1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234138, "uuid": "b3726cb8-db2f-4ed8-8f8c-50d5812f8416", "value": "ed65d6e5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da755a4-adbd-11eb-abe1-42010a9c0039", "comment": "Malware payload (OskiStealer)", "timestamp": 1620231412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620231412, "uuid": "a09fe69b-eed1-4ce5-83a7-34907ff8f475", "comment": "Malware payload (OskiStealer)", "value": "8a0e218b840695f1e6e25932b1a4e9b6", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620231412, "uuid": "286dd52f-7e1b-45fa-8c39-850605e07ffc", "comment": "Malware payload (OskiStealer)", "value": "6430c8386fd933b29f0c267c42fcf227c4d0defc3061af984d5fda413ec38b55", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620231412, "uuid": "cacf4fc7-874e-4f25-94b4-aa4a5effc53c", "comment": "Malware payload (OskiStealer)", "value": "c606c93b789d05131a9fb563145b6dc97376eb45", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620231412, "uuid": "dbcb07a2-5c40-4e50-bdc0-aedd0e2f077d", "comment": "Malware payload (OskiStealer)", "value": "6b9c753ff931b2fefe03a70839723e1926a8aafc9dba32f45cd6d12451649b9b274f97b7ff090c7740757bdc91ce535e", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620231412, "uuid": "3edfd593-b6a4-480c-bd4e-ca3e2461f0fb", "value": "43F43372172B7BC9CD303FB1E521D2EE6306A8CC4864DEE584E932DFC56CA95960E097", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620231412, "uuid": "0464640c-65b4-4541-a831-fe192aa435c1", "value": "12288:EPw3tsoCnNpD4sQa8SYIy9xgM1iGQlX57egF3fVVgRlRLz945vLDqfC20yYm:EPwSNpEsQat7sRzQhgRlRLz90vyfC20o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620231412, "uuid": "25cdf034-0c86-43a6-a5c6-9ad46f23287a", "value": 758382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620231412, "uuid": "bbc9daf2-8f53-4f08-93bd-9173164e3d0a", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620231412, "uuid": "f604a398-1366-4c8c-b04f-048f49a844e3", "value": "Payment Advice.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8d16ef-adb2-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620226876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226876, "uuid": "3e2ab384-c0fa-45c5-a336-62de20a78afe", "comment": "Malware payload (AgentTesla)", "value": "1e36b303cfc7cc66870848b3c2a75079", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226876, "uuid": "8bb4bc2e-4779-4016-be67-1a7d79fd2ca2", "comment": "Malware payload (AgentTesla)", "value": "647374b8b20223f23c332f7f671f21fc7715f9665fcbb41c64796b72e56133b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226876, "uuid": "1f30e77b-2dcc-41d4-83be-875e3ac69b5a", "comment": "Malware payload (AgentTesla)", "value": "1ab025db78667993f704efaa85fa172f3b063746", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226876, "uuid": "77e3909b-ee7b-47f7-a605-cda8803fd01b", "comment": "Malware payload (AgentTesla)", "value": "deb2f1a8b9b6b1b842e4aa3321ae7c6af5ccca9c696590934b35f0de77cb3b278119065e57cd30b30eac45778e0c66f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226876, "uuid": "0ea4f6ef-3554-47ec-897c-b9c151a7195b", "value": "BC05127816889B62C47E5B3C28B8C4142BF4BA369773E71F7FC428BB2F67A4145106B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226876, "uuid": "cd149016-daca-4e4a-897d-58b3f76b66b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226876, "uuid": "5e66ef94-eaee-4183-be34-15cab5348a97", "value": "12288:nmtkfi3k1tCMYV53MgQb7x5fQCqmfh4KELqpZ7Lqze5XAsiwxhoUMcN2Ze:ngFMPx5I+4KEmruzeqwzjh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620226876, "uuid": "ab4cb566-8a9f-4a9f-85f8-428432071a19", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620226876, "uuid": "7da948ad-20fd-443e-b0e3-45fc7288a889", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226876, "uuid": "09bb7c15-21c1-461d-aeb8-1a58cdc51ffc", "value": "1e36b303_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7444c502-ad85-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620207425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620207425, "uuid": "963f3197-f2b9-411a-a3fa-f62bd0d893bf", "comment": "Malware payload", "value": "b2f0a278aefc2acc0290b06b4cc437b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620207425, "uuid": "f1efe4b9-9365-4ffd-bd8d-7272160e233d", "comment": "Malware payload", "value": "647c3d01428d52451c218af6d02b2cd0eb0142cbb2385e90f4a8566b89bb79a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620207425, "uuid": "e43597d4-56b9-4438-8da6-529cf0f948bf", "comment": "Malware payload", "value": "3c29ff21a24ab720a1aed3a50ab395c3932e2269", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620207425, "uuid": "4835f5dd-512c-4130-9a04-5c7305f0a0f6", "comment": "Malware payload", "value": "2c030fe192659e8e1323d4984e4099ebe5725025ecc6e23248d1aa62a188a2e03bf0971bc1e78d5af12175620217883e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620207425, "uuid": "e55c89f1-da02-47de-b277-0c19d351efea", "value": "46E301D9E7C7A0D5C8E412B568728D00B6B78F469C8793013DD2BA7AE7F949B44B0C35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620207425, "uuid": "5aaf2cf9-3579-4dcc-ac8e-db27cf8bd7db", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620207425, "uuid": "b7e9c6b6-5979-4ed1-8b59-219c8a2a7bc4", "value": "3072:ccDxIPVrcqP/JFtsW7mGq4vpQNoQRdAcY7pZsPGR1+aJe1mgawzxsBub861jIHxQ:ccx21HJFtsJGwpdi/sPGRUTV5nn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620207425, "uuid": "0bb43b9d-7bd0-49d9-b16e-7d48bc21a9cc", "value": 150532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620207425, "uuid": "dd5f08d0-6853-4647-856a-d64126892d65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620207425, "uuid": "fc8610d6-6fa3-47a3-908a-636ba3be5b87", "value": "Update-KB1484-x86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01883647-ade5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620248464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248464, "uuid": "02a6b79a-bb3b-405c-8643-4ddc9c63ecb7", "comment": "Malware payload (Dridex)", "value": "3206ac47e4777a1c4e7ecfd3bffc7e99", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248464, "uuid": "13756558-5696-4f27-be4a-137a40ffcb97", "comment": "Malware payload (Dridex)", "value": "648d54989c1e0546acaa1141e6047082a8e0d3adb0bf2a50b41262c6d209c82d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248464, "uuid": "276bec0d-1a6e-4564-8105-0fa5592d645f", "comment": "Malware payload (Dridex)", "value": "24aba004fb178acd999851c966f2899383e900d3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248464, "uuid": "4591397b-77ef-4a82-980c-b75c87d7f617", "comment": "Malware payload (Dridex)", "value": "c67cabaa224cca63a008e3c701140826498b0cd11562d1f1885c0102476b7ee1ae95a3f1037b4f913fcd88b62a64e106", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248464, "uuid": "e41c31fe-9651-43e7-900d-9eb36fc6285f", "value": "63F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248464, "uuid": "61b720c7-63bb-4cee-995a-a853ec6b3a48", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248464, "uuid": "e8e09356-da12-42da-be70-54c5e9dc4458", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620248464, "uuid": "4317c680-04be-4687-883a-45b9a0696321", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620248464, "uuid": "e41882d8-9642-412d-9d77-05fbb2064203", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248464, "uuid": "181129b6-3365-458b-a355-a1f08d067b49", "value": "3206ac47_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a34ce00-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241634, "uuid": "64ff8cb6-e550-4a13-92a9-e2b1e19d3c9d", "comment": "Malware payload", "value": "4eb285b0848e996df1a34b701a66b3d2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241634, "uuid": "52bcc629-915b-4ab7-a97d-2d5d48dde1c2", "comment": "Malware payload", "value": "6497f220b71b3bf0bd139a7fed1a9a09a119216bee1f1310f6969c55f522083f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241634, "uuid": "d52027cd-6296-4e2b-8939-9c66b6566c2e", "comment": "Malware payload", "value": "d701c15ef19fc2000b9c168311f026c66096343b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241634, "uuid": "34ca0157-8e34-4be2-a13f-ad2c4ce3d261", "comment": "Malware payload", "value": "f0b6825e72a7d6e3f9f75fe3e29d5e8614d5e6a5d371d692df9f790916d7e048179547472cabed3e1ac872776b7fd834", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241634, "uuid": "d0f16a6b-604d-4a64-92a7-79a6e76a6fe1", "value": "CFF3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241634, "uuid": "20426211-4754-4507-9ae7-3362efc4fb0f", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241634, "uuid": "1e586e7f-4542-41a8-b8be-25239553fabe", "value": "3072:eY45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:B4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241634, "uuid": "aaf9e131-9184-4590-a467-1c7fae98f2fa", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241634, "uuid": "4804e5bb-acbe-4852-b2fb-d3265a952620", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241634, "uuid": "d5ea968f-f2f9-4d91-bc9f-6a2577241f82", "value": "4eb285b0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0689976-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload (Worm.Ramnit)", "timestamp": 1620201916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201916, "uuid": "7af0ed8f-a67c-4416-9f67-4512eb16586f", "comment": "Malware payload (Worm.Ramnit)", "value": "d71a08e318fdfdafc7204cdc85866347", "object_relation": "md5", "Tag": [ { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201916, "uuid": "04842433-e844-4d6b-a797-e81659d27725", "comment": "Malware payload (Worm.Ramnit)", "value": "64ae52e978fe48c65e909c47332af1c73048dae656fe4d51189acba140b992b2", "object_relation": "sha256", "Tag": [ { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201916, "uuid": "922ee54e-ba5a-4795-8e22-0357e1c907aa", "comment": "Malware payload (Worm.Ramnit)", "value": "d1110bcc891b203c69ff8eadf9cdfe03b06cb62d", "object_relation": "sha1", "Tag": [ { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201916, "uuid": "4e8b927d-526b-4390-8016-f74e9cef7eab", "comment": "Malware payload (Worm.Ramnit)", "value": "383934953d2c55ef9ed264434b1838ec92f8d999968ec295fffe44205cbf35e111dcc76ab4202fbdec6e80713681a59b", "object_relation": "sha3-384", "Tag": [ { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201916, "uuid": "71139a54-8806-44d9-a6dc-9b79e2a5611d", "value": "73E29F8AB603A8F7D95732B000DE96B7DF7FA9218D71883ED670E9706F57890BC24215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201916, "uuid": "9aa06f87-ebc1-450a-9f4d-6334cd5895f7", "value": "bada59b09f06f9c01c84b065a341cf6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201916, "uuid": "698b5274-de4f-4f59-acd1-08d80c1e5731", "value": "384:tPpOMLnVCiL5WTdCSIww/2AyFSqXZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxl:tku5AmOqeQGPL4vzZq2o9W7GsxBbPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201916, "uuid": "d412ad5e-5b91-43c4-b31a-9f7d942211dc", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201916, "uuid": "c3fca012-9175-4dc6-aea5-d1f039805634", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201916, "uuid": "f7cf3ab7-d165-42fc-9c50-6190bb78e481", "value": "d71a08e3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1426044-addc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620245001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620245001, "uuid": "d61581d0-3159-46ec-9489-c055d57f8bde", "comment": "Malware payload (Dridex)", "value": "f511e8a2b5ddc01adfccf3a70fbb7b1a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620245001, "uuid": "2ae3ade3-5076-465a-9e3d-e28bb684ff46", "comment": "Malware payload (Dridex)", "value": "64ff82856239f732abcad725a75d49756e64341a681faec8421c5245937ad673", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620245001, "uuid": "17ad68a4-374b-4192-94e6-57c0781e6907", "comment": "Malware payload (Dridex)", "value": "748893042f6ac6ca5d20ccd3a4ed5498782d73f6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620245001, "uuid": "a4cd5165-f9a1-4877-8624-57d4a9b0b2d1", "comment": "Malware payload (Dridex)", "value": "3332bd607c37088773667774d95fad92b65e911f92901f13a268c7b420cc096c93332ea5b5f60cf8d302f949d2f8d95f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620245001, "uuid": "362293b0-0da5-4c0a-afd0-b5c55934e4de", "value": "96F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620245001, "uuid": "7afe2f7b-7d15-49e8-b319-3341a29bfabf", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620245001, "uuid": "de207a69-6fb8-4c97-abcd-22b8c785b441", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620245001, "uuid": "638a2b8a-0376-434c-9be4-69c171d382c1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620245001, "uuid": "6741c553-3e71-4e6e-b309-f1f3a981fead", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620245001, "uuid": "ada4fa85-ee18-43af-a32c-c78f603b29ba", "value": "f511e8a2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "591a1348-ada6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620221553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221553, "uuid": "057dad66-5d29-4445-98cf-57e5bad3fa3d", "comment": "Malware payload (Quakbot)", "value": "7618c96cd8808205cd008be91e90ccc0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221553, "uuid": "a805d550-4452-4d4a-921b-4818820b959c", "comment": "Malware payload (Quakbot)", "value": "655ce3209ab8b61a4a560aef2edd2969d3e807c662b926be73c6cef58b8245c9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221553, "uuid": "addc7e2a-df04-492f-aa0a-ae69f13e8272", "comment": "Malware payload (Quakbot)", "value": "39cddd992916f2536ab5a433fa8b1435258f609f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221553, "uuid": "9f782589-7c61-43a4-b17d-ef4d07363b53", "comment": "Malware payload (Quakbot)", "value": "00e48f31869a7e44b3f2d2c66685d0b0031cf4bfe7a324c500e656a78c79a6e08848441b231cfc39db05354c59c54e4e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221553, "uuid": "dba8d094-087b-46a5-b5b1-4d3bc5ca725e", "value": "F0A4AF6CEB62D977E1182FF492C35F940B53E9D17560660E42B01F2E3D993E53C3AA88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221553, "uuid": "7b2f5c23-a2aa-4b9a-8994-a45b539f4333", "value": "bb6c5cd9afdd44aa768f3e91032660d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221553, "uuid": "410dc207-335c-4bc2-b3fc-7c1d9951d23c", "value": "6144:K4kYHG/5aWHq/Ca6VbrdRNNcjuQ/9zoaV3Eegof:KTHq/CjtN6juS9zoadEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620221553, "uuid": "16a93090-fe28-42f2-9eb1-838ea282ec6e", "value": 491860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620221553, "uuid": "b0cd622d-c379-4685-8dfc-73ce34f0366e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221553, "uuid": "e2f29b17-7b09-4452-ad76-1645243e818c", "value": "7618c96cd8808205cd008be91e90ccc0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9da2f310-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252592, "uuid": "337aaa17-6029-4ac5-a82a-2421c7208643", "comment": "Malware payload", "value": "c6b3d3412639c7caa772fdd6fd73b4d4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252592, "uuid": "e40e3427-1ac3-4ed8-b5a9-11b00965d02f", "comment": "Malware payload", "value": "655cfe9b872822fe93afa0e3ce268ddc052163c3f50546cac5b7d20912adfd7c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252592, "uuid": "d887cf6a-79b0-42e9-880e-e091b4af6f1c", "comment": "Malware payload", "value": "7214dad1c2869f7dd75c120caad7f25f24008c6c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252592, "uuid": "e6a3b8e8-38f9-42e4-9545-af665cd7aab1", "comment": "Malware payload", "value": "809fabadd875d3ae87a9262ff2841c594177edd8d9295291d5ed1f31d751bc8f65fc520cd1ee592ceb96cd8646394b59", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252592, "uuid": "2b01d9d1-4fb9-4a32-9cf8-e25fd0939655", "value": "3BF3CFE89A9FC097E663583055FF3BB6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252592, "uuid": "ff3bb3e4-8919-4764-9e7b-5ead143895cd", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252592, "uuid": "e84a9e14-707e-42c3-8b2d-0031e628b36e", "value": "3072:vv4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:4DBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252592, "uuid": "333f7ffb-6e82-4556-a666-7c791e7fcd3d", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252592, "uuid": "c9314653-64b6-4280-af68-f5bc94ddbb62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252592, "uuid": "5bc86ce6-a327-4ba9-9930-f73b71d38795", "value": "c6b3d341_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5f6b103-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241949, "uuid": "6107502f-285a-4d91-b04d-8ed129914a2f", "comment": "Malware payload", "value": "e99ac88b19aa76a2261ac640b81cd8a6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241949, "uuid": "661fe953-d5c1-4f04-8a16-771517c11297", "comment": "Malware payload", "value": "656239f8b8ca60143a825c182a1e143a0d7eaef875dcd021bfa476374579ecde", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241949, "uuid": "635873c8-e8d4-4e38-9918-209bd92b5327", "comment": "Malware payload", "value": "21ff402db5044b8990547efad7a788319722b051", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241949, "uuid": "6343508d-10e4-4639-ae94-21d191861894", "comment": "Malware payload", "value": "1dce4d852d79de37e123956e43eb223f0c0a6cc0a556758767dc3aa96f451189344414a905ace2f4a2d61bb45598e3c0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241949, "uuid": "e66486d3-9b2b-418c-9086-5f96167dc0a4", "value": "6BF3C085DBABE87FC45A35399071DFFB5B388B145250C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241949, "uuid": "1168c49e-a68d-4f6a-bf91-7f1926bf5827", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241949, "uuid": "da13ced6-b653-4ea6-8971-ee25c720fe8d", "value": "3072:QB45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:e4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241949, "uuid": "d1b9b296-6640-4b0d-a243-aea9036bfd4b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241949, "uuid": "b0b31b6a-70ce-4bcb-862c-6cf467be6d6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241949, "uuid": "85c7f77b-83a9-4e09-90e1-b85c8c6fa3fc", "value": "e99ac88b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f760199-adc4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234314, "uuid": "d3829d1c-385b-4e46-8db4-f1ffe030990e", "comment": "Malware payload (Dridex)", "value": "88d82fdc0bfb3f91a39b9df5903a7652", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234314, "uuid": "b41d3cd9-7675-49d8-9227-261331f48a79", "comment": "Malware payload (Dridex)", "value": "656979b345cfe87e491836dd4f8adfc407e736e7ae599b570cf3610d8bfa1ad7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234314, "uuid": "26172e05-383e-4dab-9e0d-29581f0934cf", "comment": "Malware payload (Dridex)", "value": "abda782bac7027f8f1d792059b81d43a8db31b34", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234314, "uuid": "04afc92f-6a55-4c26-9b35-22af2baeca9c", "comment": "Malware payload (Dridex)", "value": "51d001937c6a173acf0de846613414d6cc3fed574e10339283f2335876fc337f203973593a427607d2c36d8d1aa9c6bb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234314, "uuid": "8d27c750-0bf5-4cc2-ad81-4538264a1eac", "value": "04F3C085DBABE87FC44A35399071DFFB5B388B149240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234314, "uuid": "94e06bcd-333a-437a-8909-fca26baee5f6", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234314, "uuid": "a095efb4-84ea-4699-a575-3d1cb6fcdb99", "value": "3072:co45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:v4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234314, "uuid": "d20c8d9f-1b77-4fe6-8b52-d128ad959245", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234314, "uuid": "23aeb713-95a1-4807-b228-a077cacbe5ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234314, "uuid": "5557436a-66e8-43ab-803d-f40386555588", "value": "88d82fdc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c50285a-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201802, "uuid": "e358c1f2-d665-4311-b988-28d97b83cdf1", "comment": "Malware payload", "value": "eca1806e6c6e756c394995baa106baa8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201802, "uuid": "77d3ae1e-e391-4290-b573-060fbde48066", "comment": "Malware payload", "value": "659b76788cccfc9c993dd9047e86844c7183957478fabe32455dc2a2ddea49fb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201802, "uuid": "ec5188ec-bfe6-490d-b25c-e24bba914e88", "comment": "Malware payload", "value": "5f4e7d99591387bc11ed93a8722aa098696ff0ab", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201802, "uuid": "cfcc6ae8-142c-493f-84d1-f33bcced8208", "comment": "Malware payload", "value": "1697f7dd0b80d4da6eee2fb30c0342d415dd7f79d28e8e4b75a671905147ba18b8ea04558cb3c9cd44416a572a4aba1d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201802, "uuid": "641e57ba-f69e-4032-bfc5-bc28ca60f382", "value": "7CD4AD05A38AA089FF1706323B66C93D6011F296E66207F35970CDED8FDA6472DF6D42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201802, "uuid": "3268eee8-73dc-49ef-a5b5-444c5271fd0b", "value": "c6de4b54f09dafdec2453ca9fe8064ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201802, "uuid": "8c039f72-ff43-43b8-9def-75d8c246b7c6", "value": "12288:gU6d+KFfknyzNh3g2nKNgrNeOd+Ynmz6+L8TIxkqQOnwnKnjTm:ghd5knUD3geqgX6VITbqQOBjTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201802, "uuid": "4325698d-66e6-417a-a09a-79a4d280b7ba", "value": 639488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201802, "uuid": "7e2bf11f-bc2c-4298-8317-3c2088b6bf7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201802, "uuid": "3094184d-c06e-445f-8408-bfff968a5902", "value": "eca1806e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "209be5a6-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload (Sality)", "timestamp": 1620201701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201701, "uuid": "075ab6c3-907c-4286-a1f4-946b8d85a8ce", "comment": "Malware payload (Sality)", "value": "f04527ab6fbe2e2c9def4ea5c400c753", "object_relation": "md5", "Tag": [ { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201701, "uuid": "843ca3c1-7aa2-4e9b-9213-579da9048a0d", "comment": "Malware payload (Sality)", "value": "65d452037fe5b0178ba3d8b1ae2f7b556d5a06f93e1079725637251fca3875cd", "object_relation": "sha256", "Tag": [ { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201701, "uuid": "db0cef0b-8577-4970-ae0a-a780d39170fd", "comment": "Malware payload (Sality)", "value": "f16718a110a10ba5dade87c4ec3bd51c0bc2eb5b", "object_relation": "sha1", "Tag": [ { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201701, "uuid": "26628810-51a0-4a58-bf21-fe9bb3ef2b64", "comment": "Malware payload (Sality)", "value": "4f8ff884591989dc6eb2daeacd6863c0ded520d01d02f4766c7bf31c33b4e8f7fde41e3de103c16f92e5938c4ccfdb37", "object_relation": "sha3-384", "Tag": [ { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201701, "uuid": "15115b93-4a44-42ea-9956-d1353bdbb32f", "value": "51F3121DF974262CE036C13045F5C89498B638595D389F46D2CC297B68EBBF4EA243EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201701, "uuid": "a4af8f94-80d0-4352-989c-03333af3db2d", "value": "f7abe9aaa48fe0998f125ce28b3559fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201701, "uuid": "5af0bfd7-eba6-4ca2-aa1d-d592d878675f", "value": "3072:xaJW2qohu1mfiXE9oZkabtbonkOG/vT/MIccu+7JRqe2U6a+ItB0oCZCF:oJpEAfi+ovh0nBG3LM23J2UD+auoT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201701, "uuid": "614b4d0a-88a0-4784-9cea-a8e1922384ee", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201701, "uuid": "3fd845bd-16d6-4523-8baa-4de64741a692", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201701, "uuid": "47dc6f34-4166-4fbf-9c65-a8cc91624951", "value": "f04527ab_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff1e985-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252649, "uuid": "c55d167a-9319-4872-aea8-8265f8ab5921", "comment": "Malware payload", "value": "c1f3e7018f5482a26a87e20d90433c55", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252649, "uuid": "3939af51-5b98-47d7-aa15-9e648950c34f", "comment": "Malware payload", "value": "65dafa7f8f5c039e342cd109faa876a794400aa69904fc9b1dd6dedae4357176", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252649, "uuid": "eb92e4b2-b153-4030-913c-365f34ab3256", "comment": "Malware payload", "value": "5575b8b0f25af1df5feaf48562a583ab57d4aec9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252649, "uuid": "cd72aa04-9782-44e7-8491-5a1163687a43", "comment": "Malware payload", "value": "5cb1330a05b8b362e9ce027490dfc01d6b6b545785b271a2a33a64082e377b2913fb5c4d7ab999ecb471dc9e1bdb4157", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252649, "uuid": "f5f2d70a-7260-4b14-b83a-55e4cdaab405", "value": "92F3C085DBABE87FC44A35399071DFFB5B388B145650C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252649, "uuid": "f69fa65d-9a2b-49ff-85ac-2ff0d9169ff3", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252649, "uuid": "1aaff076-a394-4938-9dee-e0658175c6de", "value": "3072:XB845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:a4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252649, "uuid": "216779f0-5666-4151-9f52-3fa6ead5d00e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252649, "uuid": "8548feea-76c0-452f-a0a9-04952ae84e49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252649, "uuid": "8e615d30-bef6-4c86-a311-44e780f12501", "value": "c1f3e701_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce52872f-adb2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620226904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226904, "uuid": "aad5f2fa-514e-4a3c-b962-f9a7dc8085de", "comment": "Malware payload (Dridex)", "value": "a225a2ade140a9e7b4e845fb4880f7e5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226904, "uuid": "311bd929-e196-47bb-aceb-7bebbc570e50", "comment": "Malware payload (Dridex)", "value": "65f080f2f12c41740a33be467706ff611f6ba8a2a89f82251e29fbbb2263ad58", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226904, "uuid": "9dbb30d8-7877-4836-9ea8-6713494f759f", "comment": "Malware payload (Dridex)", "value": "e9b3256ea195d9fb70904a3277c5e4905d1b3583", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226904, "uuid": "d0554c66-123b-4267-8a5d-79c370663452", "comment": "Malware payload (Dridex)", "value": "85c9ec56bc1698e9c74f915c88aa3c3031563dae6622b213ac89486b1d4d468dd6bf0f2dcb26cfab329e28427fa109ce", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226904, "uuid": "8cb6b2cf-90bb-4b21-b317-71d4b448790b", "value": "A5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226904, "uuid": "8856d049-7230-47ae-ba2a-85e1a25eff82", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226904, "uuid": "4f3a0255-4da3-4f8e-aaa4-2eac0e77acb1", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620226904, "uuid": "82907dff-f616-4b3a-a0da-e3e4a89c3b95", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620226904, "uuid": "58dbaa71-962d-4088-b3b7-a74dd6b9809a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226904, "uuid": "387375a7-300b-416e-b573-1a334385e406", "value": "a225a2ad_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f07a20c-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209108, "uuid": "d576b89a-b1dc-4f70-b84d-a808f9509db0", "comment": "Malware payload", "value": "26da31542351f619b3a750f6548fde7e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209108, "uuid": "00c7d34e-ed02-46e3-8889-9fdb24420051", "comment": "Malware payload", "value": "660fc0b8d4215d5ea8c67ac9402c0f9e1d96effc94d29590a03747ff8976b540", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209108, "uuid": "75132165-5749-4758-8225-34b67db171fa", "comment": "Malware payload", "value": "b2eea077436c72d2fb18b0af659a7ff547a27651", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209108, "uuid": "31a6baea-6aaa-4374-be9c-c53dc8a6152a", "comment": "Malware payload", "value": "364238d8c51b37f795efa077e0b011207663f24aca0855c02b8155c00ad0fa04e2c2544d3c42079ba719b871d91063f0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209108, "uuid": "e01e5d7e-7786-4e3a-aded-4d12ebedbce9", "value": "4CD4AC7F75F1CBF1C0AC623AB6C9292AE9402CDBC5C1219ADB6FD49013763A25C355A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209108, "uuid": "5c6d51e3-2a1b-42a8-a492-211fc9b892f3", "value": "97c6fbd6f0eef61f2ceeab181849295b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209108, "uuid": "89d2e027-fb6d-4c56-826e-6f3b3a559836", "value": "12288:h6Og8K0wECHFYj3EqEf2JfFRaC5J2cgeMJudCBKjkdoOI89Al55fKax/5Tm:h6/ECqj3FEf2JfvaCbpgeAWOI8w55fJ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209108, "uuid": "596c7d97-8019-4480-aeee-14d6c348af1f", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209108, "uuid": "6aa82ce6-d3ae-4020-a66d-dab816dfa77e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209108, "uuid": "39d80159-3c7b-43d0-a38d-a35986a35f45", "value": "26da3154_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee640fdc-adcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620237695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237695, "uuid": "e0845da4-73c1-4041-89af-fdba0d70cf59", "comment": "Malware payload (SnakeKeylogger)", "value": "187e98e3738e64e38e674d68e322f99f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237695, "uuid": "c3d1f82d-70dc-46dc-b695-2ea196eee03c", "comment": "Malware payload (SnakeKeylogger)", "value": "662b11389fb369114d5922e6b791ad19b00654ddfafe353173d964df7a618725", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237695, "uuid": "4f9a2c30-d2a8-4594-b694-3dcbb6bea47f", "comment": "Malware payload (SnakeKeylogger)", "value": "3f806cfcaa8fdfa4b5a713907b4e40a3fd75697d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620237695, "uuid": "4a048a06-6e56-48c0-86cb-c7175cbedcd7", "comment": "Malware payload (SnakeKeylogger)", "value": "c0b2a35c89c0c24a0794fc3749e220af74309c51e1785e6adf8563f754a2cbfce143456a3eb3a885cefb7a179b7dfae5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237695, "uuid": "4cd8693a-5e17-46f4-b3d6-4c0f3183a3df", "value": "D89423A06CDD4ED4D2566EB5383FFEEADD2636E53846978AB90C9B38B5C411840FB403", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237695, "uuid": "eb910e93-1025-45e3-bbd0-6406975cac79", "value": "12288:CmSq2Lh0g9ryipFjsMOABsUpg3ouNYfTqPFM5:CmSq2lDr1Nlg3oxf2PI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620237695, "uuid": "28ac8849-418b-4c2f-92a7-5b2122e79701", "value": 426937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620237695, "uuid": "231a4b5b-2b1a-4b07-af05-4d9a08cffb3d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620237695, "uuid": "59b9dee4-c5dd-470b-b558-5a9e8f4dc541", "value": "187e98e3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "621decfd-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252492, "uuid": "d6f9a7c5-f20a-4d71-b069-ce6ae8781f1b", "comment": "Malware payload", "value": "5baea98d075e9361204ec2d2813adb7c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252492, "uuid": "3ad38b47-da24-41ac-974d-7e038267ebca", "comment": "Malware payload", "value": "663b7a65d10201b68c0841fd681e9a610bf91b53b61bc14c8c6fbec0500cdf55", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252492, "uuid": "f181aa8b-a79b-4cb1-9653-62ae8d7c0c4d", "comment": "Malware payload", "value": "2f8cd238f374b938a53a8aea9aab1e1d9a8b6cc7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252492, "uuid": "dbd69e89-1f1b-4568-84b8-320c7ce7d200", "comment": "Malware payload", "value": "88d2ef799aa902dbb690792b6dbc4273994b5ceedd333ec90175bb0f786cdb446ce3f0f886320e6ae532915ac058d4f1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252492, "uuid": "f0cab232-a073-4883-914a-4fc14ebcedb7", "value": "61F3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252492, "uuid": "c1b6917f-0ccf-4fa2-be58-28adaea76ab0", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252492, "uuid": "8b3ae0a9-7133-4572-b3e6-6eddddc77cfa", "value": "3072:lB845bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:I4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252492, "uuid": "1edad44a-9f3f-45b0-8ff1-57b3f7f5c2f0", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252492, "uuid": "0ad25578-2161-4aa7-87d9-9bcdffdfcb1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252492, "uuid": "456170f4-c77a-4fa9-9e4b-d719cc7970fe", "value": "5baea98d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0529fb0d-ad92-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620212822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212822, "uuid": "b929f087-588d-405a-b808-b8672a9b625c", "comment": "Malware payload (Dridex)", "value": "ba9bab8682bf428b1dfae4d34ae78fbe", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212822, "uuid": "45fe8575-b168-4fb3-a2d9-d39728deb40f", "comment": "Malware payload (Dridex)", "value": "663d5ebfaa667211d16d2d8a9fd7c5be053af97c1f1fa83c5ec4a7c7cf060a75", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212822, "uuid": "97ec5b84-93b0-499c-b797-ca53f2664a25", "comment": "Malware payload (Dridex)", "value": "beff4c094e277cd9f9fb28c0977432cf0e4ec2d1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212822, "uuid": "3cd1a5ff-08f6-4bd5-aad0-3a1c1eab06e9", "comment": "Malware payload (Dridex)", "value": "6694df9b0c0a2dc83f072534a60ceea7c394da46dd356ddd147f08b931eb94b4fd44bcecde53f7853b216606d9f32ede", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212822, "uuid": "0f4cd9e6-d2d5-4be1-bad2-64a11cfe1d4b", "value": "1BF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212822, "uuid": "96fe90f5-47ae-4d8c-b481-950a08e9fa15", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212822, "uuid": "073299e4-b2c6-4c5c-9cf6-ec1afb4686c4", "value": "3072:xlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:xlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212822, "uuid": "b5e63097-5f8b-48ab-8418-413619c17182", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212822, "uuid": "e83311dd-965a-4a7f-bd09-ce28cfc36cba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212822, "uuid": "7f6d90f5-36fb-4efe-8961-91aefa7e0d34", "value": "ba9bab86_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ea8e85-adc4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234401, "uuid": "6d33c752-7dc5-4bb1-a782-bf2d7ce3f917", "comment": "Malware payload (Dridex)", "value": "dc4b550115f1314b46ef90de7b476464", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234401, "uuid": "1e43dab7-c12c-4611-89ba-15478cc2c34b", "comment": "Malware payload (Dridex)", "value": "6653a401088efe9d850f7c79018c0459a1f793e1657f25d3c387231f379dac19", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234401, "uuid": "2289c570-1f79-4b44-bc7d-e14586bcb4a2", "comment": "Malware payload (Dridex)", "value": "785cff284b47114c5d4aafd7981849cc8e8edf03", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234401, "uuid": "7773007d-7ed0-4073-b5a9-21a04dcef464", "comment": "Malware payload (Dridex)", "value": "62675eaf120fdbcece88bad170635e887cd8fd499b48b54bad73177d7c32aa0267e56d93e234debdf7e11d85850b2c7f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234401, "uuid": "eba0147f-6941-48c9-8241-3d0e3d3d92af", "value": "35F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234401, "uuid": "00edd5d7-a3bd-4931-8f37-79722c00bed3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234401, "uuid": "9fba188a-3cac-49a4-befd-0598373d4d19", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234401, "uuid": "daef179f-ac3c-4a70-8cb7-4a05c9bacc34", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234401, "uuid": "c56835d0-f214-471f-a73a-567f27ed47fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234401, "uuid": "3022a5ec-dda8-4767-8ea6-8bbc29079980", "value": "dc4b5501_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "916745bb-adc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234103, "uuid": "0303e2fa-aa32-4c5f-81c7-2a884add7a17", "comment": "Malware payload (Dridex)", "value": "f9c54f57de3fc42eb68c2ffab666863a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234103, "uuid": "20b38d96-7bb4-49bc-bc42-803c62f658f5", "comment": "Malware payload (Dridex)", "value": "665da24ec510b6c981f13caa585b8b55c20b4448b6a56f3faed6fb5ff3128862", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234103, "uuid": "3fe904b3-feab-4484-8bc2-8257bd8bbdd0", "comment": "Malware payload (Dridex)", "value": "5a0c42cdaa6c3a159c3184df75ef7284672d9743", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234103, "uuid": "3b85a297-1c18-4304-beb7-95c774e48d7c", "comment": "Malware payload (Dridex)", "value": "55405f6481c9c9e0a0d4d296802f2d345ef4af837eb8dc3adf038f5cd02bb47d46a47fedf27569e50cc3d0dd824aea9f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234103, "uuid": "bdce43f4-db16-4d48-bde7-df156bf829e2", "value": "5AF3C085DBABE8BFC45A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234103, "uuid": "c5b9c8a6-766f-4acb-a7d7-027f01128be1", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234103, "uuid": "97423b07-fed0-438d-a9c1-d71c706b3093", "value": "3072:sk45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:f4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234103, "uuid": "06119038-7657-4f5a-b3ce-bb16eb581a4a", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234103, "uuid": "096a76e8-ec44-44ab-9ebe-60898ef11274", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234103, "uuid": "d157aacb-73cc-4f14-a989-d20c7c7c4205", "value": "f9c54f57_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4931196-ad67-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1620194675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620194675, "uuid": "079126f4-b489-41da-b91d-d2f7d7464cd9", "comment": "Malware payload (GuLoader)", "value": "009c4b4a5d270321b39a743e6dc5bb89", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620194675, "uuid": "a8219295-c461-4649-886e-5b9684b7b14b", "comment": "Malware payload (GuLoader)", "value": "6670269c08d80b6511029d06dfa07711a5e0bb1494107da5dc9d9d5661f010f3", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620194675, "uuid": "9f6d21ae-3f1c-4fe2-889c-5e44b13558b1", "comment": "Malware payload (GuLoader)", "value": "a8388863180d744c2b2478a6f1a2e8c1a7ecf948", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620194675, "uuid": "b9bfcc44-6213-420d-89cc-4efba7da121e", "comment": "Malware payload (GuLoader)", "value": "b514b04f091b85351bb65c0463d646894e909acc719a68ee3e5ba1678e829a99c56169fc12c301aa72db10476b483eb9", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620194675, "uuid": "306f115f-a792-42c0-9301-ab9928ce767a", "value": "0DA3F79673C5E465E20E80708E4587F519DA7C30273A697BF1C6362E26BD0C42DEE2F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620194675, "uuid": "faa1cc79-70b4-4b49-be35-2402437e51f9", "value": "4795af900e336ef757ad3450a080a8a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620194675, "uuid": "c51793be-1d63-4fa1-8317-87e512efa8bc", "value": "768:LQaGUofIMyafSWqHgKXHFyTPzQWtAI+ruwddoDOsNQ06bwGvU91GIGY7hu+b+t/2:b3A5yafSWHK47QWtAJwZcb9irhudEI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620194675, "uuid": "1ef617d8-970c-41ff-96ba-7f05da0b2cdf", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620194675, "uuid": "801c1f41-4578-44b2-b4ea-f46f6d30e49f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620194675, "uuid": "508acc5a-e893-4579-a63a-11b7bc318cbf", "value": "Consignment Document PL&BL Draft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7720532e-adbb-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620230623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230623, "uuid": "a50bd3c9-aeba-41fd-a35d-023d9876154d", "comment": "Malware payload (AgentTesla)", "value": "a423d144ec2cd23a22fc179153d06fa3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230623, "uuid": "f055a7b5-74ce-46a0-a39c-1a5e76018a5d", "comment": "Malware payload (AgentTesla)", "value": "667b8ddf5ac40fb9639136fbfae83cfc0fc0c0a0fe12923630060796d3d86a57", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230623, "uuid": "bd887b64-ed62-4c5e-ad48-e93557e4a0ed", "comment": "Malware payload (AgentTesla)", "value": "a2118deabba0a515e954c15a70cdbb5459076e4c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620230623, "uuid": "350df712-1bda-4a5c-92cc-be446f98b061", "comment": "Malware payload (AgentTesla)", "value": "c037f6ca4dca9bb3f0c421a6757df0055130978e0d582227e3a672f17e8e4b38f1b0ac317030d71547578bc38dd7c816", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230623, "uuid": "a7d60d13-b29a-491c-b353-3175166f9377", "value": "F243E05EE172BCE6C0F6B8BAC304D8DF479D298CD10CBD277184FC0E59563A6B299168", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230623, "uuid": "6a3a23d0-f906-4034-b944-972e8284628c", "value": "1536:xTIOOulNOOOIDEyoCKjQqZ91s33UXIngo:xSZ91CUAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620230623, "uuid": "9cd07f9b-bbb2-4454-b04b-aa951fe22221", "value": 56200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620230623, "uuid": "55199d7f-efb4-4d08-be27-1d13bd9c0826", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620230623, "uuid": "571c8dcd-08ff-4c3b-977f-34b78aeb9dc8", "value": "a423d144_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef37446-add6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620242125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242125, "uuid": "8a1b60be-ec75-4c13-8910-bbfbc5228c04", "comment": "Malware payload (Dridex)", "value": "12519727c52074699594f919a27b9137", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242125, "uuid": "3bd0d505-fdb2-476e-b234-81099dfaeae1", "comment": "Malware payload (Dridex)", "value": "66aff1492e5c1175e48d816ed4e5cc0d8f34e52f7cf73be22286812c9b927858", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242125, "uuid": "cd806bef-2de3-4a36-a392-dda810a3d5ce", "comment": "Malware payload (Dridex)", "value": "29fd95d9d2836197d869b1aad08887b86dfc5677", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242125, "uuid": "6a0560c1-d273-4096-9521-89095f699c4f", "comment": "Malware payload (Dridex)", "value": "b423fa3b6e805e8a520090bb73aa28c9b1e4c642823929be02394015ee7417debe1bed64d7bf2ab87a1fda730819e7df", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242125, "uuid": "7770a120-2243-481b-8b40-9b093c3ad1e6", "value": "B8F3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242125, "uuid": "7d92f47e-858e-4c46-9a4b-9b4997110701", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242125, "uuid": "ad4123b4-196c-4bf2-8da1-ee986277c00d", "value": "3072:E945bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:m4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242125, "uuid": "05c15817-66bf-47df-8cd2-f85f618ae213", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242125, "uuid": "964e4773-e3c9-43f8-836c-ec468fa7d4e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242125, "uuid": "69395699-e4fb-4f5e-a1cf-911c16f7ea49", "value": "12519727_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d1aeccf-adab-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1620223627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223627, "uuid": "e48e9239-6c1c-448e-a67b-4beffb8ec1f0", "comment": "Malware payload (IcedID)", "value": "6a2284c46a3161595bb897a30a050a07", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223627, "uuid": "d6104e79-0dbb-4f90-bfc2-1b030de765be", "comment": "Malware payload (IcedID)", "value": "66cd58060e69d133acc2b9ffec752d8461a528ede47ec07f56bdafa5992cea4b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223627, "uuid": "d768cb00-9f04-4cc3-9741-467230a77aad", "comment": "Malware payload (IcedID)", "value": "43835ffc5825b34a8dedd24df716cbdd783fec80", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223627, "uuid": "4ce4f419-0e68-4f4a-a5d4-3b9f54e94422", "comment": "Malware payload (IcedID)", "value": "dad84b7f91a2bd93501f45700ba7ba680200f1f54a5907bb665e502ce36176d9d61977f3e5e719cf9d21ed87fe19ab80", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223627, "uuid": "2d473972-1e9a-4740-acef-4070da9e841d", "value": "51834731AB6A5B90DCCA79774255CAB1D3324FC0170377EBBE6CBA4D2B68980492512F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223627, "uuid": "0275285b-0652-49d0-b5f5-1e2b961590e1", "value": "768:zbp39rCQeomfAk751bTD2LdNnh2OiImFqGYjloqiE2DpKrflUPYPbskMHcbsmY:zfReHp1bTDkNnhipFnY5IE2vYjsRR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620223627, "uuid": "d7fe2e44-22ed-439e-bfca-e39c3624eb07", "value": 81099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620223627, "uuid": "427cc937-f67e-471d-821d-df0917493940", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223627, "uuid": "1d1da0ac-17f1-484e-b00f-749d115d60bd", "value": "6a2284c4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6953e885-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620212561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212561, "uuid": "42e00216-37e4-45e5-aafb-06469728eea4", "comment": "Malware payload (Dridex)", "value": "0992545083c5c5ba83569c5ec7415aaf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212561, "uuid": "0893ca43-1e3f-4b30-9e4b-e6b18f9425ec", "comment": "Malware payload (Dridex)", "value": "66f2e82f5d21adffd205598349a4f2930414cc2e29288f52c7079af112d78b06", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212561, "uuid": "ce1d2ab4-5dda-4306-b9f7-818e0fcecb3c", "comment": "Malware payload (Dridex)", "value": "6aef5398b4fc7d0e414f627a1210ca3df2e0aa81", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212561, "uuid": "218084bc-4ed6-4866-a340-112e4c8696b9", "comment": "Malware payload (Dridex)", "value": "da9478f913e73b03f684e5ae57cc5cefe16a49b29b0de8fcb804bc9a4c4693edc0fde5120fd289dcf7565e6824dcc223", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212561, "uuid": "2583dee2-19d7-41c3-a67b-6de17e126128", "value": "4FF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212561, "uuid": "fd262a93-d973-4628-b6ca-74f161c9410e", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212561, "uuid": "9b28aaaf-7b07-4f3e-b21c-d67034432473", "value": "3072:tiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:2eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212561, "uuid": "61b1175e-3d50-4ca9-bd06-fab3afd1c454", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212561, "uuid": "57b0aed2-708e-4d1b-a909-c43347760a73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212561, "uuid": "8969cf5e-87dc-4f41-82ab-30a5e06ca1d5", "value": "09925450_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e89e9d-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620202061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202061, "uuid": "afb2fabd-b595-4467-92b5-22da42ec595a", "comment": "Malware payload", "value": "4c2f2d5ccaf0d59e119d607726f09ab6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202061, "uuid": "ef321064-c6d5-4798-b858-f98db9c010ce", "comment": "Malware payload", "value": "6706f09b6f16d3f76c318aee3b1cc55608272b0ccfe833fcce3f7673feaa35b0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202061, "uuid": "d4983543-02eb-45fd-a247-579ff3179dd4", "comment": "Malware payload", "value": "8e9af40b2ff4df1103015e8873270acac5be6104", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202061, "uuid": "19eed146-f037-46ba-9dcc-32aac8028472", "comment": "Malware payload", "value": "bed1babd259a27f2ff7be4842b4c54b141a1ae2d6f7574c0c246cac43f9d19ef6dda6516376f24aee081e5b6f5b1c896", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202061, "uuid": "95092176-36ba-4850-9d4d-ec6c4acfe311", "value": "9DF4ADB6D9E20199F8520E71A060159AF1713F7FA2BD13717BA2087F4E17F81AE49C9C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202061, "uuid": "7c8253ba-5f9a-4433-98bc-9f0e9e7d295b", "value": "2e77770d220e7118c2113b27696b8dd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202061, "uuid": "c693f948-6eba-458b-914a-a9cb00c28ee2", "value": "12288:XgdI8c+LKGAe9C+PnJs0ZInuuOsMMgFmWh/XcX4DRYeRt4ts3kGk0MyegLqMK26E:wehuvC+xs0+nuFsmmWJo4ZRi10z5Epk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620202061, "uuid": "d98f1bbf-982c-4633-814c-f88972c512a0", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620202061, "uuid": "d0d3d898-b67a-43b7-b8d9-87a7c6450b4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202061, "uuid": "bc09adc1-99c5-4f47-aba1-b4426ff4f55a", "value": "4c2f2d5c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a23a4e-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201794, "uuid": "44bcf1b8-af81-45fb-9752-f6a5c74efeb0", "comment": "Malware payload", "value": "b2ad9775914b417450888a63feed173a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201794, "uuid": "a0479c77-65fb-4f19-bf9f-6e629565bbd3", "comment": "Malware payload", "value": "671fb988c777ad27531f39dd4fb5f4c4483fb7b07e8e493cd72ee8a6572db576", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201794, "uuid": "ee414a09-f947-4ecc-a017-1f2947981790", "comment": "Malware payload", "value": "889008544db84951a400da8a9c93a0b5d5761dc6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201794, "uuid": "ca1355a2-193b-4eb7-b6fa-0a67c797977d", "comment": "Malware payload", "value": "7e1b1d2c1ea7d264b258d235c230680a643f4c5ba7a30b1e22380498ffb21e80ba6d7f62e28fe41c93d0bf79f6b16d8b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201794, "uuid": "1cdb2244-56d7-488f-88ce-9a45cf033623", "value": "2CE4F180A6BD10AED805C47F192E755E6FEB390592F11877CF6D4F199B2BC8C7280B89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201794, "uuid": "4fafb2fe-d939-424f-aa11-e2aa3de788ce", "value": "a5d65f75e22404051734dd7c8d068331", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201794, "uuid": "0b6486bb-21d0-461a-834f-cf9d3230a156", "value": "12288:rny37FQymIe7Av90iQkvNK5Pw7cTYaZXquJw49PrKRdwNbsAs2DsR4IOieQnfYwb:zy37FQVI6AvDp1K5PKWqdw2MDsb/YwbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201794, "uuid": "8fd48171-ee61-4fee-b826-b504120096e1", "value": 675328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201794, "uuid": "dcb16620-e526-4cd2-84fe-dd776005b7b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201794, "uuid": "b24caafd-e3e0-45ea-94c5-84699dfdb24c", "value": "b2ad9775_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ae66fc-adb3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620227025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620227025, "uuid": "088d8e6f-b980-4e2e-bb58-411d49943794", "comment": "Malware payload (Dridex)", "value": "be93f5b616ab6e4bf04198f8fe7cc3b6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620227025, "uuid": "5a282ba1-abd1-426e-8b21-37c439dcde60", "comment": "Malware payload (Dridex)", "value": "672e4e5b8c0f515b859b4da2795f6290e44895dcdc09fdeca6cf0797161c25a0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620227025, "uuid": "95c3bc73-6d9e-46ae-b203-f5f24e28bdc0", "comment": "Malware payload (Dridex)", "value": "0ffc99bd594d3a1acfe627f8fa9b75cea61e341d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620227025, "uuid": "70d0ad94-05a5-4591-b0a0-52bd1b5e853d", "comment": "Malware payload (Dridex)", "value": "a72fa441ab928dd6c0513be8edd059f74a085ac81dca3de3a5fa10d961768d2bd8784c733d18dbfda2d16d302e84329f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620227025, "uuid": "8d622a29-4a85-485c-b0cc-e4aa55695275", "value": "CCF3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620227025, "uuid": "28818e5f-4e58-4c35-80c4-08c3555fd08b", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620227025, "uuid": "e3dae6c1-d87f-4ce1-9e45-c496b72aeb1c", "value": "3072:3WX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:342IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620227025, "uuid": "a9ff4c91-b9a3-4d08-85fa-e023fb62d1e8", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620227025, "uuid": "63b25370-8fd9-4746-adfc-1684d8f25ac1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620227025, "uuid": "a4b4ac49-43dc-4e16-9992-e203915949b0", "value": "be93f5b6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df429e8-adf6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255921, "uuid": "fe194e55-b719-46a7-9029-82d5130b1524", "comment": "Malware payload", "value": "d4e653f9cd1ee5a1cc5a5a0ce48b4425", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255921, "uuid": "ca130f8b-71a6-4056-bd88-93ef23d9ac3f", "comment": "Malware payload", "value": "6772c6066b0240a6176c9813321fb0de67b6f61d2b5b027212694067a76fa537", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255921, "uuid": "67ee2ba3-720a-4968-a485-e68550c37a17", "comment": "Malware payload", "value": "7ce38b1ab83fb28b11aca8bf5e075107256c5090", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255921, "uuid": "a0abbda5-7198-4239-9bd5-08bcb5a1fc0d", "comment": "Malware payload", "value": "e050b2cbfb1072da85174d072ad303bc6b4aca45087833c1bdfde74435f4af5b9476eccd82fbc0c8825e92824ad79956", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255921, "uuid": "c2a3dc7d-3e5f-4276-9022-c25afa1962d8", "value": "98F3C085DBABE87FC44A35399072DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255921, "uuid": "43a4da03-e84d-4424-8b12-c7586647aea2", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255921, "uuid": "0a49fca1-ab34-46af-b055-e80ccb337e19", "value": "3072:vF45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:94KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255921, "uuid": "126f41e9-6c2e-4f78-8018-4816d96fbfd7", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255921, "uuid": "bddc8815-13e6-4562-9394-5ee6fe9a0535", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255921, "uuid": "3f991b00-dd0c-4f27-8b4f-47bd961e9879", "value": "d4e653f9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc450045-addc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620244939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244939, "uuid": "29e7250f-957a-4a7e-bcf7-6ae12e5abc74", "comment": "Malware payload (Dridex)", "value": "8463ecf0792cc03823b810463771fda7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244939, "uuid": "126dac06-d037-480f-a5a0-0a4e74ae9432", "comment": "Malware payload (Dridex)", "value": "67a28836f28aabc6f870ec5b55c310973fbd3aaa0115ac623fb3f20f5d51bf7e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244939, "uuid": "7a59a555-9edb-4bf5-833a-8bf3af366657", "comment": "Malware payload (Dridex)", "value": "38a9e76d9edf93fff85c2d0c82bf2b266452c745", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620244939, "uuid": "440234f4-f37d-4ea6-b8ad-613e9d3ba455", "comment": "Malware payload (Dridex)", "value": "8ba1465c58bd640d691db5158c0605157fb3425c7a84a2c4b3585f07e60f21c91ddcb4f2296ff6bea7ca6d9db2d2a2b0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244939, "uuid": "99a37271-fd3a-4778-bafe-9cb0d9229177", "value": "E9F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244939, "uuid": "abaf0193-3f17-4c8f-9f5b-eae10bd7ed61", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244939, "uuid": "e8c382cc-ce24-42b5-950d-bec19c1a481d", "value": "3072:Olpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Olo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620244939, "uuid": "654e306b-d7d7-4278-9529-0ef313fe2b8a", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620244939, "uuid": "5830ca63-3e95-414b-a03c-ad02cf3780be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620244939, "uuid": "a32fe23d-f500-4d30-b5c5-50db668eb206", "value": "8463ecf0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3950b517-add6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620242116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242116, "uuid": "ddeac895-4f0e-4e61-ab4a-fb095130ab50", "comment": "Malware payload (Dridex)", "value": "0a037a6308b8487dfa91c723e0faec3d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242116, "uuid": "46390f8a-4de4-4371-8f2e-e7d41dc9a6d9", "comment": "Malware payload (Dridex)", "value": "67be5faaa00aa7f1bd1edb0de3812b103225de2c860b79b96cdbf9d4ea026ad8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242116, "uuid": "0c51349c-04e1-4b72-be2d-2973a6607d06", "comment": "Malware payload (Dridex)", "value": "d52f24bdbfaa285b47e3377a8393ecd2a51aa95a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242116, "uuid": "48d04e56-8c7e-4c7a-90b8-4356f0909bd5", "comment": "Malware payload (Dridex)", "value": "5f6549a647f1b2400164a29c4cc03ff2786ed750b0ea8d281ad0d13f1edb6186d3dbd1f02f7f105377fa4ebc33393381", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242116, "uuid": "9eb3e15b-b5d5-4a11-bd8b-37bd170b6e07", "value": "5CF3C085DBABE8BFC45A35399071DFFB5B388B145250C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242116, "uuid": "7763b173-8481-4c6d-93ed-6cf0862bd860", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242116, "uuid": "7af7ed90-8fd1-4556-ab8a-4e61c8ccbb3a", "value": "3072:Jp45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:z4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242116, "uuid": "51c77dac-0151-46e2-9eb5-14b8774790e3", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242116, "uuid": "a623ab24-bba4-45e0-ae0a-1f14ce4a42f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242116, "uuid": "3e6cb424-27ae-40b8-9669-40592f3bffdc", "value": "0a037a63_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213be694-adf6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255819, "uuid": "8357af90-edc5-43c6-8368-74f378fb4745", "comment": "Malware payload", "value": "8310ebff05f984b7a5d1ccb8d403c0ef", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255819, "uuid": "a64e8ad6-6129-4f9f-8ce0-f86a9743519b", "comment": "Malware payload", "value": "67c4c5e92b0856713133c0ee8f0a5fcc17c59cabc9751e116a53db52557a55e5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255819, "uuid": "83aa8fee-d02b-4a63-94f0-0c5e5c877214", "comment": "Malware payload", "value": "16af734bb2445833f51576f6ea07c38d545aac3d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255819, "uuid": "595f7c21-2378-4294-bf9d-f5a661c6fa93", "comment": "Malware payload", "value": "437d229f7c9fdfae30359369e2687cba96140ef5467ab1cd333df405c72f5898a6bef5a57292646e49d5f5c4c6ebfa47", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255819, "uuid": "b83581aa-8080-4589-9e86-bbc79031a7e3", "value": "86F3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255819, "uuid": "a2dd7082-442a-4d79-bc58-647c186d5083", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255819, "uuid": "a041aa53-4f97-4605-92dd-0eb5616d464f", "value": "3072:984Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:xDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255819, "uuid": "ec1d0b6e-06d1-48eb-b4c8-f701ada24f51", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255819, "uuid": "8b7f0809-5a13-472b-9859-31314a041245", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255819, "uuid": "31628ac1-5166-4313-b96c-593b8434c5cd", "value": "8310ebff_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b7669a-adbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1620232253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620232253, "uuid": "19a002c7-f385-45be-913b-5b1385fb93a3", "comment": "Malware payload (RedLineStealer)", "value": "aa4bd26f0a7cd6a244cad4ccf5668219", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620232253, "uuid": "9a7a8d68-3a49-4719-a8d7-b10cfa3f262d", "comment": "Malware payload (RedLineStealer)", "value": "67ce4fbc9577e825524b7e892648d072f026b5a4d540327546e63297a396886d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620232253, "uuid": "e8c06aed-e1ba-4cbe-8ce6-77f7c36ef10e", "comment": "Malware payload (RedLineStealer)", "value": "e09bfe229d0eb8875b6f25955e881779e892f5c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620232253, "uuid": "e88ff3c8-ebdd-4eca-b781-417d291b995d", "comment": "Malware payload (RedLineStealer)", "value": "d86f92b5629cb946b813ee35461146f2655e919550b0b04f689ce19cae28021c830024b498ffb063d09e9a0b7f46012e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620232253, "uuid": "63bfdbc2-826c-47d8-aa27-8d5c0947c8a9", "value": "72351D36053CA54CC2F66FB05BD87297533E6FCA2936910D9A40B53E6262ECD81B4B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620232253, "uuid": "0c24dd6d-2a93-4675-a2a1-3198400bbe94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620232253, "uuid": "5655fb9b-ad55-422f-b976-3bb4bb6441a9", "value": "768:zOM+htR9GpJWn4Nhp127cb88MVkZCPHclbOfj8aIo5aGEjZcyQ+ZgsBOv06YP1Fa:zOAIZffffzffff1AoYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620232253, "uuid": "ef196346-3e95-42b5-9ac4-2a882259efc1", "value": 1091584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620232253, "uuid": "2d89efd1-6164-48ff-8c06-b3aeb6647913", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620232253, "uuid": "94b46440-537c-4309-a769-0d8b3c1276fe", "value": "aa4bd26f0a7cd6a244cad4ccf5668219.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbbee890-adb2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620226899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226899, "uuid": "fd10d30f-1a40-42a3-b1ea-873eb402765d", "comment": "Malware payload (Dridex)", "value": "3aee6f64075e9d2400b89ae5acad0ae2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226899, "uuid": "516f7cbc-7f7f-4a6b-b4eb-d61a6a9df0f3", "comment": "Malware payload (Dridex)", "value": "6834cf31c297627812f8438e979a6ad569e66b63bf1023a8b476566b43a4d990", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226899, "uuid": "f2d96a9c-aeed-43e7-8d0d-b83be133d4df", "comment": "Malware payload (Dridex)", "value": "c129f1f38ef3be7e076cbea7dcc2a53228aa46be", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226899, "uuid": "2c34a32e-75c5-48e2-a0a5-fa869387861b", "comment": "Malware payload (Dridex)", "value": "ab5f595c1265a1c99f8f07c59e6bd05294ecfa81fb75c82561af42d9d933e54746b0bad44a900342c74b7716dd49dabe", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226899, "uuid": "0ade1f0b-a0af-4cd2-89d4-fc8e223a9ac0", "value": "66F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226899, "uuid": "ede86171-1b73-4657-a7fe-750bd08b5f5f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226899, "uuid": "c7e50cf0-aa3a-4247-a0ea-448858ca5544", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620226899, "uuid": "59cfb490-3d02-46b0-8830-3e0a1b9e63e0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620226899, "uuid": "92ffefc9-f41c-426e-9f33-85d80633c30d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226899, "uuid": "939ccb7c-8698-48e0-acc7-9a81a54a3761", "value": "3aee6f64_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "852055f6-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload (Urelas)", "timestamp": 1620212608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212608, "uuid": "63912960-ff8a-4fba-ba67-4b2bfb2ae1de", "comment": "Malware payload (Urelas)", "value": "f1585cd0c4d85d406925d6a90bebd022", "object_relation": "md5", "Tag": [ { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212608, "uuid": "6d7db79a-85ff-4fcb-aa9c-e0fde80c5383", "comment": "Malware payload (Urelas)", "value": "68637bb4a95bc8af9b13d29c14d4af8ea8a531f69144b7ab6bbd8c428cdfef4d", "object_relation": "sha256", "Tag": [ { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212608, "uuid": "27f816df-b499-4820-8c37-1c2e31eb30c0", "comment": "Malware payload (Urelas)", "value": "3e8fdd6c4783014e57aefdd5b6658009a8156200", "object_relation": "sha1", "Tag": [ { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212608, "uuid": "20d0ef81-a145-4577-aa92-16ba654ec992", "comment": "Malware payload (Urelas)", "value": "ab776cba741a351073a025e0d75c05eabbd0f27f97e18f45715ef59f981e26bcc0c5e169da33d6942718ac4afe348ff6", "object_relation": "sha3-384", "Tag": [ { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212608, "uuid": "f517e1c4-83c8-4e17-acb3-437403136aea", "value": "3A84AD253140C436F3290B354455EAB11AA9BC3915D9E48FF7B8BE7A6E311938B3B24F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212608, "uuid": "cbafdcb0-7565-4f6e-a088-c6cf70732d5c", "value": "372467513fc37686aa91f0703e76e7b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212608, "uuid": "cef98a73-e916-412c-bc64-5466078a33bc", "value": "6144:85SXvBoDWoyLYyzbkPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrohh:8IfBoDWoyFblU6hAJQnOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212608, "uuid": "66d246f5-26f7-4b67-9c67-8285dcf6385d", "value": 405534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212608, "uuid": "46a76523-fb5f-4d25-8c96-a15cc9cea0f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212608, "uuid": "82428b32-2c63-40c2-95d4-98fc7ef622bf", "value": "f1585cd0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea507b9-ad99-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620216086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216086, "uuid": "b89ee074-748d-4eca-839e-dc2af20556a2", "comment": "Malware payload (Dridex)", "value": "cb783c358abced7e29a8df008e406bf5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216086, "uuid": "550ae176-1d0d-4206-af18-0020954295da", "comment": "Malware payload (Dridex)", "value": "68705cd68362d21ca13e29505bcaed7588a35f8e03f4d278dce429d02eb6f28a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216086, "uuid": "d74411f6-3e65-4245-bd8c-9e82178d494c", "comment": "Malware payload (Dridex)", "value": "c34a2aa154ab1d08c47cf3e4bbb86bbb68d7e888", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620216086, "uuid": "8cd694cf-5bbc-4883-b159-bd49eddd8a2a", "comment": "Malware payload (Dridex)", "value": "a297896c6aeae7448a9cf3a9f94d90effc5fe1caaceccb3ee912b1e1f1ec9ed859be8d45ecff3d68ee1daa61c8ec2b26", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216086, "uuid": "a52fa0a0-384f-4d19-916e-3a5476564a95", "value": "ABF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216086, "uuid": "2fcf39a4-3267-49b0-a6c5-bc2eb0b21aff", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216086, "uuid": "7436e6f1-ef1d-42d0-88c9-06972a19e204", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620216086, "uuid": "5dc87903-0be8-49b0-8657-1ba25c4a3a51", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620216086, "uuid": "3c313626-6cf4-4998-812c-b2a52d7e9568", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620216086, "uuid": "2f63981b-653c-4ba7-a355-38717cf80b45", "value": "cb783c35_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27cbf579-adf6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255830, "uuid": "0b0c2bf7-b908-467f-a95e-749737adf1d4", "comment": "Malware payload", "value": "f740464f703cb8be34ceb1bb3592e0f2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255830, "uuid": "0e2e1afa-a588-476b-8d53-0340ee195851", "comment": "Malware payload", "value": "68d7307a21b92c5f8792d045ac645ab2d3406ae41eeccb780a73d3432de29f90", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255830, "uuid": "327494a2-1f43-4b74-b5be-00c9d4e6faa7", "comment": "Malware payload", "value": "0934d4a6a41052ecdff8e47864540361dc1a3784", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255830, "uuid": "dfcd4f34-f1eb-4a41-a0af-6dfc60c548d7", "comment": "Malware payload", "value": "b069d9cecd2217ad35fdc8d3439d497cdee020753d727f8cc17cc567ba8efe027ad8a7868eb397756743f2353b5fc4bf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255830, "uuid": "fe377599-1df2-44b0-a083-cce6f607f16b", "value": "CBF3C085DBABE87FC44A35399072DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255830, "uuid": "b86f90cd-002e-4dba-8cbf-b724d8bf792b", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255830, "uuid": "4993c1a5-c272-4287-8e63-edc10f8189c0", "value": "3072:UF45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:24KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255830, "uuid": "44cbae7a-8b4c-4fba-809a-cfa70ff2e112", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255830, "uuid": "ef5ec28a-7c75-4e28-a2fb-df12643b7e5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255830, "uuid": "b219ee81-ba19-4a7a-882b-be415aa7d966", "value": "f740464f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c370db6-ad63-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620192702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192702, "uuid": "490c16a8-3fa0-48a4-861b-a208e77ed61f", "comment": "Malware payload (AgentTesla)", "value": "cfd98a893dbc815f224d17de8578b868", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192702, "uuid": "b371b99e-c63a-4050-8853-ba794031ebf9", "comment": "Malware payload (AgentTesla)", "value": "6906010d796861631e527431fc9ecea28a277307ab374a9641bf716856535b69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192702, "uuid": "f88019d8-93fb-4c0c-b6e5-35a1885778c2", "comment": "Malware payload (AgentTesla)", "value": "72d2045ef3b443d8ad83f75bf11190b557b5b593", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192702, "uuid": "36642660-0e5d-4add-802b-842602156000", "comment": "Malware payload (AgentTesla)", "value": "2e1628a163cf150865bf094bd2b2315644093b79b03c8535a386de64587f02496d1787f2b2b5acf38e7faa9628a1685c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192702, "uuid": "857d9471-e4ef-4b4d-847b-e52c18340dd6", "value": "BFC531882835D5695B58E3BB42D4BD30D90FBCAB04B8A4F776491B2BC704952B03B7F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192702, "uuid": "9e032eaf-bfa0-49e5-80fd-a215779b8f98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192702, "uuid": "1f08b304-696a-4b21-954d-8bd2bdc23944", "value": "1536:zi/sUsMsbsxsEsQs9s/sksGsfs1sM3sqsMsChs1ssstsMsMscsAsosnsusRsQsOP:O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620192702, "uuid": "fe4e4958-3f80-442b-abea-4a235c8caa82", "value": 2632192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620192702, "uuid": "a2a1ed4b-d6ab-427e-a876-292db25b1aff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192702, "uuid": "e937f8bf-f988-4f4e-abcb-7ebbaa09b1e6", "value": "Consignment Details_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e1165ab-add6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620242150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242150, "uuid": "9b131a83-6f2c-4b71-afc2-372b7d5c0b2b", "comment": "Malware payload (Dridex)", "value": "1cc594df23696ba314dde28ded054cd9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242150, "uuid": "e04ce3a9-b3c4-464f-9704-598277ec0d00", "comment": "Malware payload (Dridex)", "value": "69682fc432b3b2b67c153608e0369eb311fef8ed067d18d8a8d8e839515df301", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242150, "uuid": "b1f35941-b821-446a-9142-8c5fcab797b8", "comment": "Malware payload (Dridex)", "value": "268585af5830c6cfe87727ff3fb3abd82a774e78", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242150, "uuid": "14d55ff4-b217-4920-9fc5-d907a5ecdf55", "comment": "Malware payload (Dridex)", "value": "3437b614ad8edd94422080bb511ccfda4fceb9dec70b3ee510899f50f33932ffe1f6886faa5482a45ca39eeaf2711233", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242150, "uuid": "984f219e-9d4d-4b62-a718-f919d69092ab", "value": "26F3C085DBABE87FC45A35399071DFFB5B388B145250C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242150, "uuid": "ec8c8b20-2f1e-4118-9a1d-a30c838a2369", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242150, "uuid": "b74dec30-f62f-4b6d-b995-4ad260deae25", "value": "3072:9A45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:64KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242150, "uuid": "6e656a64-b64b-42d9-8f1c-105a8f459f69", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242150, "uuid": "7ba766ac-f601-41c5-a980-9060e7ee00fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242150, "uuid": "891edaa6-213d-471b-b035-6985f5ee54bf", "value": "1cc594df_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80026227-ad80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205297, "uuid": "60437b49-0029-49e3-97e7-9ccf20aea1ef", "comment": "Malware payload", "value": "44c51734631ad98c8d740aeb47fc51b7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205297, "uuid": "160f7e0e-98f5-4669-980b-9476d5b59d61", "comment": "Malware payload", "value": "699beab2a7ffa4dea85ea703f6001b4b04652d128f1e520399860f5b7cccfcb7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205297, "uuid": "83c68783-b5a5-4bfd-9090-787c766b40b8", "comment": "Malware payload", "value": "24cb7cfa19297e2138bea56a330abab7bc0f51dc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205297, "uuid": "96b17026-e6e4-40c6-ae2b-59ae49b3fb68", "comment": "Malware payload", "value": "3d4ab3bcbbb15e88767d4d31a9368138d18b337e0a85e46fb918d23a670ccab5250eac683d37a293b0c95585874a483d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205297, "uuid": "eb6c00c5-f61f-4110-99e0-060e26cf91c9", "value": "1A4302FECF9467A8C8DF863045AB8644EC7660B1FD68BEF5906113551B3A583B380C6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205297, "uuid": "88b49fb9-ff6c-42c3-b00d-36e5b76f97c7", "value": "cdf5bbb8693f29ef22aef04d2a161dd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205297, "uuid": "b6afdc83-6c61-490e-9534-a1f66914f3a3", "value": "1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIZv:ymb3NkkiQ3mdBjFIZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205297, "uuid": "bfb47843-9cb7-4fa8-9819-0dcbf6543b0c", "value": 56216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205297, "uuid": "1b1d554d-0b26-4f7c-8a2c-12781639f3cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205297, "uuid": "d266f80b-010a-4574-8231-db9841bdd0ee", "value": "44c51734_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3630d442-adf6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255854, "uuid": "61f3f04d-1b6a-4610-860d-ec762d31fea2", "comment": "Malware payload", "value": "d2634986c1e094bb87a59242aaf146e2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255854, "uuid": "ae3e56ff-3504-42be-a34e-922fbf35928a", "comment": "Malware payload", "value": "69a052950095d6ef059f3eed28b92b233c6a9d03ee968a0bc35dc901298e5d11", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255854, "uuid": "4bed358f-d2c4-407f-a108-9f0263cdfc9a", "comment": "Malware payload", "value": "c67622e6ed33d7f0fb11d129d33f3c7aecb1237b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255854, "uuid": "195354ef-45e2-48f4-a674-b9174978933c", "comment": "Malware payload", "value": "1cdeb9d51775fe7bd169981928b27785c23738eb03182b163fdbb0c484295aa9a5b28ff87d1fac2116927341149bee69", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255854, "uuid": "ed0d5ae4-1f80-4ff0-8b69-6bb9f7f1d5b0", "value": "08F3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255854, "uuid": "4c0e62e0-6de6-4a6b-821e-77aebbafddd9", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255854, "uuid": "25bcecef-2a45-4ece-ae7e-656e100a8c4d", "value": "3072:6d4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:7DBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255854, "uuid": "c3840eb6-b7c9-4db5-b291-b194d9638c51", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255854, "uuid": "93003091-f377-4226-843a-70787d0765fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255854, "uuid": "259e0780-989e-41b1-bbe9-301022c4763d", "value": "d2634986_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0567dc22-adb3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620226996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226996, "uuid": "43742240-6110-405b-a3b9-cab563e34499", "comment": "Malware payload (Dridex)", "value": "c7101c79efbf24bfc7fe798571570264", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226996, "uuid": "3fd1f3be-1124-4fed-8dd6-60d3ba801df5", "comment": "Malware payload (Dridex)", "value": "69c5808351b7559e9262d557d074a54423119705427747aff88f0020582a69bb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226996, "uuid": "18ff6809-51b8-41e5-be62-53308293b807", "comment": "Malware payload (Dridex)", "value": "07f88848aedc0b1fdd4a343c47ea971ff18b1e48", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620226996, "uuid": "55c93f17-1035-457e-a621-cf8dd6932260", "comment": "Malware payload (Dridex)", "value": "0a19199c8c533331d982b71df157ed476a86b40289b94f7bc2c84007592a41b3db0944ee098cbcc295da7b21499ce60d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226996, "uuid": "9950dc78-19b4-4570-9db9-e461b24ef8ca", "value": "ADF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226996, "uuid": "bc5c9a91-7aea-4e5d-925c-798c7d217e8b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226996, "uuid": "5603a107-00c4-4bf9-8948-693682bf3f47", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620226996, "uuid": "67483ec0-ff6c-4a34-a437-79c57cc49205", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620226996, "uuid": "fa6398c1-af59-4449-a1ac-0b9f3526b045", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620226996, "uuid": "f9c595ba-e4f2-4b4a-bf3b-abc76104da8d", "value": "c7101c79_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d781bab-ad80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205320, "uuid": "a20df013-b9d1-490b-a90b-cffa3de5d801", "comment": "Malware payload", "value": "a0b7ae8f99831b2fa6c22b233428907d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205320, "uuid": "fb9009a3-4471-4ff8-851f-386b4e09e51f", "comment": "Malware payload", "value": "69cfdd45abe04f873866d2764da963b6ca5ad387cead41459aa893c781a2c2ef", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205320, "uuid": "61100212-a567-4b2f-9824-18dcb455b494", "comment": "Malware payload", "value": "9721a9b95bb42d978527515258f59d87d957d978", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205320, "uuid": "c4d16267-11f7-42ad-85fd-3e916fcd52d9", "comment": "Malware payload", "value": "a77bb0e6e12c3240235ab43bda1f96b9bbf0adcda39995c04bbddbf6a0188e89baf1f7217aba42e6206c42c522160cf7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205320, "uuid": "4344603f-12a5-46e2-949c-568142ad3caa", "value": "AEF49D1BD7B7039BD8927B71CA3164020A636B93BCFF59E20550DA12DA05CA970C7FE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205320, "uuid": "40f80720-3151-4ce2-a4ac-88fa6f72669a", "value": "83f5c734e5ed1ee76fb7456ef4c2a447", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205320, "uuid": "71823390-48d8-4d20-b40e-fbda1fd92a36", "value": "12288:Baztf5AgoM/e8s3GFO2ibqCEXqTCO0XcYwMFbGwvw64sWU65bRqTm:rh3GFqbqroCOrabfvw649t5bMTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205320, "uuid": "dc1cfff7-32df-4ecc-962a-37c4c81dfb9d", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205320, "uuid": "bf531f62-2e01-44c6-851c-4dcfac14d58f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205320, "uuid": "6355af4f-e97b-438a-943b-8d61948d62bf", "value": "a0b7ae8f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07bd7244-ade5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620248475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248475, "uuid": "aa427a68-18fa-4951-bca3-d9969ee31b2b", "comment": "Malware payload (Dridex)", "value": "47f3113a9ff37a1ea631cddaa6f5108d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248475, "uuid": "3c43a0ae-50ca-4aca-8f43-e06e9fa430b4", "comment": "Malware payload (Dridex)", "value": "69d956fa2399a0cd1ae530ad4967b5970ce4a06b101a988d75c4ee7032ecde88", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248475, "uuid": "2d04ce96-5e4f-45f6-b269-7490473150a8", "comment": "Malware payload (Dridex)", "value": "1b87fcafcc8ca84a26595e29c6b391e83ec91728", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620248475, "uuid": "055a82ca-d86e-4a2a-800e-f2e43223da75", "comment": "Malware payload (Dridex)", "value": "c37c85f249f533af3d999fffaf609680f7a448275460cb6e87509847a094eb8ec517a1b3585936e809cb1d0b22cb6873", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248475, "uuid": "666adab9-e750-4031-b0aa-66e62075ab5f", "value": "D7F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248475, "uuid": "f4db9507-3798-4025-b5da-801d4abfbadd", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248475, "uuid": "f7772544-83dd-425c-9e0d-040a6dd965f1", "value": "3072:jlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:jlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620248475, "uuid": "1e7abd57-0234-4c8c-944f-98fa13b54c4c", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620248475, "uuid": "9feed1b5-7461-4753-8c13-232253cf7cdf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620248475, "uuid": "4c9234f8-9cf2-44f2-b808-046722602046", "value": "47f3113a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21704b08-adc4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234345, "uuid": "1f771b56-0752-44a5-950c-d1b1fcf96eca", "comment": "Malware payload (Dridex)", "value": "7a41063002d0f430ffa2908620d27cf3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234345, "uuid": "4518f489-09e4-4217-b05e-83ec687e64b3", "comment": "Malware payload (Dridex)", "value": "6a2594626dc84c8f8c9878d5a4ea7a2fd7d4e3f99ac8ae2541b91b40ff221dfc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234345, "uuid": "a1e70aa8-031b-419c-9126-d88f16d2b0e6", "comment": "Malware payload (Dridex)", "value": "c51255c8cc9ad7563620516ddf726822e4d5df59", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234345, "uuid": "d4658446-1629-492b-9b77-e7fa1ee75cf1", "comment": "Malware payload (Dridex)", "value": "a81b8529cfea154a115d5700121d963cd72459e8078feb053fc1a10a1e5ba741e069e6fee45bbe95047faf5143663bd3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234345, "uuid": "be00ac66-7c26-426b-99a6-75fb78b5d9fd", "value": "56F3C085DBABE8BFC45A35399471DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234345, "uuid": "4da6d1cf-03af-43ab-8105-a49cb36121ac", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234345, "uuid": "a5c09459-0449-4540-aeff-4df5616aec78", "value": "3072:kO45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:N4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234345, "uuid": "d2672e42-c5bb-469e-bf6a-0777753123b8", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234345, "uuid": "8c885cc2-8558-43d4-96d8-e3fdac9e0b59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234345, "uuid": "b482f692-32d3-409d-a1fa-a5f8cd3af748", "value": "7a410630_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a3c8c8d-ad81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205556, "uuid": "2ca64451-b010-43b5-bc80-53e040ae6bac", "comment": "Malware payload", "value": "4437e85c350054bad573062ab259ffe9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205556, "uuid": "204097c0-599a-4ac4-848a-08f3a081ef33", "comment": "Malware payload", "value": "6a2d6b0c135ed86282bcf96081f37e9f41308f919d3e32c20513240f218ae461", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205556, "uuid": "8ba2d474-68dc-4dee-a5d1-d69f6876ee57", "comment": "Malware payload", "value": "71a470f6417b072299198161f2615d35554a04a6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205556, "uuid": "46fac2eb-ea98-4702-8348-385b32955e42", "comment": "Malware payload", "value": "7a330954bd3d22485153c5a1ef8f5ba17490b8dfc074d4c118a02eaf70114b63ea70884c270297b00b4ca0505d50077e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205556, "uuid": "9692fe70-2a25-4376-81d5-016ba02eaaf9", "value": "A5F4ADB172878AD9C79BA83129FEA9C180BEBF21554C01F578542C675358FA00CF6BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205556, "uuid": "6f131edd-a137-4469-b3a1-9019ae4a7ff7", "value": "75ef5561329049132519eca1426587f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205556, "uuid": "09822b4e-0f36-4fea-af67-97564add910f", "value": "12288:f1cHy01acgSYQ0xliadlEmPXbDwu9WG5gyzQdss1WoRSkOma3fBPHWH/V6txJ0/O:f1Gp1QQ03lEmPT/Wddsm78xWH/V6t70m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205556, "uuid": "879dd7d5-51cc-4f29-a230-05ad06ed25dc", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205556, "uuid": "2b681645-c0fc-48f4-8560-1641b8048498", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205556, "uuid": "8e982647-bd0d-425a-83af-f655b483494e", "value": "4437e85c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c647fed-ada5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620221129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221129, "uuid": "1f0600a7-22cf-4734-8a05-2c48413088af", "comment": "Malware payload (Quakbot)", "value": "85a7c89fa008483f2b5dc446cf860819", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221129, "uuid": "452014b8-1549-4e3c-9141-0b1777cff106", "comment": "Malware payload (Quakbot)", "value": "6a58d842dd9202b1dbb4636a80c030fd73afdbe14a9187acd6cbff4b61c8302f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221129, "uuid": "fae43015-4441-4913-a684-84fcf527e75e", "comment": "Malware payload (Quakbot)", "value": "18545ca2a9e4be1526b2ca8fbaa398301fd6d40a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221129, "uuid": "65209f36-3aa0-4e20-8bc0-977aa3edfc7c", "comment": "Malware payload (Quakbot)", "value": "762eb68c037343ad3155681d2786d7ac1932aa96a2d01333c937a9418e22b487b2f4cfb1b3b3baf14b72b9cd1db54373", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221129, "uuid": "e0eb3b58-f0cc-4d0a-be75-bf0b80e9edb7", "value": "DEA4BF7CFF668973E1142FF1A3C35F940A53A9D175A0610E42B11F6E3DA93D5383AA88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221129, "uuid": "c11247a0-81b3-42cb-9f5d-4b7d94ae3287", "value": "d4b10803acf444b49f2549bbf867a9f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221129, "uuid": "bc65fed5-1046-4314-8781-6eea74416f74", "value": "6144:U0LcdcjuQ/9zoaV3EeVHq/Ca6VbrdRNXh:njuS9zoadEYHq/CjtNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620221129, "uuid": "abda4c68-eb70-4ae0-a7e7-3107672fab29", "value": 481381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620221129, "uuid": "41a463ee-8639-4f47-be04-f9b2a7adcd5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221129, "uuid": "84b93cdd-12ac-436a-b692-ee8b84fa3f03", "value": "85a7c89fa008483f2b5dc446cf860819.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a4e135-adf5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255741, "uuid": "aff32ab1-c25d-446f-bb7c-b1a61fefe73f", "comment": "Malware payload", "value": "f2805109d3848c22711d731b4151c682", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255741, "uuid": "fff510f7-db16-471e-9c8e-b6a2590ab7dd", "comment": "Malware payload", "value": "6ab053b3f77627f9c60db6ac19bd3e0a63641e226fc8ec036b5fd23266165abd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255741, "uuid": "0624f417-6dbd-4735-a4aa-c19dd67e3f59", "comment": "Malware payload", "value": "063bdf219bf53850f65340b1b3d9da9a21db7412", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255741, "uuid": "8cd54a65-0c03-4c04-b64a-d68762aec983", "comment": "Malware payload", "value": "23eadd1c39c8124e9570b2c1acf95743463d0422c8df2925e6cb223319066416204137f8aa99dc917a9e7f72002188a9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255741, "uuid": "767cda07-23e2-4140-8d5c-925c91329d81", "value": "EAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255741, "uuid": "4cda9179-dfcb-4650-a450-e0c01deb93b5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255741, "uuid": "36ea64d9-5ca9-4615-ad0b-a7db5bb620fe", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255741, "uuid": "fa48afab-8f78-4593-b26d-416195923121", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255741, "uuid": "87debde4-0776-4f64-9bcb-8f99dd7f961e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255741, "uuid": "4bb627c3-52e1-4ea4-bf4c-46ca42020de3", "value": "f2805109_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "400e0245-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208626, "uuid": "a331a783-ad03-45e8-b9c2-6390d129c7d1", "comment": "Malware payload", "value": "dd480d7f7471a754efcb6f210f21a7c2", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208626, "uuid": "5d1437b6-b58f-41c8-8077-0064a8127e75", "comment": "Malware payload", "value": "6ab307339acec42a80fb851cc9d0625b6c5eb88a0a5bf56b29182ce5297a186a", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208626, "uuid": "f8e1c367-ac1f-4d69-93f0-e467ef55a4a8", "comment": "Malware payload", "value": "e0c9d20c843f0a5d5cab6374546b99bbe9b59d4d", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208626, "uuid": "fcfb3c2d-334d-4d48-a1f2-fc04707663fa", "comment": "Malware payload", "value": "6d593f6434d70017db40d24e65248ac302d171142f413814b1d3bfc68cf8bb72ff0d777174a7f4b62f2a681242df6c41", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208626, "uuid": "4d05c9ed-97e9-43ff-8f86-18f17893876c", "value": "B7A1F750112C1AB07246697AD26FFB52B90EC81B0A7B7B358433A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208626, "uuid": "d6c9afcc-fd04-44b2-bace-28f8119e8c09", "value": "96:SrRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:SrRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208626, "uuid": "769d48cd-21bf-4370-ba89-9015f672509a", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208626, "uuid": "c4dea61e-8ca2-4b19-86db-f29056d7a115", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208626, "uuid": "17552b6f-c3a4-45ac-9cde-51894936198e", "value": "6ab307339acec42a80fb851cc9d0625b6c5eb88a0a5bf56b29182ce5297a186a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f7172a-adef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252794, "uuid": "4dd26d81-3d3d-4c0a-997b-d0fdf34d342a", "comment": "Malware payload", "value": "46955bac73350e34aa6bb6ac5a1387a7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252794, "uuid": "78078c14-771c-47ab-b884-ea255928815e", "comment": "Malware payload", "value": "6ab979eefba1918382b89c2a8cd551a3c74a15e6743e31a4ab72d09ad14e2823", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252794, "uuid": "4ea3ab38-aa5b-4a74-a377-827fd03bbfd9", "comment": "Malware payload", "value": "913c277ebcf7992f8af85edde1000254308ffad3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252794, "uuid": "88aa5840-1a13-4f15-b2e5-73c95510ad5d", "comment": "Malware payload", "value": "cef82388f915af00ca12673ac07760650e242d85dadd3934ec732ec8b8f55597c89d50f8c9456629b98882241ccdac6d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252794, "uuid": "961d4c91-3cf3-426d-85cf-dc7aa59b5d86", "value": "40F3D091F25FE2CADC4618340139F77265FD89108B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252794, "uuid": "478534dd-a80a-4f84-95a3-7ce8b5aa043a", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252794, "uuid": "4e5e1734-902b-4b34-b248-db841d0e2110", "value": "3072:hWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:h42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252794, "uuid": "28f0c44b-9adf-4688-9f36-a65bd35e7214", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252794, "uuid": "0be74ef0-9d82-4a69-a766-5cd5c32b20b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252794, "uuid": "bc702745-e3b5-4598-89ee-296d854ecb8e", "value": "46955bac_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2164547e-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241646, "uuid": "dd94090c-8fdf-41a0-a891-685c3db72bdf", "comment": "Malware payload", "value": "a7cb5ae9a237db5a3245ace941af1523", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241646, "uuid": "1aa6ee70-8d19-4723-8d06-0b7900f96c6c", "comment": "Malware payload", "value": "6ac9e487eba21fb663b41fe31f1d6b67ac92c88682061c64e0ef842f6898f9ba", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241646, "uuid": "658c79e2-c26d-41dd-a70e-1b426cf2d0fa", "comment": "Malware payload", "value": "d0275876bf596c62c17a7d47ea2bec97e3613b53", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241646, "uuid": "cbc11e81-8dcd-4349-b79d-590463c721da", "comment": "Malware payload", "value": "98481599e861426680b535ed94f9e79ae7d734596cfb2c2e2e1a12ce9c9406d2944477912701ead5969fd5e0eb355921", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241646, "uuid": "d5af2b65-e957-43ce-9bd6-a398f32ef659", "value": "F7F3C085DBABE87FC44A35399072DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241646, "uuid": "54a5785d-c437-43b5-8be6-82106b321a85", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241646, "uuid": "238b8430-004c-4297-8f40-eb47d58735d3", "value": "3072:Kw45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:54KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241646, "uuid": "9e668da1-7cbe-4ad8-9ac6-8d5de6412c12", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241646, "uuid": "b3dcd260-c2d0-4f12-a1cd-9fcdf479b8df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241646, "uuid": "d1b57427-46a8-45d6-b10f-dff539cd69b0", "value": "a7cb5ae9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dc8fc33-ad6e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620197563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620197563, "uuid": "255e1c1b-e2eb-4d34-9809-1619291363ac", "comment": "Malware payload", "value": "442fa9c78a4efb0dc1cd63aaaa37571c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620197563, "uuid": "aa660666-e7dd-4dd8-90f2-46221381481e", "comment": "Malware payload", "value": "6aea214889d90e2db09054a0363b4c6c7798e9d431700183f4822134519290e1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620197563, "uuid": "12893020-7352-433b-a5a2-bdb10fd4e718", "comment": "Malware payload", "value": "9d6cca6120b114b2d5c412eb8042bced2419dcf4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620197563, "uuid": "25d228d1-3dc6-4747-876d-ab537ea70c7f", "comment": "Malware payload", "value": "77087cb681458b482013637cff84b1d0bc042447bab5611f779b2f05a40eacd296d7c0413820c117837d257488ad012f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620197563, "uuid": "d9693c62-1cec-45a7-be54-07b09b3c936b", "value": "4CF02BC368D491764A47115B9B70844DFBB5669BA1D0560CFDCD01112F12BC59F972D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620197563, "uuid": "904f4c2d-0535-4f36-94db-f655c1021e06", "value": "6:TMVBdItOmMl/BMKdESOQeGM34sVtn74e7G+7w14Ke9UAUDKGMKdKFbFPOWtA7VIh:TMHdIMlZd/OdLnx04JodSh8J/umdbboB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620197563, "uuid": "1fbecd90-2910-4981-b4b0-f469d95c5602", "value": 594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620197563, "uuid": "f0de72f1-825c-40a2-b309-7ce3b4e475ca", "value": "text/xml", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620197563, "uuid": "3b281ffc-8fcf-49c2-84ef-fc699b7cade4", "value": "presentation.jnlp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca04da3-ada6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1620221693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221693, "uuid": "0759a6e2-8831-47d8-b1a5-d281cc733e18", "comment": "Malware payload (Quakbot)", "value": "77fccf41ae1a8f0bb1593b4022174baa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221693, "uuid": "39d1fe2b-4d05-4b92-9e50-fa7fb3efdee6", "comment": "Malware payload (Quakbot)", "value": "6b028006040a8d4b524818593e52e77357ad60a17211941db2cc6cf5056a907c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221693, "uuid": "90330f46-1cfe-4ef2-9a5b-1a837546e520", "comment": "Malware payload (Quakbot)", "value": "0fdd7c88e89e4c700d4506284813881311cf2d94", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221693, "uuid": "fe1ae06b-e9b8-4691-9fca-643fcf06a07b", "comment": "Malware payload (Quakbot)", "value": "e078508a29ce5daebb7b0c69d7dd2924201db3ca3e62fd80b26e4a5c70efd07db6f32f6902a55e544e402fab2297a332", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221693, "uuid": "b84c2c5b-bf8a-4a3d-8f27-856aed0718e3", "value": "8FA4B0ADAA32C666E2152FF1E2C71F98475398D53120570E45B01F2E3E9D3E83C3AB95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221693, "uuid": "b7264f03-f671-466a-b200-23e1b60681e9", "value": "c7f129decb1948fe596b367e0a726495", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221693, "uuid": "4a272de4-39c5-4bb7-b164-c1f1dea4dea5", "value": "3072:NJpfClqR2d3djh8lxxURt1XX/2kOrhidWCnW/G4Jx5SW2+xQ9OoqAC9uSkDql:jQh8lxxUf1ekOakB1K9OXAC9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620221693, "uuid": "555251ca-821b-4556-8b90-6604acafae86", "value": 483519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620221693, "uuid": "366f802d-5d5d-466c-8373-85c97bf418cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221693, "uuid": "c7cff089-0607-4bfd-a8a8-1c662c844987", "value": "77fccf41ae1a8f0bb1593b4022174baa.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e589d6f-add6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620242070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242070, "uuid": "6e6d4a1b-adb3-4515-867c-bdc07666b223", "comment": "Malware payload", "value": "5a5fe92642277311f2f792a57172241f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242070, "uuid": "649655a8-2494-4f9a-bd6d-e9d98ebd37a1", "comment": "Malware payload", "value": "6b30d5a542ef3b40c98e31ec27b9bc7d7c7dd146e2f9ea797b46b445b8c1d451", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242070, "uuid": "28e594ad-ebe5-47b7-bb2c-1bd77f377e66", "comment": "Malware payload", "value": "24f8e065fc870dea589cc72c05370a50c15d5452", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242070, "uuid": "7985601e-18af-41ba-bd1a-bf8f4ae158e3", "comment": "Malware payload", "value": "d0bbdcabcacf1d2f4925c7339f29d0ffbb7077a481b438aa88e8ef0d449f24d4f09bd14dd9c7101b1d2b37b6116e11f8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242070, "uuid": "513ef6f0-3e44-4194-a5e8-bcd109e75649", "value": "80F3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242070, "uuid": "c5307448-add5-452b-b7b5-967f089d0bc1", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242070, "uuid": "4abb0f76-fd51-4aa4-81e5-992a7dcb4a94", "value": "3072:w/45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:M4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242070, "uuid": "73617552-dd2d-4637-87b3-ab5e522eb971", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242070, "uuid": "d8fa4e92-808d-4c33-ba81-ad0ef7beec09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242070, "uuid": "ebb8aa3c-0f80-499b-88da-46aa0833ea01", "value": "5a5fe926_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "205678ca-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209002, "uuid": "f3362df2-a33d-4ad7-9082-cece7fc1ca77", "comment": "Malware payload", "value": "8f9e4cfc428be1f2bab69add30e6f0f4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209002, "uuid": "ace937ea-46fe-43aa-b025-856dcc5e62a8", "comment": "Malware payload", "value": "6b35e3ebd80ad3ff1d1a6a33d24a7af3e695f79bb5dc142c109fa38f45566364", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209002, "uuid": "089c85a0-7633-46c5-a875-f232e396be99", "comment": "Malware payload", "value": "d35a58fbc4788a6fd4adca119a8c56a2dbbce73a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209002, "uuid": "c9605004-3127-4573-b61e-5d0d223c4298", "comment": "Malware payload", "value": "967fab47048391db6d7c20a3276653f253cbfa1ae47d246915d241358cbf94c52061411285a20014643868c7c6025689", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209002, "uuid": "abf2436f-58c8-45bb-ac5a-cc1a60d9ea6a", "value": "EB75E00F9BFEB13AC5D5BE7822585AF942085DF55AC8F26CCFC92858890C12B7450FE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209002, "uuid": "25c2801f-823f-491c-949e-3581f5dba012", "value": "e005b3775fe13673c703cc931018cbb8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209002, "uuid": "65527348-8078-4357-accb-c175dbc2f678", "value": "24576:q19qrYSPTDTkK0799Qv60WZtGcymnpQxFDAh/Iy4L1vTlTrAXo:qHqrYSbfE99LnpQxFw/IfJTlTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209002, "uuid": "1b115428-8a6f-4ff4-8b80-f6911b024076", "value": 1600512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209002, "uuid": "c8b347e9-34de-4ec8-b01f-12201f878641", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209002, "uuid": "d61dc5cc-5f7f-4714-b6e8-9a02792ae686", "value": "8f9e4cfc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d09461-add6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620242158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242158, "uuid": "b3742db1-54fa-41c8-97f8-9e485622fbc0", "comment": "Malware payload (Dridex)", "value": "8f5f89c71d75ff4906bb5633a872e34e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242158, "uuid": "1c56e712-7aab-405a-a8c6-8b651e9aeaf2", "comment": "Malware payload (Dridex)", "value": "6b58095f51e23d7ff3634c5eb731ec0892c0f7495b6ce179c8b8b111a3b5239d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242158, "uuid": "a32fa324-84ba-412e-a5df-b2ce44c7f4f5", "comment": "Malware payload (Dridex)", "value": "f51fea5bd4e506dfe658d4c533b2590f39fc6697", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242158, "uuid": "2ae2be20-f9dc-4c39-bcbe-8ca99bdb4a90", "comment": "Malware payload (Dridex)", "value": "ad16de9bee358a824187e1895ae515a0b07b85f112a94bec59a13bf22ff5b9040d4a1eb6bb153fbc95258f8f13fd090e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242158, "uuid": "2d7462e9-f76a-483e-b39c-c318a0884904", "value": "70F3C085DBABE87FC45A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242158, "uuid": "2a58fd9f-80a4-4ad8-ad04-36344eb2d513", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242158, "uuid": "56ece85c-5973-41ed-af38-8ab321d9b51d", "value": "3072:h945bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:j4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242158, "uuid": "2ee337ac-3f3e-49d9-a849-7279500d72d4", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242158, "uuid": "73bd1b54-a044-49b3-bccd-dfca52e33f83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242158, "uuid": "b9e0d321-b251-491b-96b4-8ab05f59fbac", "value": "8f5f89c7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ec0610-adf6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255859, "uuid": "a88623e5-2207-44c9-a0e9-8d79e1d95e6d", "comment": "Malware payload", "value": "fd48a9d85aee9e3b13c2c7d8d9576eff", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255859, "uuid": "b512809b-f868-4fec-aec7-8427694ff356", "comment": "Malware payload", "value": "6b7a0fc6da2f4c5010dc0d515659c636c799f056f00fdd0390a1c525ac7527fb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255859, "uuid": "e20f5a36-5068-4811-b27b-fc0a3de40547", "comment": "Malware payload", "value": "31a233bf7384ad5334bdaa39e18932a164dbf4d0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255859, "uuid": "317ba5a6-0fd5-4b05-b785-16a42f83232d", "comment": "Malware payload", "value": "081ed1854bd92029120ac69291bbf267f565cf5721b212fbc20c81317abd12ec5e7416eb7fd72519ef6cdb4b612720c7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255859, "uuid": "e4402ed3-4346-4796-9027-e358c51828e8", "value": "A9F3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255859, "uuid": "b8c6f822-161a-432e-bd94-21a278533ba1", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255859, "uuid": "ee26c7f6-8a80-4154-a7b7-fd740054590d", "value": "3072:1d4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:8DBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255859, "uuid": "151d354e-2dba-4583-8e0b-3795d0eea7e2", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255859, "uuid": "318e3c45-410d-477d-8b4b-b10d02374d64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255859, "uuid": "8d968a6c-97ee-443c-a54c-dd922eb9d494", "value": "fd48a9d8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd8b5a2-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209022, "uuid": "cfc5c5c3-664b-4edf-8fda-5e63eea08c49", "comment": "Malware payload", "value": "6b1ff70734d0680efc177c0d0ed27ec7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209022, "uuid": "e22c5cfb-a730-4558-9f5d-90951ef85a29", "comment": "Malware payload", "value": "6b82bd1db63b1a48b9edbeb8119e39e26125b321d61f6dbf29ea7a1a18d4dfe9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209022, "uuid": "3a36bd8d-ee30-437b-a4d3-85a1808c1291", "comment": "Malware payload", "value": "c004fd8de589c8ac5b7f89554d84acb059544dcf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209022, "uuid": "a3e6a28a-5305-4f9c-bf02-e4d71c3e2047", "comment": "Malware payload", "value": "bbfdbc72d0b19a69428ff09b55bbd855f76c0477cb6dd756231ff8499596b6b296702acd1e56c8a7b091efb4b3a95227", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209022, "uuid": "a2559113-490b-4c73-a5ae-f977e7062d8c", "value": "F7F48B60789379D5EEF71874729C2D08A167E30D6377370465FA3E80AAF27BED2058A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209022, "uuid": "ce9a409f-d3a2-4e88-a41d-1bbcb016c80a", "value": "eb68c33878507de0e664c6d259c8780d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209022, "uuid": "8b6ce674-b26f-4e70-9e78-6f1d220d525c", "value": "12288:8tlM3JsOOJ8GoJDC/PWBsIf6ZkCNTotzK7WCtKLjYZ3q1Tm:8wOJSJ1BGCNOWCItTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209022, "uuid": "2d8a2dd5-f5b4-4230-abc6-509b69fb47df", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209022, "uuid": "d879d593-ea71-4813-bbf2-1102b9e86012", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209022, "uuid": "116d446b-faee-4b70-88b9-843ddd56476b", "value": "6b1ff707_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb806903-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620202069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202069, "uuid": "9eb44f2d-516f-406a-8c4f-f5a7832590c2", "comment": "Malware payload", "value": "729587324c077801ddb6380abd0f67d2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202069, "uuid": "c1de8116-2126-4977-b37a-b3e4c3efc99e", "comment": "Malware payload", "value": "6b91b3886d16079b12939c1f63bda1318b2a7723cbd03df628716285ce905b23", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202069, "uuid": "f2843464-b4f8-4d01-9150-7a946c57249f", "comment": "Malware payload", "value": "f9a1481753c0b8d5648fc3863eb0970b9630b808", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202069, "uuid": "36bfebc9-fda8-4500-86bc-038ae3974bb7", "comment": "Malware payload", "value": "3243b648fa9cb5f3ee430325a58a546ab3249e9032d729d6672e503b34e56303e569cb1109f158b10f1658eddbeda42f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202069, "uuid": "083411dd-c25d-4b76-a25f-1c92c2fd7219", "value": "90865B7D16F250A6F5D382716FD33AF8A2B114A173B983987E50A36C5B0427E583FAD0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202069, "uuid": "f40cc3ad-54af-4746-8242-b2a6155af85e", "value": "a64e048b98d051ae6e6b6334f77c95d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202069, "uuid": "82e1f081-c5ea-4ef9-9ecd-b3f47ec407ad", "value": "24576:wpM7CMBhBqKCM7CMUvXBhBqKCM7CMmpM7CMBhBqKCM7CM4sMCMmpM7CMBhBqKCMI:hS3S2SDsoS3S2SU2S3S2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620202069, "uuid": "d9807e4f-b556-4fec-aacb-0cad73cf53ef", "value": 7860224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620202069, "uuid": "8979736a-de94-400a-aac5-ef67165516f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202069, "uuid": "4c9c5e24-1c04-4f04-b61c-435d42fb1079", "value": "72958732_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c80fe93c-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209284, "uuid": "a4d8f214-1be8-43ba-aea7-27273f61f684", "comment": "Malware payload", "value": "74eed9586cc06b58e68f05cf792c8ac5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209284, "uuid": "b3819dcc-238d-49ff-b413-6650342aca71", "comment": "Malware payload", "value": "6bbdfa2c501c10965877fa3c4fb68d0415bd948fb09790320f1a9b53e0b614b0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209284, "uuid": "1ab145d8-8d70-4e08-bb86-df435edfcf72", "comment": "Malware payload", "value": "270b6131dedecf447a65ecf2af291ef145c0289b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209284, "uuid": "394c1097-0ac4-479c-8136-ebfc112e4d92", "comment": "Malware payload", "value": "c06fdca8fd2e6f861577f7889058975b9e4c6255c2e06080ffd836eda150c916f876495e5e035785f1f68a81bc01b9e3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209284, "uuid": "2d58e2b2-6005-421d-8e8f-b1becaebdac8", "value": "6AD4BF9BA468F76BFF80DBB9B119E971CD3A1A60C4019CBACC0387D04DD056DA51F9B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209284, "uuid": "a82020be-35cc-4d75-b058-a5992ce70bd9", "value": "41989a77c0faab82d2e4a630f90e8c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209284, "uuid": "55ecf312-4ba8-413b-8f83-6f28a3ad68a2", "value": "12288:1VMy/ftaCHw2RWlNSuX0nolDB7OkFb6kLGNAlY3YaL2yQTm:121zX+o7VFbBLGNYY3LVQTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209284, "uuid": "7b5f6cf1-399a-4fc5-a982-e180713bf4bc", "value": 641536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209284, "uuid": "c408cb7b-dd9a-4668-834e-f562680be8c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209284, "uuid": "5bbc1eb9-7cd2-4eaa-9495-5acb68a91b20", "value": "74eed958_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d173053a-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201998, "uuid": "3988a828-40e9-44c2-8ed6-1bf3c960abc1", "comment": "Malware payload", "value": "d344e938be1a44111aa2d049c677282c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201998, "uuid": "ccff0588-0844-484a-af3b-62c0df9b58cf", "comment": "Malware payload", "value": "6bc6cdd7f08d17a4b96c17a9b038fdbd06643a5a78f5cf7dbf8058cf9bc87565", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201998, "uuid": "98eae5a3-89bb-48b6-a641-22989f70b178", "comment": "Malware payload", "value": "5a784b7fb3f3d20e0185a681ceb85df93aee64df", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201998, "uuid": "4409a67f-2bbb-4934-866c-210e2089194b", "comment": "Malware payload", "value": "55bdea1386bfce1fc64679ce5e2b64b56b8427572d089f7e98bf17b8cac69377f30e5ddb6ea7469aee9cd9b93e1af7d2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201998, "uuid": "73d90654-ec88-42bb-9a56-3f81361d89d5", "value": "4DF48C669C21B619F00A987D2D3372F4397BA855852077A09A0D3F75B8DD0C2FB4AEF4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201998, "uuid": "ad8cd0a2-619a-46ac-8958-1b5753b27bba", "value": "7fc5d836752dc4baa51418fc2987bf60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201998, "uuid": "9d503458-7d80-4eee-be61-d9cafdec7c86", "value": "12288:DCxzLspu8oFUkZgxkACEIg0pZP2E4aKiTdPhkofXbDSgaTm:DKzLXhZgxtC3gCNqyRP1XSgaTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201998, "uuid": "2b762acf-95cf-47c8-ba44-7b074b0ec8e8", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201998, "uuid": "0cd41938-232c-4c1f-9218-c2905ba3ae4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201998, "uuid": "736c180b-2b80-47cf-b5c4-3b89f367efbb", "value": "d344e938_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce99891-ad63-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620192998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192998, "uuid": "94cc4d8d-8269-4a63-b5b3-6cbc866fe4e4", "comment": "Malware payload (AgentTesla)", "value": "0060cf4ff7daf294ea45bb30977b632b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192998, "uuid": "0c41d17a-9de1-41da-8e12-221d258a9c0f", "comment": "Malware payload (AgentTesla)", "value": "6bc91265c3e4b3aba6f05a52e22273b445be07032a2e56c4eab5bec41e963350", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192998, "uuid": "e2434a19-17ab-4216-b885-43e709ef8a68", "comment": "Malware payload (AgentTesla)", "value": "399d93ab7c1e1ca9b9be2cd45dc00781597ebb5f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192998, "uuid": "1817f025-a686-4919-820e-9cef3447fc6f", "comment": "Malware payload (AgentTesla)", "value": "8a2f58b0a00ad1e6eb561fb4f284601838846a0198943f1d988c5302eeccf056458f40070b82110aeb76b5523df28bd5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192998, "uuid": "c2531648-5f94-47ad-8314-84e5fde6ef8e", "value": "5AF423AC1D8B798ECA3FC2B01350A6C925FBDA473503DE581E92A621D4C77C2DB535B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192998, "uuid": "e28690e4-d1dc-43f7-92a7-d9ca7bb7fb49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192998, "uuid": "d9cef66e-5396-43ce-a8c8-7b49e83d6637", "value": "12288:UDoMQ98OAQ9ciLqcGuMRHCqF/QicPKxH9W5rw6pUvB+2zht5Wedg5RVYg6thmv:GoEOAQ9fL5GuMRHnF/YgHYXpMBzhtTgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620192998, "uuid": "cc88f45f-dd9d-4a89-bcbd-e6a36a91564b", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620192998, "uuid": "03b74394-4c32-4f92-84a5-fd368e3ea609", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192998, "uuid": "5a545f86-938b-4e96-8fa3-b05f58686aa8", "value": "MSKU4460632.SHIPPING DOCS. AWB PACKING LIST ISO CERTIFICATE BILL OF LANDING DRAFT. COMMERCIAL INVOICE SHIPMENT INVPLTHS0094587231.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "960e4b2a-ada4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1620220796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620220796, "uuid": "138f7f57-58aa-454d-82d3-2f04894fb3dc", "comment": "Malware payload (Formbook)", "value": "93b2ca391610d14085551d30b9b4dba8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620220796, "uuid": "c104230e-3128-4ac9-be49-1e48dc1c2abc", "comment": "Malware payload (Formbook)", "value": "6bd5e5d02430922bfce2893c805028ae0374fee203235b379856f8bc5f574a76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620220796, "uuid": "15fe9839-dd8b-4203-aeb5-f94e7b991936", "comment": "Malware payload (Formbook)", "value": "55e76c4988018dc93df899e2cda607418325910b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620220796, "uuid": "2e5a878d-eb78-4e33-b3d5-3a2ebd850883", "comment": "Malware payload (Formbook)", "value": "724c50f05d2d5461c043681777d1bda38234e26334edada7b66dfcf3027d30d04c2f42cff5865af145c7640fba6f0a89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620220796, "uuid": "bf877525-ed12-4207-b192-e0b87e7aadea", "value": "59F423C9139811A5C3AAFB7E6474825413BCE14BEB2ECA3C3F5B415C58D76024792FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620220796, "uuid": "0b782169-9e10-48a7-9402-08b671c46f6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620220796, "uuid": "203c1ea5-c53f-4dc2-baec-d453daaf7495", "value": "12288:vTMU6BDIVI4L3Ew37WQl1LvxthdAKPVaOtr4By0haW5m0MTZNdC:vTeDR4L31pLrX4TAWVMte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620220796, "uuid": "4de5e5dc-ee41-4007-aa7e-28b6552a2116", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620220796, "uuid": "a8330288-f5de-4a89-ab3f-ae8f442eceb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620220796, "uuid": "b83ffd44-4340-4cb6-a144-504b3492e6b0", "value": "14500.50.Deposit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e9abffd-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252164, "uuid": "ce4a5471-103f-4cc8-a864-b66188accd4b", "comment": "Malware payload", "value": "36d1fc6302ca60b07528eefc7d25e3d7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252164, "uuid": "42c4d874-9a87-4aa2-bdd1-aa14079ca51f", "comment": "Malware payload", "value": "6bdf253cd218aad24d3bb5c951417f241bf87ffbe0287f1b19b67c15035f8e7b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252164, "uuid": "d080febf-07c0-4b79-898d-c237f3db97d1", "comment": "Malware payload", "value": "18c9aeb15188727a8121dd928b113b8da21897bc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252164, "uuid": "fe6ac39a-5b64-4ada-a069-f85ec2f815fa", "comment": "Malware payload", "value": "fbee84e7fe4ab3db95099d5065a8e1d1cca427f9e9e9bf4800061cc3f96d5cef98eb974a74efdaefdae46936844462d6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252164, "uuid": "32f70477-be38-4225-84b3-27d92de044a9", "value": "EBF3C085DBABE87FC44A35399471DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252164, "uuid": "afd7f375-3283-49e5-8102-c4f0c64a5ed0", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252164, "uuid": "72610dbf-1897-4e12-8a93-9ca27f3f2a2b", "value": "3072:0x45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:C4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252164, "uuid": "4f8e5115-4ae9-4bf7-8fc4-16bee773665b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252164, "uuid": "abfe7629-781c-41f1-a7c6-562974657d8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252164, "uuid": "c017af83-f9ea-4a66-ad84-760163a3be50", "value": "36d1fc63_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "673c2c8a-adf6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255937, "uuid": "c2f15c72-ee2e-4bce-a9cb-a38d10839d03", "comment": "Malware payload", "value": "5689bde935d6aafc97f45f3fde877789", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255937, "uuid": "92b060f3-2a40-4d86-bce1-94937b190ddf", "comment": "Malware payload", "value": "6c266906f327b8ee3612ac572fc0b7ff9904171fbb90d94f1c7e7ca77f00646e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255937, "uuid": "9bb2d8bc-708d-4eb0-ba9a-ca629184876c", "comment": "Malware payload", "value": "21338564198db21fbdd1612ffbe21f7954fec159", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255937, "uuid": "c8574c5f-54cb-4192-8e7f-c0889f3aa42f", "comment": "Malware payload", "value": "b48f5f25febc9d719daf9202eb46d4b7c7859f55306172d24da85b9ad46a9b608769beafaf3945f2d21024ca6eedaf9d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255937, "uuid": "1043f071-d84f-4066-9092-237246680e58", "value": "17F3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255937, "uuid": "13dd4386-6735-40b6-bfc6-7d564e2135af", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255937, "uuid": "bd58e4bc-89cf-4934-a9a4-2faf74d20d16", "value": "3072:Pf4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:4DBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255937, "uuid": "fb4350ee-fcf1-467f-b87e-27694ca5e037", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255937, "uuid": "fbe0ab25-4a6c-43d4-ad42-94a8775d0d92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255937, "uuid": "952c61aa-72e7-494d-883f-f5484d91d589", "value": "5689bde9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "945b5580-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209197, "uuid": "665c1cc1-c93c-40fb-80a4-0c243ca413da", "comment": "Malware payload", "value": "04903ce0096b6c97a6ac10c7c6f7d5a6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209197, "uuid": "70ccc295-2e96-4af8-873e-f3784a8cf980", "comment": "Malware payload", "value": "6c31a74d071e8c555798bc83468ef2648788f6d91cad334446fc77dbf75a57d2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209197, "uuid": "f8022074-956a-4290-b5d8-96565032ada9", "comment": "Malware payload", "value": "93e0cc31c6b4f057762c6b734e5d3fbb7cdbc4c7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209197, "uuid": "784d3fa0-43fc-44e8-8464-59cc91f010e5", "comment": "Malware payload", "value": "d2b35ee99e094033a9afcc5da00da1435fad815cecf9bc4d6775adf776d8ad97d86b70bff30ccc670035eb1a0b283c6f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209197, "uuid": "c25846ed-7ad4-4cc7-8c37-94e0b316ddf9", "value": "3BD4E0A3FB826092E06748F42F0C71C058E99A65DA9F3E313F11D631D67C5A45BE788B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209197, "uuid": "1f86b69e-8e41-4f22-8d10-4b3befb141dd", "value": "7d9db18cb7382f3cf070975191374df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209197, "uuid": "b3f49244-5450-4407-9628-5b211fbd314e", "value": "12288:6JQMkkYyln0//4De0V0fuWUjxZGFeORgynyS4DB+egT0JCxsw8u8E:6Xkkny8VouWUpOG6d4DB+HhP8u1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209197, "uuid": "0478e44c-81b9-4985-a97c-1cf7bc0f884c", "value": 636928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209197, "uuid": "7232c1f3-abb4-4e4c-979e-36b1c05a93cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209197, "uuid": "def57e71-2242-4dcd-8734-6826c24f3b14", "value": "04903ce0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08336795-ad81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205526, "uuid": "5767298f-588b-47f1-9c02-be813e5fdd96", "comment": "Malware payload", "value": "2b006765ceb86d232e548ce754994524", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205526, "uuid": "858d4d41-995f-4575-8800-2b9e6bfbe19f", "comment": "Malware payload", "value": "6c32cfb7a7e220df0e7431b60ce81dd40f55b65f54a912ef62154b46dd1f2e7b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205526, "uuid": "891252ab-8a8b-4360-b74a-6921e596904d", "comment": "Malware payload", "value": "f1ba02fea1f632d00696080a891a07a08b0acabc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205526, "uuid": "7c65a0a3-42bb-44e8-aa4c-79315f97cfb7", "comment": "Malware payload", "value": "fe655692f0886bcca8df87e9e581065b8978dfa2750b29c9185d00cd1cb03f114adefa12c24d12d325675aea0a46ffc9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205526, "uuid": "c2edc56c-2dc3-414c-868f-c3acf0a2cdd4", "value": "F7C4CF895A3B4820DD314638532F8D6CAE727FC581A8844E71546CB671BEDEEF972334", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205526, "uuid": "6bf85eb0-3190-4c8e-9c8b-fb0ba31ac01f", "value": "8ccf02f6a14ff911eb7a8f96c5bad4f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205526, "uuid": "dc1f32d9-aebb-4bd2-8922-169f86ce0f59", "value": "12288:V75aKuHzAS3uV7TkKMm69ebtC1rf2ZqC7cw94S+q8UqK2khJ8i:V75ETAqE7TUeo1G94S+Fksi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205526, "uuid": "55aab0dc-781b-4552-b4f6-0d5ddf9cc36d", "value": 594432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205526, "uuid": "a4d0e1cf-f547-480e-bdd9-a273851f0e94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205526, "uuid": "de30a723-94d5-4a09-8f30-562ecf08c389", "value": "2b006765_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c86fbc-add6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620242027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242027, "uuid": "03f32be9-95f0-4ff0-97e2-4a7e0e47339d", "comment": "Malware payload", "value": "a1c35300b9f69bf0f750f15010a70d66", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242027, "uuid": "6b201160-10e5-4dd5-a7d1-b389a242c09f", "comment": "Malware payload", "value": "6c4aef5ca74951c766d8e4e7a866e5ce7033135f4b124c31aeec74bf4c84277a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242027, "uuid": "5e810e1e-2def-4d87-9692-89dd88673e1a", "comment": "Malware payload", "value": "a50b2e9afd47fbdf44ffa226575887ab5510c258", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242027, "uuid": "5c65744c-f224-49d0-9787-ff4c281a24bb", "comment": "Malware payload", "value": "dabf2124bfe4e9dddcc2328d820618f60ec583906b2f8430c5c3c30c2a1b5a7e771a434f30d2904674533d618adc2cd0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242027, "uuid": "1867b86d-e1cc-48de-ac1f-454ee18b0325", "value": "E3F3C085DBABE87FC44A35399071DFFB5B388B145250C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242027, "uuid": "6fde3d4a-dac2-4898-b3e9-e1a3f93b74ba", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242027, "uuid": "8d3b8065-cc64-44ae-a38a-0741f66ced76", "value": "3072:uw45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:94KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242027, "uuid": "25fec7cd-a9e7-4050-94e0-036cadc229e0", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242027, "uuid": "a18192c5-73f3-4c4f-8528-eb72b3f31fb5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242027, "uuid": "5b206e1d-27d3-4781-804e-578da07375de", "value": "a1c35300_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1debe0-ada8-11eb-abe1-42010a9c0039", "comment": "Malware payload (SilentBuilder)", "timestamp": 1620222605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620222605, "uuid": "5dea0850-40dd-4499-bc8c-9a4751421901", "comment": "Malware payload (SilentBuilder)", "value": "3a53da03a882458b32904991b479b7bd", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620222605, "uuid": "c7105613-6969-4084-ae9f-89d47857b698", "comment": "Malware payload (SilentBuilder)", "value": "6c6ce2ca3d8f6796017905c5a41899cb2e99bf0aa190ed69de81363d314e52b9", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620222605, "uuid": "cf63a370-95c3-4b8b-8d99-64462bc9228f", "comment": "Malware payload (SilentBuilder)", "value": "27da495de0fb5488c972eb762bc1c6d77baea804", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620222605, "uuid": "d8fd25a8-80b1-49fb-be40-db2f273f35c5", "comment": "Malware payload (SilentBuilder)", "value": "d0b1acd6889a601a8b3fe484d7356a57d5fcafefe656062e349e0ac81b41e5d93c555429849748791090454e4c7f57a7", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620222605, "uuid": "f04c33db-74f7-4009-9b02-3dde96db43e4", "value": "37547192A602B0ECE1147A35D82D41EF46A7EEA92F58B2C72C0473B37F761E12FC1549", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620222605, "uuid": "463758e8-bb2c-4d1c-8dbf-beaf6ffdcab0", "value": "6144:GcPiTQAVW/89BQnmlcGvgZ7rDjo8UOMXJK++P29v:3mp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620222605, "uuid": "5603cb1c-af09-4594-8735-dcf7fc5aef10", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620222605, "uuid": "2eb344f7-8089-4d12-bcdc-e2c5e2a14c8b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620222605, "uuid": "1b1d90ce-8145-44f8-aa2b-3cf02208bb37", "value": "maldoc.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f8a98b-ad57-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1620187487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620187487, "uuid": "8c82b2d0-da9e-4191-ab8e-42aeeea1e29a", "comment": "Malware payload (njrat)", "value": "6b1185633a706335384631391c38505e", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620187487, "uuid": "4ff6dffe-10af-406d-9286-d521c85c68a0", "comment": "Malware payload (njrat)", "value": "6ca8d9e0214b3c8da72b641ce89afbc1d14a5fd1e0acb6fc2e1f10d1732f748c", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620187487, "uuid": "8d92cff4-dd44-46ca-a029-d61f4f981068", "comment": "Malware payload (njrat)", "value": "02a7c692736cd6238d7e3447a04c1897d9493943", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620187487, "uuid": "6e570981-e0f2-4df6-a233-355cd837f42b", "comment": "Malware payload (njrat)", "value": "066e23b3f4cf22926966c4af4159e0b7fea55cab2fcbef94f7be97464238752ed1c662f4fa66ba6897f2297f62b8242d", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620187487, "uuid": "80fbf373-d9b7-41f2-b628-f864ae0b0e5f", "value": "A6242BCD326BD8DBCA5605F43D13C27D87339C6AD116E65A28B2772ED2B107B23614E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620187487, "uuid": "2da96521-be86-4f66-8679-2455c454f45c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620187487, "uuid": "22f94362-0ba0-4979-896d-fff291282291", "value": "3072:inYh/xr+VBFaI1YIYiheeeeeeeeefYDeOiClppeppOpplppepppDppptpppjpppq:egZrMBgkSOG9iO2RK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620187487, "uuid": "6744222d-48b6-4d22-97dd-ffb49580159d", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620187487, "uuid": "7d78d424-1c51-4a46-835d-b048365f09ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620187487, "uuid": "3d25db85-b36d-46d4-8572-f6af587fae49", "value": "SecuriteInfo.com.BackDoor.BladabindiNET.10.21006.14845", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dcf3b27-ada4-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620220648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620220648, "uuid": "61442938-a67e-43f2-a6ee-4c5659eb3851", "comment": "Malware payload (NanoCore)", "value": "1979be7e2281c20ab7806d78aaa8ec47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620220648, "uuid": "b787f164-c138-49bf-8b83-00c597885b98", "comment": "Malware payload (NanoCore)", "value": "6ca94a8ad9c54789fbf640e91ba405b2bbc5dc7f917ccadda40347665a4de653", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620220648, "uuid": "5a75a4a9-3560-4d85-a43f-e24bb6027169", "comment": "Malware payload (NanoCore)", "value": "29cc8e24ea23d7191dac3d4dca867bcf06d34a65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620220648, "uuid": "779992e2-4236-44e7-8ba2-c27f2482dfb1", "comment": "Malware payload (NanoCore)", "value": "d2a0b79b43c962edb6dfa9096490376b6f26a3e25507716c8b313b03c667dadb580c4eacbb05e6601d0c741959c50bd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620220648, "uuid": "31e164b8-1ad3-41bf-84ef-a34207a3b4ca", "value": "A50523C17208A430CDB957B3443A056402F4FE1FF9E9DB0E2A67B95D7AF368205617AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620220648, "uuid": "0543d1c9-2b09-42ac-bccb-f4c232254259", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620220648, "uuid": "5f7093c9-ed4d-42f8-96b2-3dd901704580", "value": "12288:VMLrqdEeAGqsbUi3o5H6AgJHdJCc3s/jfERUHJxuUL8l/t9PNFIvqAnRBZ:V9LqyogAgJnCcw8RUeUL8XJBAnRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620220648, "uuid": "ad83fa2d-5204-4e9e-bbfc-48c9021f1705", "value": 795136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620220648, "uuid": "1cdcdc7a-bf45-45f2-99f7-491444c49933", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620220648, "uuid": "9df051f9-dd50-44e9-8a07-87328c7526ee", "value": "PO#293701 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8306ef19-adc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234079, "uuid": "6a8704b9-2659-4b4b-810c-4c27e34543dc", "comment": "Malware payload (Dridex)", "value": "899b04ad656eb481baa3ab26aae5b747", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234079, "uuid": "6d6ad67d-b31b-42b8-ae9e-c17cf775bfb6", "comment": "Malware payload (Dridex)", "value": "6cdde2583a357c101785a7c5187a66051232f5682df3d2ccd3f750a2584727a0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234079, "uuid": "0272cc9b-2086-4a16-90b0-1537797ed7cf", "comment": "Malware payload (Dridex)", "value": "2be1672aabab1df68b1dc1e8ff8e05155d38f08b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234079, "uuid": "df81ef8c-6da3-4f7d-a466-25b901defcd9", "comment": "Malware payload (Dridex)", "value": "51065dacc6c9ba11091b18b0cc3cb4f9dc164caa9f0c5c36145afdcd55fad0147ed999cd759225ac3a497006f931c170", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234079, "uuid": "f95eecf2-5259-4731-afc6-f57c2b33cc7e", "value": "B7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234079, "uuid": "58f9b7ba-cf8c-40f3-a2e6-d12c819607d5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234079, "uuid": "0c5418c3-5830-49e4-8c04-786c2d354f79", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234079, "uuid": "3975846f-f220-438a-8d19-0d28478c74cd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234079, "uuid": "4e034050-5dda-4d35-9dff-d90929b980fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234079, "uuid": "297aa258-8dc7-422c-99ff-abca59c17f27", "value": "899b04ad_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "540b02d3-adb6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620228417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228417, "uuid": "af0def28-703a-49f4-ad82-06296af109c0", "comment": "Malware payload", "value": "ef1f929186c436b78b1b1639de196cdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228417, "uuid": "2d046bd5-e73f-4eda-805f-12d709e6c39b", "comment": "Malware payload", "value": "6d006ec6fb6d8741a3dc50c6f0131eb90bacbb9c49b60f02e1be2049aa4f2255", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228417, "uuid": "fe2ef763-2eee-48ed-a426-7990650c7d6f", "comment": "Malware payload", "value": "325835583b5375622f332af1d3450252d0c9fb03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620228417, "uuid": "6f9306a9-88aa-4f75-943a-e26bd28622f9", "comment": "Malware payload", "value": "2e4036023e2f1d7b2e0d7c560b60b0cb507a2ca2e37a1d9af3d58d603defa3e43e80e3cc16ffaac812f157bcf0a2ddf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228417, "uuid": "d830f959-e551-4588-873e-d57022135b92", "value": "E25524A0B32E6B40BBA403B0BF4E30E0262E19BA117B5ECAD651724D6F35F199C55773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228417, "uuid": "3831e718-2529-4493-96c5-5d6975f85d85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228417, "uuid": "f28e17c8-6606-4118-9c44-cf58d7877069", "value": "1536:Na9tNoH3uvOnc2ue8t958YYHW5Xr9W4qpjm4oY96RQJoHr18WA10jRQX973JBfwT:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620228417, "uuid": "2b18f6fe-5cbe-4338-b545-4ef741fbf82c", "value": 1328640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620228417, "uuid": "90a033fe-2b9d-4e52-9e8a-7b97a53459b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620228417, "uuid": "4e4e028f-9e42-481a-8ed0-eedf7cafcc93", "value": "Our New Order May 03 2021 at 8.70_PVV550_TXT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4891844a-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252449, "uuid": "eb6727eb-ab43-40e1-b5c1-45df480f4ab5", "comment": "Malware payload", "value": "8bb1816864fd2067a9bb96b099270d14", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252449, "uuid": "38d564bb-2ba5-45fb-9a53-d07b28922917", "comment": "Malware payload", "value": "6d129fa77f0470f721990ebfcf95ff13a63de7a502adeda8151bca35ad4c9729", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252449, "uuid": "0e08d69f-2241-4dcb-a41d-effbb4b3df16", "comment": "Malware payload", "value": "564619420934a45b0b18f8b60ae9d76162fec8b4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252449, "uuid": "37a3ffa3-7187-427c-9a30-a1b36765f5c6", "comment": "Malware payload", "value": "c29de49487fbc3cb11eb11ddfce41be8c0a3cd6ad30d0fbc3e2f5e59373820926e216fa33e9978053cb570fce9f82d94", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252449, "uuid": "2bcab5c9-5576-473e-b886-505885b5adf7", "value": "15F3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252449, "uuid": "47f02fbb-d17c-4f54-86e8-a4647a2fde1d", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252449, "uuid": "d06e24ae-1589-4d6b-9d0b-e12b33758b8a", "value": "3072:hm4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:7DBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252449, "uuid": "c989a2c4-f801-4e3e-89ed-f188118dadf5", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252449, "uuid": "cff08c00-03e2-4bf3-8988-e8133208c7a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252449, "uuid": "7bcf54d7-41de-4752-8608-8e587a73996b", "value": "8bb18168_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d22731ca-adaa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620223474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223474, "uuid": "f400fe58-bd75-4a94-a7fa-834acca95795", "comment": "Malware payload (Dridex)", "value": "6d4b44c1a10689aeee98076c2b91bc66", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223474, "uuid": "c41ac85c-2097-4bb7-bfb6-b7e755f02f7b", "comment": "Malware payload (Dridex)", "value": "6d20a9616a861fc61b2e717256d65305b9551d9c54a108a86fb6f90a29b5c709", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223474, "uuid": "0e424563-98e9-4b72-b339-7228ad944bb2", "comment": "Malware payload (Dridex)", "value": "d46c1ed1902c395db06638875f4384e4126e8c3d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223474, "uuid": "e45d3133-6b38-4d49-96d4-5206b02af08d", "comment": "Malware payload (Dridex)", "value": "6624aa6e7671d06150bdb71ee95cee161d840ab1627719670edb7a4650431557e41ad3a315f6636bca99b006cf9fef37", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223474, "uuid": "24b73188-4dd3-421c-9fc2-d32a0a5e0381", "value": "F7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223474, "uuid": "8e2fdeb1-8e61-4d6e-9922-2459f2e73657", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223474, "uuid": "1dbf64ba-2898-4b30-b6d3-4c4117e269c0", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620223474, "uuid": "582f79c2-4f95-483d-8cc5-961b8775596a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620223474, "uuid": "9f68871e-7512-419a-a67f-27ccf0fa394a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223474, "uuid": "77d201f1-8cbf-4e52-8b5c-a06f74589e31", "value": "6d4b44c1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2638c05-ad94-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1620214079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214079, "uuid": "c79f0893-f9c7-4980-9dc0-90ffeb864909", "comment": "Malware payload (AsyncRAT)", "value": "9c697146c626141417666b847ba49752", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214079, "uuid": "2340aede-1b01-422a-bc50-b26ace62510c", "comment": "Malware payload (AsyncRAT)", "value": "6d52d77cc1f4ae6384113a2099386a3ec22f31d6d58bb264d625d532fdf48161", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214079, "uuid": "9e4411ec-143a-4c5b-88e0-69095f3a42b3", "comment": "Malware payload (AsyncRAT)", "value": "5847ac080a879df3533d5fece6cb21f07702beb3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214079, "uuid": "0ae689e9-7d2e-4d1a-9ac4-3c4146f256ed", "comment": "Malware payload (AsyncRAT)", "value": "b8fb683d6e4a5a09bc93a87a36fb4c44a56f5d66af7c9a2ca363e6ec7cb4c9a6c9d00dbede4cf3cde65969d6d6cb05dd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214079, "uuid": "cc3d896d-ccd8-49a4-8928-974441ad7bcd", "value": "B0D422587388A869CEF9C7B5911D82C1237DF257AA57CF0C3E5AA08C6CD7B024311BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214079, "uuid": "26678f06-0059-4a15-8d9b-2cd69a06a6bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214079, "uuid": "90a7387f-ca40-42ee-a00e-565881c93924", "value": "12288:XHMovMax3yHMtAE9ecJmGg7O98sceIo/Hd3fPd6LaNbAr28aW+Mc:XHY5stAQV85O9R9PtcLebAiZ3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620214079, "uuid": "3a0151fa-0129-447f-95ef-e31c382ab682", "value": 607744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620214079, "uuid": "7cb22bb8-5595-4f71-969d-dbd9cfa62edc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214079, "uuid": "224ab78e-3ffe-4f78-b9c1-f82e06ffa17e", "value": "INV00293893.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9b3713-adf6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255838, "uuid": "1ba982f2-dfd4-4844-926c-bc38b3d99167", "comment": "Malware payload", "value": "c8730a4c19f5e6c44c06046213e76da9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255838, "uuid": "299e2188-d06c-464f-84e5-3d364bcf265b", "comment": "Malware payload", "value": "6da8a5c18841267fe9148374d97d443d1406ffde42c854829d5985f615faf540", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255838, "uuid": "c865e449-9002-40b5-890d-7bd359df61db", "comment": "Malware payload", "value": "a314fac11824702cebe9de62cc9709872a53d80a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255838, "uuid": "0c4bab90-8e3f-4ffb-b294-679b68624ea4", "comment": "Malware payload", "value": "c8218f7dcfdfedfdb1ea7f64a0cf398256a2c4f2be596ace0671076285762fc470f5f7b138eb36096f957630010374b7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255838, "uuid": "99aa49e0-8dda-46d4-8fd2-7f21cd867f6b", "value": "0CF3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255838, "uuid": "99730f00-7136-41a6-ab00-9088b103ab3a", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255838, "uuid": "23c9b21d-bb4f-433a-bcd5-e3d03cecc0a0", "value": "3072:q84Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:WDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255838, "uuid": "4e3a9859-59ec-4b24-b137-b2280c765843", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255838, "uuid": "afc63765-f56b-42aa-8bed-a1cdc416478e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255838, "uuid": "5acf31ff-5cff-4895-9bea-80cb50dfb327", "value": "c8730a4c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51e118b9-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209086, "uuid": "e54d4673-7059-46a4-8c3f-9c90dce214f3", "comment": "Malware payload", "value": "966b193b894f740b78dce206acfe9e40", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209086, "uuid": "b9abba5b-c30a-4734-b736-94322c44cf27", "comment": "Malware payload", "value": "6dad77171c960f2d7b5f71763d2102499683c904e9af3a41118562261d00a97a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209086, "uuid": "05388aa5-05fa-42bd-acd0-0cd805815d0c", "comment": "Malware payload", "value": "d2bf6f3656e118c17f0b15af777a4bf2f8c390c9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209086, "uuid": "1805525d-f221-4337-9b02-4b3436d541b0", "comment": "Malware payload", "value": "533a93b6ee11becdffbcf4653e652eced40a58b5722958eeb252273693d85d5952d37533134740ad111359a8955200af", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209086, "uuid": "65274afa-16d7-4a9b-bb80-b99c52dd8fd1", "value": "1485F14F6FBA8C9BD058C8FC4F9CDEE42DE9013D816912B2A335F745D856730B926868", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209086, "uuid": "99e9d0b4-1fb5-45c7-af8e-fe442cd40ade", "value": "6600dcfbf2c898a8a85c05b6492bae57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209086, "uuid": "d3bf7087-5c42-40b9-9aeb-8c56d02ac674", "value": "49152:NQvaHdhPH3nCNbuCcwefURmSy6x2beq6W9ZBS:NQva7nCZuCcwefURJqqqbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209086, "uuid": "ff6844ad-7532-48ff-9c3e-7b8a27370345", "value": 1726976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209086, "uuid": "f3f2f472-ff6f-4a48-a466-064fb8f9e4ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209086, "uuid": "7bd95630-800b-43a2-8662-3e028d927666", "value": "966b193b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d73334dc-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620202008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202008, "uuid": "5386a63c-9d32-4622-961a-d9c9d45f1b7d", "comment": "Malware payload", "value": "5bb04e59709e1d7190333fbcc50f23d9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202008, "uuid": "35b13a5a-472f-4671-9c2a-249fbe96e2e7", "comment": "Malware payload", "value": "6def9d0131bd36c911d6d14aeac1b8d294e1a2f8b8874087fcc79d1002ebdda4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202008, "uuid": "e851ad37-1f37-424d-b93f-705c835e3f97", "comment": "Malware payload", "value": "3bcffe7705e9b043a047837d45d4fff01247b0ca", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202008, "uuid": "d5be77af-94d9-4443-94cd-5bcd2d84f108", "comment": "Malware payload", "value": "94da3c035fc2e24dc14520d95dc0676c840908c6eeff80810af6c97bb28acd1e3fd5d1c64195d536646f5032c33d9dde", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202008, "uuid": "2eee9880-b61c-4cd5-bd22-ca5c9774a750", "value": "65B46C327601BBF3CFA334B1C64657B7861C89DE086A830B96C0CC5DBEB78916B79615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202008, "uuid": "269b30bc-0722-4bc2-acdf-240b50ebbab6", "value": "dbf687d6aa2a6cafe4349f7b0821a792", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202008, "uuid": "a2ba5d21-35af-474d-8524-16c7759d6ece", "value": "12288:71/aGLDCMNpNAkoSzZWD8ayX2M7Cw7D03CLQxhdpABeHQBEwA:71/aGLDCM4D8ayGMuXkDfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620202008, "uuid": "092d51af-ad76-4b7e-aa07-ef5461042c97", "value": 540694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620202008, "uuid": "836b957b-7ad2-4922-b84d-e28ca1efdf21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202008, "uuid": "6b8c848e-3d73-47f1-9be7-20ce76b17c83", "value": "5bb04e59_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a24dc7-ad81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205596, "uuid": "5ca77d47-3eeb-46e7-9820-1261d7d84d95", "comment": "Malware payload", "value": "f919831cf92b54946ee17fdd76616acb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205596, "uuid": "099d1759-ff39-4ecd-8db3-a7b42b7d690f", "comment": "Malware payload", "value": "6df3cc776b52679aa742f3ce9a45617fa5bd66a4de5bd0594e2cb24d9e9534e7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205596, "uuid": "013d2bd2-d758-44df-8b68-8e03cfc8b4d1", "comment": "Malware payload", "value": "2f06f9d08a1ddd528d24408c3f10295dc079e359", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205596, "uuid": "6b186bec-4b64-4160-bb7e-14736d91bc59", "comment": "Malware payload", "value": "af20f361a7c016a007d6c3cda4f3af686cf150655f4d160922631ef618f8d1e3a8ad457e81819fd1f252ea4849f63a18", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205596, "uuid": "f950afbc-683d-4b7e-9537-b39e66f75a50", "value": "75A4F15A37656A64D4A7733E17BE4B105C0350E4157CA1A8C8FDF00EAE2BDADDB9022F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205596, "uuid": "03395139-f3f0-4ee8-bf3c-a52c2f590dc3", "value": "ef3fd1c1a81435e51fcc42212e25d2ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205596, "uuid": "c0840982-c118-4f92-a272-04c68d34f39d", "value": "12288:0K+uoHICkLkbzIbmnBRB1qdfHfo4AmJfA:0Goz4JbKXB10Hfo41a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205596, "uuid": "beff7bd7-d8fd-4775-ac32-2f5f28f7cb87", "value": 465740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205596, "uuid": "60e350f6-ea79-46bd-b9ad-feb07489140d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205596, "uuid": "27af29cb-b8a2-4070-b9e8-f8bccb8bc7ec", "value": "f919831c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3809d539-add6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620242113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242113, "uuid": "a691e93d-0165-4a61-9dd2-6dd9963d6043", "comment": "Malware payload (Dridex)", "value": "6d230ed5a6e9384d126c31da34e1ac21", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242113, "uuid": "ca35ad41-41d6-49ee-b01e-e36c43471896", "comment": "Malware payload (Dridex)", "value": "6e0b3f1eb923728fa5b638cde0f51ec55c7f39074ec65b6abb9fab5041e2ab35", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242113, "uuid": "dbd381e0-d511-42be-8831-8ae93aa52d3d", "comment": "Malware payload (Dridex)", "value": "873b2aa78522654c1b9527cf997fe22dc2471a5a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620242113, "uuid": "97cb08e3-729d-4d02-a748-4b8b534450ac", "comment": "Malware payload (Dridex)", "value": "126a5e01fdd8551941bfd2c627d08ac5e02c478fc3641346b31ef3897a51f34d1b8b5c48ccae38d70610405606fba72a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242113, "uuid": "814b5418-91b0-4c39-b393-cd8943367778", "value": "84F3C085DBABE87FC44A35399071DFFB5B388B145650C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242113, "uuid": "e390b01d-364f-49fc-aa13-2a197befbf69", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242113, "uuid": "facfa139-5fa0-478f-8938-48c236c6807b", "value": "3072:DA45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:s4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620242113, "uuid": "ff47dd9e-eb3a-474c-b3ac-5c6419c44ea1", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620242113, "uuid": "9b573c44-05e6-4b7b-8306-4aa3c5d06932", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620242113, "uuid": "5ecd9833-005b-4bfb-b6ad-436a2e4d844c", "value": "6d230ed5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d2e73f-adc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234105, "uuid": "bd0bf30c-1cb3-4f85-8d02-f3afbe257254", "comment": "Malware payload (Dridex)", "value": "c856e5845b65fca05426645f7d7ca00b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234105, "uuid": "bc52cec9-3e10-407b-9fcf-afd798cffa6b", "comment": "Malware payload (Dridex)", "value": "6e0e8557d220fc89eb82147de1a27c6162f00a863966d4117ad5f88e52529cdb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234105, "uuid": "868c8921-a14a-4bee-a209-a256adcba097", "comment": "Malware payload (Dridex)", "value": "c9435a46520c54fc5daa54611535a44a58b5ed62", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234105, "uuid": "ea12b191-6c56-4bca-8bdf-db58ae62c15c", "comment": "Malware payload (Dridex)", "value": "aff2594f1a04b6acb0a734ae2605012b4f8c0c5a2d4063ad83381c9381748101b14797a97e923f3b94833c625e208e59", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234105, "uuid": "f890049e-19a4-4640-840d-993ae9bf6bca", "value": "0CF3C085DBABE8BFC45A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234105, "uuid": "027f0186-fd91-4a7f-9545-745144f5cd58", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234105, "uuid": "e5e0655f-9a0c-403f-b46d-a168822c0eba", "value": "3072:vk45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:s4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234105, "uuid": "63d6bfe5-7817-4393-9479-f92bec10d9a6", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234105, "uuid": "24447e41-9294-4bef-9ce1-4322aae48cd6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234105, "uuid": "b28a5e56-2642-49a1-afba-c453eca6c296", "value": "c856e584_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8827ca2-add4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241497, "uuid": "53c008cd-45db-415e-987a-43bd75755aa8", "comment": "Malware payload", "value": "a9ea57cb60dad8e908f4784334c6ba12", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241497, "uuid": "2525f0e9-017d-4a6e-bc5e-b5f6835d75fb", "comment": "Malware payload", "value": "6e10cbad58cadfc1ab3b0ab2c531b08aa3065e66903ace4909c7ba704800f56c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241497, "uuid": "5ffa5f1a-f11c-4c55-95a1-019bb4f575f1", "comment": "Malware payload", "value": "401d413bbc665b3b5f847293d366ea1f5e765b6b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241497, "uuid": "229747d9-f7eb-4b0e-b67a-22b5e082b473", "comment": "Malware payload", "value": "8ed34acc554e9e34c5719a66c8e5cbc9354acd003d0ed9fb1e5e18bd82ea15b592615f0b7cd494601179664c292cad6a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241497, "uuid": "a26addc4-c169-4b67-a8fe-2c29d997c8da", "value": "75F3C085DBABE87FC44A35399472DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241497, "uuid": "faeb7815-4d83-4353-ac54-d688cf53c968", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241497, "uuid": "09ea6f5b-f097-47df-abeb-cead901b4ed4", "value": "3072:SX45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:S4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241497, "uuid": "d6169822-7492-49ea-a435-af1889460b95", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241497, "uuid": "208dd55c-70db-432f-a56d-2444f5645f0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241497, "uuid": "e7bca351-0777-41aa-a49f-a9f641289e50", "value": "a9ea57cb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ab5c4a-ad47-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620180817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180817, "uuid": "9ffd5c93-6e79-4957-8321-6103c0e7be09", "comment": "Malware payload", "value": "6fe67155349d2a29482f3fffcfbd48f3", "object_relation": "md5", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180817, "uuid": "1e688693-68ec-4b3f-9615-d8d221baf3db", "comment": "Malware payload", "value": "6e1e9fa0334d8f1f5d0e3a160ba65441f0656d1f1c99f8a9f1ae4b1b1bf7d788", "object_relation": "sha256", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180817, "uuid": "a3fa5add-a092-4e81-9d09-909dc166c7fe", "comment": "Malware payload", "value": "da361bb68c3d1a2a18e6f8c73ae3988a0e910350", "object_relation": "sha1", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180817, "uuid": "b8a43e63-f87a-4d66-b6f4-8e51c08a7280", "comment": "Malware payload", "value": "34f5a91f4c0ba3e004f7daab4132fec9547e9b88853b0a6de7e6b3152da2ba89b31a114827cbbede77af448ea3b4e4aa", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620180817, "uuid": "ee2af6fe-d85e-4568-a88e-0a15d6887d8f", "value": "F7E3BD8C8386D8A6D4E3BEF11907B16A864BDD6D10E3E8E576DBFD2C3070692048DB57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620180817, "uuid": "3b2cdac5-b395-41c2-8eb4-f370be41b3f7", "value": "84245f630674d6573306664292458cd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620180817, "uuid": "b63e8f83-cbe1-4493-953c-f6848fa8c2ef", "value": "1536:E3icGgKEuISZ+SsxcWRMyEWr4SW55M+3ltHxr1P5zdOjApjVK9eP:0SCcWRMyEWr4SWLM+Ckpj89e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620180817, "uuid": "7581bf79-0ba9-40fc-b3e5-179cccaf2f66", "value": 155136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620180817, "uuid": "1c9323a0-f43f-4fe9-981a-107e556fe234", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620180817, "uuid": "722f2a2a-13fc-4a87-ac2d-b0dcf7576fdc", "value": "6e1e9fa0334d8f1f5d0e3a160ba65441f0656d1f1c99f8a9f1ae4b1b1bf7d788.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452a6859-ad81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205628, "uuid": "2688d713-c442-4de7-8871-30574464a999", "comment": "Malware payload", "value": "98a81d96896a6880e33d6b327d59b11e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205628, "uuid": "40719d63-58e4-48ba-ae7e-db351ae4adb2", "comment": "Malware payload", "value": "6e52adb9ea3f8ac005ba8a047c879a083d8495892447f3cf729e0f772ec03454", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205628, "uuid": "3b59c060-7ba3-4924-825e-d430bb058178", "comment": "Malware payload", "value": "f8609abce95945fcbf53243db5ab0c64c086b13c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205628, "uuid": "d825f913-27ef-497d-9af1-56075f193a36", "comment": "Malware payload", "value": "53980c99bcb3ad9011a2825f9a03be8e01b09f68cba70bfefb8c0c39da4e0273cf54d9f311a41f45e2972f72245aaef6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205628, "uuid": "253c4656-382d-43e1-99cd-dadd1d34ccec", "value": "E4B4E0130A2A05A0DA079DF636A012715D5AF1FDDC1D12987F15CEFD9CB183DEE8AB82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205628, "uuid": "5b57654f-c512-42dd-a923-f75fd3468c14", "value": "a391813582447f018a76f18236665128", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205628, "uuid": "3224c814-e70c-4ebd-8ff0-42895a5e0c4b", "value": "12288:+N5GZABHyc4/+kPFGjWoY/vE68S5G8IKA:E5GOBHyc4G4kOvE68m/I/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205628, "uuid": "ad3f7235-ee4c-420c-b92e-3f0cce66c218", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205628, "uuid": "4df880e0-9722-49cb-982d-c795e47ab756", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205628, "uuid": "3be4d1a0-b6c9-4938-93e0-b73960b6b689", "value": "98a81d96_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a71a5e9-ad79-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620202094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202094, "uuid": "fc0f86e1-ea29-43a6-a0d5-1d82e6f2f15b", "comment": "Malware payload", "value": "77548d672178be9a8b1602cdfddf09c7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202094, "uuid": "b12e495e-f649-4f5f-acb8-2dde35103a62", "comment": "Malware payload", "value": "6e9a4cef238c5b734ecf32e9c449d09497eade2391bd85fd706ecabc2b210d7f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202094, "uuid": "ee39f37d-84be-43a6-a07e-adf36f69863d", "comment": "Malware payload", "value": "65ea0fa06bf3d528e076d91d1f93f3876c1f9ec1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202094, "uuid": "47cf5d63-9dab-4a20-aab6-02f4942f6774", "comment": "Malware payload", "value": "b78a40ae105ac134047a1b55df6c3c485b5c17e86b0b07b15b11b141c25f40f2d5e897de3a7dc84c7213c5168136a61e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202094, "uuid": "eccdb457-fe5b-401d-accb-130c6431f01b", "value": "0225D0DCE27039B1E4A26F769F4C62C1C0D4E382266674D21C569772B313D3DEAB1A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202094, "uuid": "5b5ad283-46e7-4d54-8dcf-b884da154e9f", "value": "9fc47ac04d423b6390f810a4e43dd690", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202094, "uuid": "efcd97d3-b2c7-4235-aed2-7fb67724e87b", "value": "24576:KMhZJaGXnwzdawd0MRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRO:KsJDwz06RRRRRRRRRRRRRRRRRRRRRRR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620202094, "uuid": "4e13d64f-16ed-4609-bdf3-511da5efb17e", "value": 1043456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620202094, "uuid": "dff2aad6-df22-43f5-8ca4-4eb4e6b018af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202094, "uuid": "4a84ec36-51db-4d53-a22f-67c29d0cfbf9", "value": "77548d67_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f819ae-ad68-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620195186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620195186, "uuid": "9977cc29-ecd5-4f53-b5eb-31d8df5c118c", "comment": "Malware payload (AgentTesla)", "value": "0c74e57e89992b44be763238c96d9355", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620195186, "uuid": "252686c2-4319-4b1d-8998-c8b1a4ef72e9", "comment": "Malware payload (AgentTesla)", "value": "6eae84ece9518036a2bb762dc2e30a32568e20a1f1f8ce50247310b727389150", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620195186, "uuid": "ad9ea2b8-8781-40a9-8cfc-0abd57f1d678", "comment": "Malware payload (AgentTesla)", "value": "b2c6d86f4ce3a277083aabd7841a0dcdfe2535f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620195186, "uuid": "b54bc49a-7483-4986-bda8-05d9e6da8be8", "comment": "Malware payload (AgentTesla)", "value": "42fc6cbb87db50d25feac7a31b5bd8e193f45c64eb4ae157c299750b2fdf0050e17c7e19c2b823711158278cfe1359f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620195186, "uuid": "3029a83d-d7e6-4dc7-9256-83a25bb44820", "value": "CBF4224BB5DC29E8C66DC6768C6032502330BE669A1BCE052CC6706849F75079B73FAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620195186, "uuid": "724241c3-df00-4f21-87cf-ca5698064edc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620195186, "uuid": "19461216-e42c-4bc9-a54f-fc0ab48506d8", "value": "12288:kM9nevGN9dVxktwU2UJY3RmQLfGFf6Pp6veHfq7eXuu3FZMvTIeSZnZbLDebRWH:kSnevGpVUhJ2LlpoFu3FZPeglKbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620195186, "uuid": "3be44624-62eb-47c2-8278-ae39116cd7be", "value": 755712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620195186, "uuid": "6ab7b6aa-0142-48a6-825c-5dd1877690a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620195186, "uuid": "caa25d03-ab7f-4a47-bef5-92b81bc4c25a", "value": "DHL Shipment Notification Status AWB811470484778202129-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a875950-ad90-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212160, "uuid": "b9d965c6-6e0f-4817-ad85-fe8aea9a56f0", "comment": "Malware payload", "value": "4ea2c49920dfc1dbcc1ffb5a7300c441", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212160, "uuid": "32a9bcae-94a3-4df7-b2e4-f0a69721218d", "comment": "Malware payload", "value": "6ef0e93b9e0ddd5e3bbe36c5fdefa2dfd7a8d985fe36af2af5670b3671a1bd26", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212160, "uuid": "be4d78f7-381b-415b-ab1a-1cf04eb448a9", "comment": "Malware payload", "value": "01a1e816266a13a760a60bb00d047b14c8b35d01", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212160, "uuid": "29687bb2-969a-4f80-9117-3da6414dd033", "comment": "Malware payload", "value": "fa0b1283b63875efbaca79a67b60c6d867f0bd333f531c51457a1409debf8c3b4b1c8885a356ddd6821a62bf932389bd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212160, "uuid": "136a9c18-0d08-48aa-a128-fc8bc141dbd9", "value": "4DF6AE7F71A4922CC15EC13AC0939F40A633B1759B76C6FB629503A41F17AC4AE7FA24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212160, "uuid": "ad2566a6-abf7-47fc-859e-41fc4f6aa0b6", "value": "ff750281199fd75b463a9612c10a02fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212160, "uuid": "87218693-e659-42f2-8d73-b1f9b43e3593", "value": "196608:hJ7In8fJaw8k9pDGOVSNatSyk8uwBtNf7lGGlswN27OZO5pBn:h+8fampDdshyk8hLG0gsOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212160, "uuid": "fd6d1a35-cfba-4c5c-9b87-5f5f7026de34", "value": 16675328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212160, "uuid": "dc160294-c626-41ac-b1e8-e3530336d0b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212160, "uuid": "4e7a194d-7e46-4c60-ac17-5796665adb33", "value": "4EA2C49920DFC1DBCC1FFB5A7300C441.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a6b405-ad94-11eb-abe1-42010a9c0039", "comment": "Malware payload (DarkComet)", "timestamp": 1620214053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214053, "uuid": "b45f1c81-1289-41a1-ad38-8e0f16348f79", "comment": "Malware payload (DarkComet)", "value": "db08908582b5fadec29d5ea3c91b954a", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214053, "uuid": "8d9bb135-806b-4c75-8976-6a8d05e4661c", "comment": "Malware payload (DarkComet)", "value": "6f08293219654fea6c04ef20b911c4b3d28029ae32b9bcfaa7278df56a059ede", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214053, "uuid": "473b6c8e-ea26-44a9-938c-6db54bf8e593", "comment": "Malware payload (DarkComet)", "value": "fedaf416dd8019a55657d8321d70e2d09c98c595", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214053, "uuid": "9119788d-e191-4854-9c10-2cdc1b895485", "comment": "Malware payload (DarkComet)", "value": "2344b8a31ff8892e1ef073efb2804aea25f4fc7fb534f7fecbe5871b2ecfa9eb8c963d8b4158f4ac06f2a862db6941e3", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214053, "uuid": "9f1ca48d-fc2e-4948-9a72-7a50028c88fa", "value": "52E48E31F1808837D97219789C5F92E6982A7E202E39754B3AE62F4C5F3D6C239193D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214053, "uuid": "759d2710-84e4-49b4-85a3-b180bbc28f00", "value": "e5b4359a3773764a372173074ae9b6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214053, "uuid": "e48e4977-0d9d-4edc-b4e5-aaba290ff67c", "value": "12288:e9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h9:qZ1xuVVjfFoynPaVBUR8f+kN10EBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620214053, "uuid": "fbe13ab7-3c70-4c3d-87ad-530de5da3553", "value": 674308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620214053, "uuid": "dfec0b33-2b67-4eb6-a702-249a5e5b15c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214053, "uuid": "647150d8-5879-4502-9b2b-ca407e921b01", "value": "1yyoRs4y38XZvNF9YQAk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f9691b-ad85-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620207339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620207339, "uuid": "26d12421-d34f-4789-9800-f6c192933a28", "comment": "Malware payload (NanoCore)", "value": "5ace51f858e8451fe9051c0d95244832", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620207339, "uuid": "20dd0205-b046-450a-8544-69a067d96ad1", "comment": "Malware payload (NanoCore)", "value": "6fb27e9cc7184cffe0e14323fab01b962f53c845d4b751f7655dd4c5c5d10982", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620207339, "uuid": "e0d32845-9b94-446a-9951-919cde80702f", "comment": "Malware payload (NanoCore)", "value": "0b8605656ac8e4b861abd3a42c6544146dc7ca5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620207339, "uuid": "e25e1dad-2cf8-460a-98e8-3977012922e2", "comment": "Malware payload (NanoCore)", "value": "9ecdd9884066100906f633da3a5f4e5d138add375bf0ca74385ed885401f00d0598037da0d3ee2b9c09f5e6fa79017a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620207339, "uuid": "c716b11d-80f4-4ca4-aaa3-12fe7dc02a12", "value": "4B5412045B289CDAC694057EE9B2512102F9BE62D805FF9EACC0F1FE5E5239093D7A36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620207339, "uuid": "91945504-a339-4413-a82a-29e70403bd03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620207339, "uuid": "bfa988c8-e0e0-415e-9345-dba26b9077f4", "value": "6144:P9fRQCfresxaKWHEkQjoRyYK+c0eS5O4DAD+Y2t7iSayf:7rRxaKWMjSdc0eS5LAD4mS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620207339, "uuid": "2505fb5f-05e2-4cf7-9d89-66b837d32e6e", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620207339, "uuid": "3ad5406f-9c31-46fc-aebd-7fb2a7da489b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620207339, "uuid": "972ca27a-5ad7-4828-9f10-9d132c06ba31", "value": "5ACE51F858E8451FE9051C0D95244832.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2da51f6c-ad81-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205589, "uuid": "46f8c650-7277-4a02-bd7c-181b84c2b0d6", "comment": "Malware payload", "value": "5e5edae2c38bd19f80949ae4a625c84c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205589, "uuid": "b538f080-b4ba-4934-bf4d-a45b4477a55f", "comment": "Malware payload", "value": "6fc10a0c4d6cc08f11d15deb74a88533c85f01507efb8b8375e859910fc7dd76", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205589, "uuid": "09b94905-6e24-4d8e-8cc6-a05f21e45025", "comment": "Malware payload", "value": "68ee19698b2b4162b79f8a8be6d6abf5e325c63a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205589, "uuid": "55af58ec-e60b-462f-b17e-cd873fd7fa1f", "comment": "Malware payload", "value": "90cd8f850c31685e1021b58a8a97d6bc3bfbb8d5f5d6c3cc75d0a434c3a00d013ece6293ce23c63549f5a4cbd9a7e221", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205589, "uuid": "aae005c7-4a96-45bd-ac29-751ab0911a49", "value": "046501B3F18EE82EDD41B7FE2902A874414D667D881B4C243598368F46FA1546BCFAF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205589, "uuid": "84e0979f-9f46-4b9b-8892-fee340ee2266", "value": "306e560dd9f33b63de7ca984572298a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205589, "uuid": "eae63cde-e159-433c-8e0f-f32677200189", "value": "24576:cUYOSS8SuThEfrqrIGTDvKRO9LS+WOTr+dPCL+je4EJJ:sgurIq9vZTr+oCmJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205589, "uuid": "ea262f24-cdb1-4e32-badd-d44eacc49cde", "value": 1462784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205589, "uuid": "a2330541-a549-4d0f-8906-7c593f5691cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205589, "uuid": "e59bf526-2465-4852-9a0b-07b5e5d1f1b1", "value": "5e5edae2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c01db397-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241912, "uuid": "d08f2d43-e0a6-40fe-bed5-79216418df97", "comment": "Malware payload (Dridex)", "value": "2bbe50cf3d84390cef330bc357b2bb7b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241912, "uuid": "7a0fc987-ae25-44fb-8a85-0561ae67afeb", "comment": "Malware payload (Dridex)", "value": "6fc89f8a00355cc81a950ad7ef41467ab8f9025ee1a9beea72b069ac99f80c0a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241912, "uuid": "54922679-a6aa-40ed-8be3-197f3c43cd6c", "comment": "Malware payload (Dridex)", "value": "86ca0b05b6b579b1f4b5a7ef100b988d9e387788", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241912, "uuid": "54e66997-bf38-47d7-a75b-f298d05ca620", "comment": "Malware payload (Dridex)", "value": "1daebe93c2da707a81d0d2abc182a0e63cd6ec831e6db1e7178ca2126af83cddd97592ce24d8219368a6e5f080ff0af4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241912, "uuid": "010f9c33-29d3-4ca0-bd3a-4df9037b7027", "value": "EAF3C085DBABE87FC44A35399071DFFB5B388B145250C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241912, "uuid": "32309e0d-b921-4ac7-8b4e-194b3adca830", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241912, "uuid": "e16db215-35b7-4902-88d6-fc7e0b66a506", "value": "3072:7A45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:k4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241912, "uuid": "90f8ce9c-506b-4976-8622-22f2d3a273f4", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241912, "uuid": "5096d770-3f4c-4ba2-9ff1-ba8981c1c9af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241912, "uuid": "5e893b73-ed24-42c6-9670-affbce498979", "value": "2bbe50cf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8655bd1-adaa-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620223511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223511, "uuid": "6e23a9e4-055e-48a7-9d3e-26edc96c33d3", "comment": "Malware payload (Dridex)", "value": "9828502d6b277860b507d1e55b21f4ef", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223511, "uuid": "e69b9489-7b1d-4072-8367-06546b6dfd20", "comment": "Malware payload (Dridex)", "value": "700acff6b8a3f98599b37dc666e9cdbdb71b5c32b13c8e484bbf7983e14639d6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223511, "uuid": "22b4a26f-43aa-4dca-82f5-4d75eb7bbeaf", "comment": "Malware payload (Dridex)", "value": "7e202d0e8114429101ff7274709455aee214ad1e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620223511, "uuid": "635648a9-d154-49a2-ac9c-47535a3222c4", "comment": "Malware payload (Dridex)", "value": "364a06c937a9e95c634fd127fa5d136cf8a0edad29033778109d1c96cb50aebfa7be77f07ecc241bb62b5c5c20f8581f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223511, "uuid": "66c69f46-b4d4-406c-87e8-009888aacbdc", "value": "B1F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223511, "uuid": "c0c6fe3a-a3e3-459c-9c47-749c12eed2be", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223511, "uuid": "d5d50bb7-2b7a-4664-959b-58e2373b899f", "value": "3072:viFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:keAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620223511, "uuid": "6503e0a1-b64e-442e-a2fb-ce0bd48299ab", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620223511, "uuid": "07b05703-40cb-457a-94bc-08100a72aafc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620223511, "uuid": "538bf0f5-2100-4aca-a3bb-510e60c841b7", "value": "9828502d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b4753a-ad80-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620205406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205406, "uuid": "ba1f8e30-89eb-49f7-be50-0963342d060b", "comment": "Malware payload", "value": "d8af382756ed6a4403e4cc4251b92563", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205406, "uuid": "f06bcee6-3b4f-4a2a-8a4f-a5deed60b13b", "comment": "Malware payload", "value": "701838d130437cec1c4b7c2a829a3baadc53de03bdc1e97e4f2abec61e988aa6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205406, "uuid": "ac416874-dc9c-4870-a164-c4ba703ee022", "comment": "Malware payload", "value": "b15cfdb01f6350a9d608fc5a4737425e55750e29", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205406, "uuid": "9d2b0df2-ece5-4ddc-b6ab-85a4dba5ac26", "comment": "Malware payload", "value": "3d17881272cd61fbe42e14a6f2326695dda39a602d6f4dbb9dfdb3d56a36b6dbdee72dc4f5229854519caccdc284c6a8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205406, "uuid": "a0ed7254-e788-4f67-949b-ebd277cdfbc4", "value": "FCD4ADE6A4218E1CD27C5335301A6897DF28F3EB2E84B8C73BC54195766AC49DB87D0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205406, "uuid": "df891465-6b7d-4577-b616-1feda1438412", "value": "466f060853812bdd32dc3d7bc75ca96d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205406, "uuid": "3fd1fb98-97ab-48b1-8e03-533a0ea3f505", "value": "12288:GTcgC/sr77tt9hbGybAmbqU6CGze25vaPjMcsFNmM4Z77xWJQMXye7ZIq0keKYsy:GTcgC/sr77H/qybqU63e2A5sn5UATm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205406, "uuid": "b6bffed6-ba7c-4f19-957b-cacc4bd3b091", "value": 640512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205406, "uuid": "806608ca-511a-4588-b5b2-e15a533558b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205406, "uuid": "bb8d7e26-6315-4b9b-a320-fe0cd0159a92", "value": "d8af3827_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0284d38a-adfc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Pony)", "timestamp": 1620258345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620258345, "uuid": "b66b52a4-1ef3-431d-bd59-36b758f3795f", "comment": "Malware payload (Pony)", "value": "2a9c04da476059544e45cf520ef98318", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620258345, "uuid": "2916ca30-e76f-4a9d-9f54-1645aab4a03a", "comment": "Malware payload (Pony)", "value": "70487b89100eb4368c0147b2177b8a921a1053b231fc62a45be99667803d0d74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620258345, "uuid": "e2f24e77-6eb1-44ba-a67b-979f22cfed40", "comment": "Malware payload (Pony)", "value": "0a9b522f2d1d866e63b4956b08f5dbad906f091f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620258345, "uuid": "41eb414b-feee-4989-b1a0-24e06e636f05", "comment": "Malware payload (Pony)", "value": "ee4ea553e7858f8582b2f2e62452674a77c0f63aaeafe5dd3276097825151fe5597552301700107ee14145426208336b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620258345, "uuid": "70a7fd3e-0cfe-4c23-aef8-098436ea9df5", "value": "6B83F803F4D1E0F1D0A2167627C127B1F3FC9EB97D768D4AEF9C55856DE2286AB12012", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620258345, "uuid": "2480e7b4-d4c7-4f20-a10c-f0fd7500e4d6", "value": "88beadee8be3a02ce03d3f55f08c8251", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620258345, "uuid": "e5d475da-d7c3-45f0-89b8-001bb3f1aea2", "value": "1536:v8mz9eFVu5qTw+JFxwDAz0noZbYh4B4tMxE38/KsQyneXTvYkzbTTq/F:kmJyVuExCA4nLLMU8jQ2qPq/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620258345, "uuid": "0c391f1d-b657-4a61-9347-0b1410705866", "value": 86528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620258345, "uuid": "6f698f68-4a91-4e7f-a74e-6aa105f185e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620258345, "uuid": "225c0748-96d7-4dac-a100-4388cf700daa", "value": "70487B89100EB4368C0147B2177B8A921A1053B231FC6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "539f4b84-ada5-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620221114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221114, "uuid": "663b97d5-25ef-473d-be96-3d5ecab7b017", "comment": "Malware payload (NanoCore)", "value": "74fad1c4df7a0bf97a2265952900b127", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221114, "uuid": "781c3d46-b5eb-4976-bca4-db345dd92037", "comment": "Malware payload (NanoCore)", "value": "704c8cbba29816992cf47c9d5ae71eb251814e4df4ee3e55ea77cd48644f3dbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221114, "uuid": "72744204-5b8c-497d-9e6d-07ae376ae4a2", "comment": "Malware payload (NanoCore)", "value": "1a60b77fe20960d09eaf63253d346f5d058d0966", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620221114, "uuid": "3a5653d1-ae3b-40fc-84ae-6e34ac155b94", "comment": "Malware payload (NanoCore)", "value": "1054f1539ed2bf74baa3d41b875473a32f3e4a2c63e1ecfa5145f6bb415982faf19c5b0723145d3e0f8e159a4914f5b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221114, "uuid": "e7aad89c-1f05-4ecd-9412-34afef6fd2c3", "value": "1E450123BF584927C66D1DB488B503C0DFF1D115225AE30F2AA4547DEEC6BC62F06ADA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221114, "uuid": "1b610e87-e00f-4b77-844e-5e3c2b01efc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221114, "uuid": "2f883319-0714-4068-bf54-d6cf50c638f5", "value": "24576:W2iRqSLC9p5RYRIIC+3QgHqhThN+yw0PRja1dqWPx:9oLCvkqG3QOOdux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620221114, "uuid": "7e0d6fba-6736-46ab-ba50-5d60b920269d", "value": 1273344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620221114, "uuid": "e4589134-6983-4ebe-a5e5-b5d8de2de9a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620221114, "uuid": "c241626b-b882-48d0-a468-e599e38ed162", "value": "74fad1c4df7a0bf97a2265952900b127.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf61d43d-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620212705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212705, "uuid": "5fc57527-d8c2-4d62-acae-0de641cd8fb7", "comment": "Malware payload (Dridex)", "value": "c17c3d709a11c6914c99e6951f1358a7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212705, "uuid": "6a39a650-13a3-4027-9df2-7d4eb51626ac", "comment": "Malware payload (Dridex)", "value": "7054d9c94adbf728ac2e04d676eece8060f51057f43eefd25a2b461fec617646", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212705, "uuid": "91e87721-823c-430a-b7a3-662e63d1ce94", "comment": "Malware payload (Dridex)", "value": "4d5b50ec4e8267048fc39cdcd587d4696110a92a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212705, "uuid": "95e8ef9f-ee4e-4834-ae04-c94f3e59389f", "comment": "Malware payload (Dridex)", "value": "cd97873a60dae60c6683d0128bf6fe4ab4d59a4815e1b530aff4c402aa3846c26c40a2c74bbe7d022978a5a90ae9fc22", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212705, "uuid": "fa36b28c-a2e7-4d70-a9c1-fa75bf3353d0", "value": "54F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212705, "uuid": "1639feb5-3b7a-4c9c-8b34-71d383dcb34d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212705, "uuid": "134730ec-15fd-499b-aeac-e69ad7d09958", "value": "3072:5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212705, "uuid": "4b0ee04e-c640-4a79-b5b2-e29620a4114a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212705, "uuid": "e9266553-a28a-43f4-979a-4cc6151f94d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212705, "uuid": "ff3ee072-3259-46e6-91ad-b2e3306a533d", "value": "c17c3d70_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc3e73e-add4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241370, "uuid": "9e1ac309-378e-4d2b-971f-d97e0a0e09dd", "comment": "Malware payload (Dridex)", "value": "ee34585a6be846221ef94e3007026b2b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241370, "uuid": "f0b8e31a-9621-45dd-a068-44cc1f016301", "comment": "Malware payload (Dridex)", "value": "70b3d0eaf9c262067d8060d2294c5eef2af7b5013ec28fdab7c463ffab70ef4e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241370, "uuid": "ec28a30e-9123-4bb4-a595-979b449ec9b7", "comment": "Malware payload (Dridex)", "value": "aa09fcf9621b308310a6ee355b1ff549ee15303f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241370, "uuid": "36e4a9ce-a8f3-4eb6-b434-747b1d89310b", "comment": "Malware payload (Dridex)", "value": "f8c881257c06d1c70b7905fa88eec05c86deac12530201f345c06d80d71c9210d509f485ea8441a5063d47c22d7cad4e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241370, "uuid": "a60d4e20-5bf2-4184-be4e-04720869c2f3", "value": "6CF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241370, "uuid": "1a8571ec-ebf1-49de-80fe-bf11032fd2d6", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241370, "uuid": "2a5838f0-f39f-4cb3-b804-1a97d9807188", "value": "3072:Blpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Blo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241370, "uuid": "5d29f215-0952-4017-852e-f866b2d65770", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241370, "uuid": "0bf70e8d-c2a4-42b9-b2f0-497a2317d06c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241370, "uuid": "8e7cbce5-149c-4a9c-a222-c601a5ded389", "value": "ee34585a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff6d10a-ada0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Matiex)", "timestamp": 1620219095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620219095, "uuid": "7b89585a-6ef7-4ff7-abb7-1fb0fcaafb1a", "comment": "Malware payload (Matiex)", "value": "9941b30db8a7c185c5517e5d7431487c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620219095, "uuid": "26898af6-5586-4b7f-8e56-715aa21ded84", "comment": "Malware payload (Matiex)", "value": "70c9114d4bbcf58ac5746da8054f628a84f50d811d838c0ce89e37f165fa8889", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620219095, "uuid": "113dd256-7188-45d5-a1c6-f025dd53b116", "comment": "Malware payload (Matiex)", "value": "fc7667156a2674d8ffcf947287690e9d16371df5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620219095, "uuid": "e0fe3299-5d1a-4891-af70-f4ea6c0cd6ac", "comment": "Malware payload (Matiex)", "value": "a7084192a4f462c4b907f91f8eb3cd9f752c502f7864070d9988450b83845596bdd481b03e7d22c3d2b27048ed1c35d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620219095, "uuid": "8ea6f2fa-03f5-4983-85c4-236302be5239", "value": "55F4235939842624C63ED2BB116A41D01370E20B9F0BC7167DAE56BC9CFF782CB91B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620219095, "uuid": "7fc98774-5ba9-48b9-b772-206772cb0e84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620219095, "uuid": "30028edf-b32a-4fc3-802f-eecb96928eaa", "value": "12288:RkM/MgruTrJkEPJ4ntAvzuq8SilsGGbFccDjNoQR7D:yyMtFR4ntAruq8TlgnNoQR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620219095, "uuid": "5e6cee78-7096-42d9-88e4-1f1e33e064c9", "value": 748544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620219095, "uuid": "64cb20c6-ba0e-4ef2-88b2-f524795ad241", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620219095, "uuid": "fcacaad2-76d0-4230-b754-b6b03340a10c", "value": "9941b30db8a7c185c5517e5d7431487c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be249a26-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252646, "uuid": "75040caf-8d6a-4df1-bc7d-1ac8a961e3d4", "comment": "Malware payload", "value": "efcadc974812a322738fe6f0e56e9241", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252646, "uuid": "877131bb-835c-42e5-958c-11d420887c56", "comment": "Malware payload", "value": "70e90868da23d13e5d5d240ad2eed4e832456cdd2e427aae67092f52139bd300", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252646, "uuid": "4ad18d69-b044-4306-b1c5-d15c362817d5", "comment": "Malware payload", "value": "4d20e366495cdf9338cb3de0f6aa03318c7ec44f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252646, "uuid": "700033e9-d63c-4b88-a467-eb07405be86b", "comment": "Malware payload", "value": "06bb0ad6f99689a162aa46c5b9d45cd7e7034b273dec6b5da71574694c805f6fbc934fe86316a48e53c5ff4b702a55b2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252646, "uuid": "c38e17d0-d825-4884-a8ad-4cf0daa96bae", "value": "AEF3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252646, "uuid": "5600a857-5fd8-407c-a226-d0237340d8a3", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252646, "uuid": "10526d85-27d1-4e99-9ebf-2ed424b0ecd7", "value": "3072:XK4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:5DBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252646, "uuid": "9a3f0cd9-2676-4361-a828-71e156e9826c", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252646, "uuid": "5294ecb6-487b-4ae8-9ed4-d038017d188d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252646, "uuid": "cd329c38-c123-4981-8b79-d9ce25f933fa", "value": "efcadc97_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "446aa1fe-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241705, "uuid": "0c0ab54a-37f2-4f52-ac24-d90504a13f46", "comment": "Malware payload", "value": "e3a78f79fa504b29d299267ca5180d49", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241705, "uuid": "a3530693-b1e0-4d6f-bd92-b7f3e0f3dcad", "comment": "Malware payload", "value": "711115745ac4bfe0932abef0fc033814cde49012512e3ec3ff8d112e8139634e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241705, "uuid": "fe7fe4d8-9b9c-429c-8e79-5175942c4b7d", "comment": "Malware payload", "value": "ce68488fc17111add268bafefa0901f90ef63674", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241705, "uuid": "c1ea8128-8140-41a5-9bc6-3b2f28baa35c", "comment": "Malware payload", "value": "68df0e73e309a43a464760a518329f60a3bd4c8aae11c409ceff0dcb919331fbaf9f6589d3f389686a47ec5479b24e37", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241705, "uuid": "66270dff-7467-4274-a1d9-c8381e22153a", "value": "5CF3C085DBABE87FC44A35399072DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241705, "uuid": "8d470fef-9c4a-4b9a-bf03-b8fee3af446d", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241705, "uuid": "58c7d13e-d78a-41b4-a61a-b4ebb9ca2c5c", "value": "3072:W545bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:Y4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241705, "uuid": "cb90679e-494b-4c44-8284-16d4b890da22", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241705, "uuid": "c06f48ae-5a3e-4bdd-a288-8f42d1c6fdcc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241705, "uuid": "beaae349-78c6-4da6-acbd-7720f89bc9c5", "value": "e3a78f79_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf3ec11a-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252246, "uuid": "6c5171da-a025-4592-ac2f-9c17a0c8809d", "comment": "Malware payload", "value": "76fd6dbbd39eadfeadc5b3b66c528b69", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252246, "uuid": "d6709f6c-8c0b-4291-adef-577d7f370d04", "comment": "Malware payload", "value": "71d55eff1bcbef8ebefdbe0da19869a22a0968f16c37bfa49cbe31d70c464774", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252246, "uuid": "a35c6808-9b93-4b2b-b15b-554edd2d7060", "comment": "Malware payload", "value": "910d61cfab6160cd84f5b8cdfc318f3a851d6f84", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252246, "uuid": "09c0d2e7-1d2e-4b08-9837-7f54d62d3a76", "comment": "Malware payload", "value": "1bcd6e8da36d88b37ff043791cf1ed232403c8413a08230c78aa3ecc96e64c8bdd3eae1659cda9150f315c3f5521de57", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252246, "uuid": "a7fe1e21-daee-4344-a968-2d2583941e0b", "value": "51F3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252246, "uuid": "8b335c47-3e47-41cc-808d-700a8317cc25", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252246, "uuid": "d32ace23-c0be-4146-a28f-e11fb2bae7fd", "value": "3072:Id4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:ZDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252246, "uuid": "ed54494c-3d19-4e9c-80a5-25346110fb7a", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252246, "uuid": "1331cfb5-0bd6-4af6-9f96-e20f5402c74a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252246, "uuid": "5e596be7-14f5-42ed-bd3d-458547b37500", "value": "76fd6dbb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22c0e2d2-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload (Sality)", "timestamp": 1620201705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201705, "uuid": "baec4f5a-c800-4424-9579-524ee97275c0", "comment": "Malware payload (Sality)", "value": "fd2a937833bdc0470389402139a7b44b", "object_relation": "md5", "Tag": [ { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201705, "uuid": "776fe1e3-725b-4bb5-85c6-7e124fa5ff2c", "comment": "Malware payload (Sality)", "value": "71ed493c4e9ccafab61103f900b151659da8222d9982f007d013134ac615b52f", "object_relation": "sha256", "Tag": [ { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201705, "uuid": "d71ffce6-c41e-4311-9db6-c4ce77fcfa22", "comment": "Malware payload (Sality)", "value": "ed240df74abfaab82251a921940380a05696eae5", "object_relation": "sha1", "Tag": [ { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201705, "uuid": "966af15c-c294-40d1-b0da-d65926382ae4", "comment": "Malware payload (Sality)", "value": "6b720a5b42890d2c0d75a40a9b46104da992a5608b757d9d17fae3f38ba4134a4f92d4991b57fcf4b879e0a0640f49bb", "object_relation": "sha3-384", "Tag": [ { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201705, "uuid": "9038d518-818b-4843-af71-d323fa539b73", "value": "EA052302058FC18CD196AA37217B5D5BAC7FB8840B1B43BA16C55CCEC63A761ECF971A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201705, "uuid": "f82a546d-89a4-4534-b8da-2985f6614bfb", "value": "092eb6daba2f17cbda102fd1a32acd00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201705, "uuid": "97a78646-af74-47a0-b828-4b852529e5a5", "value": "24576:EYrpmmY0Vm+CupW/0+dlTcknzosoeEwL:EYlbVVm+nWRl4I5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201705, "uuid": "2de40cb0-45e1-42df-9a16-63a93f185708", "value": 845016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201705, "uuid": "b7ff0830-e362-4fa0-ba02-4ecd3e687d34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201705, "uuid": "afc74618-ce4f-48e7-b7da-bfe5977f3c31", "value": "fd2a9378_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "438e3df9-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620208632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208632, "uuid": "d61826d7-5bc5-4e4b-ab13-72da329f1f06", "comment": "Malware payload", "value": "b4ff3961cefcc5e151e319666bae6f5e", "object_relation": "md5", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208632, "uuid": "c8c77860-4cb6-462c-b148-e4b2595afafd", "comment": "Malware payload", "value": "71ef590b32ef90a021be7bafd074b7698ffefab7f935e371568bef5eb2543f19", "object_relation": "sha256", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208632, "uuid": "543255a0-3937-4195-b227-c2fa25253cbd", "comment": "Malware payload", "value": "e1e985a90a116edea41d99b3e2a85a697f760d48", "object_relation": "sha1", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208632, "uuid": "b5387452-ce6a-4f50-99a3-0e9de8ceee41", "comment": "Malware payload", "value": "8310401676798950cce35c7ac7cf0db36ca9aaba3d71d49daf1884a7742b19550de2edb7d5cf5344f8588a3161705be7", "object_relation": "sha3-384", "Tag": [ { "name": "Linux malware", "colour": "#2CBC11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208632, "uuid": "0f47e8be-8fce-4842-acd5-b147ca7fb504", "value": "CFC45C06E243A2F7D82705B0128BF7BF4630F63584529DC6B7949E5AB9338F26A4D353", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208632, "uuid": "05e18875-40fc-472a-a0b7-e93c126c9db1", "value": "12288:VeRvuKqiVZ4En5drNK0pPEfJKlHZ8mG97Qxee6yzmx:VIv/qiVNHNDEfJKHZ8mG9QeeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208632, "uuid": "b6de4e97-b293-4fd6-9a7f-be17725836b6", "value": 562240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208632, "uuid": "032079eb-6e7f-4809-9914-89c6171749c9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208632, "uuid": "94469aba-f3cd-4515-b5bb-fdfdfede84ff", "value": "71ef590b32ef90a021be7bafd074b7698ffefab7f935e371568bef5eb2543f19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "591b5ea4-ad63-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620192777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192777, "uuid": "ed67875d-25ea-4156-bc0c-f352f966833b", "comment": "Malware payload (AgentTesla)", "value": "94c23db7f44b472e45e0fc6235bff71a", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192777, "uuid": "042c1bd5-84a7-46af-b1c5-c86090128fa1", "comment": "Malware payload (AgentTesla)", "value": "71f1031f8d456492618aaa6edc187d4da9cfc670e336e3a3f10c841e922c71a6", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192777, "uuid": "10af7cbc-08d2-4a43-b2be-f87a8d4cadc8", "comment": "Malware payload (AgentTesla)", "value": "57a9a166961554c508d3804b513c995791eeff3b", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192777, "uuid": "6af86125-0c2f-4f01-9ec1-6792246dd366", "comment": "Malware payload (AgentTesla)", "value": "a63f0e65ab132859e3ab5ee1978c173ee1a982f3df95b824c5f1b7f8e66bb3580c7026acd7ff1287da9745d7749105dd", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192777, "uuid": "e0357950-e9d0-4803-a5bf-3228c6d604d5", "value": "9CB4231171F9A19870EF2874FD983A1D3D60027D9FBD069A7C7A4C1B08EA6507EDA837", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192777, "uuid": "cedd144c-5f42-43fd-bd61-db0677ed0bbe", "value": "12288:C6C3fO20g+gVO1QUz2Q4p4oBB4N/t8CU1uvZfWA+wPB2s/x:C6CogVOWs2Q4ao6iCvZ+A+Mf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620192777, "uuid": "2cbad880-03d7-42da-b319-8a592c7fc263", "value": 516904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620192777, "uuid": "7bab9d54-4b11-42ae-9582-cc91a515ece6", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192777, "uuid": "dd84f067-5ab9-4583-95a6-e6da64d34f70", "value": "Quote# 40346.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221b0e69-ad95-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620214159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214159, "uuid": "f2a38a5c-0808-4bc1-832b-ee61d17aa3c6", "comment": "Malware payload", "value": "11ae52bd9c6a338582892d1a0e565269", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214159, "uuid": "236924af-69bc-4aa7-a0f5-5b80d3357233", "comment": "Malware payload", "value": "720ac949e6743c94b40a02c010489f57696122431ccd4d9ab7a3eee00b8f7a77", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214159, "uuid": "87ee4f95-2fc8-4198-8561-b5bebc8547b4", "comment": "Malware payload", "value": "3b29f297c2abe8208da5071724db6361348d0d17", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214159, "uuid": "81efa21e-de0d-4f40-813e-ae79b49f0cfe", "comment": "Malware payload", "value": "c1c3d6ac9c9f39b066a34675ef3bfef70062a12243e9fcb2a8f17d347024bed5d1c3a96d695f6806f86add58d1c4387b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214159, "uuid": "6ca16cf6-03e0-4565-b66e-b07ca04b3a58", "value": "BD64131FD62B7E8AC0AE1B3CD6082CD6FA0954B85852FE46137B9B743AA3443E7CD454", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214159, "uuid": "f68b7c04-bcd0-4da4-be36-7b1fc319dd58", "value": "6144:+K01ohVSozdKp9YPfFCdpzHodVlbVxFbZ7C+6/SJciWHjri8KFgmgq:+K0USoZK2dcHExxFbZggci+riwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620214159, "uuid": "e467c78d-8bc8-4bf7-a905-3ea871436232", "value": 335366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620214159, "uuid": "9b387f74-8cb6-4246-854e-8456749e1803", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214159, "uuid": "b78df450-d1a9-42fc-a283-7cd7cbeffa52", "value": "B06CO4I2G0u642m5Gi6R.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ed1439e-ad95-11eb-abe1-42010a9c0039", "comment": "Malware payload (CryptBot)", "timestamp": 1620214127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214127, "uuid": "c1a9c85d-4079-423e-8cd8-fbeb355346a5", "comment": "Malware payload (CryptBot)", "value": "e93a68bc0e34d9fb8d76345379215b85", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214127, "uuid": "bece3f14-0f61-4c6b-b48b-ed7916f64ad6", "comment": "Malware payload (CryptBot)", "value": "72263e12f9edd11806a77c99a41569ed4acc043873cf8bac45974426e56b4652", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214127, "uuid": "56f8f462-ce34-43e5-ac5d-41f882ad9485", "comment": "Malware payload (CryptBot)", "value": "c5c105c21e408b4a8b79a10878f25e71825a4d57", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214127, "uuid": "79081308-c04f-4a3c-952c-bad1d4b80a61", "comment": "Malware payload (CryptBot)", "value": "d767d997b495a0bd93ebfac105f307f55982a6cd336d23d01df3315bd48cbbb30e286fa5bb7ecac4abb1b97ab334aa7f", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214127, "uuid": "cd58fcbb-ee0f-4b6d-a7c9-7c3a968f0732", "value": "20E41221729CE332C1D71131495DFB9BAA39E9306B50C8CB73CB17695F299E02B3661E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214127, "uuid": "c3d60dd1-b874-48a7-addd-d18d85f07f5e", "value": "ed15c1224fd33ba1eeca9dd246bc116e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214127, "uuid": "a3a8aa02-cdf7-49ef-9b56-1b714c59dce9", "value": "12288:4MFBUZXV+5osFCcynTCgU2QunejubM9ekenl55zT:4ciXV+5oskFxWuejcgekel51T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620214127, "uuid": "cbfabf17-5748-46f1-99bd-961650497438", "value": 679428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620214127, "uuid": "9b537315-d0d5-47e2-b69e-45d407b4401e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214127, "uuid": "a6a7da39-a40a-42ed-b8e6-0fc6fb3ed0e7", "value": "69KVWczH7Sk3t1fZmb5O.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b64abfd8-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252204, "uuid": "3f5179f5-f084-44bd-95df-633d7527fe8e", "comment": "Malware payload", "value": "8b85346d0e6d75dc3c1113c9b801afc7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252204, "uuid": "f7707e94-1991-455a-a52b-6850156fab98", "comment": "Malware payload", "value": "72306c6457c918bfaa19009cc21ae5eaf4bfad936e8694482c719f6f1c0c0266", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252204, "uuid": "bf5202e2-cc10-43dd-b4da-f1cb9fd2346d", "comment": "Malware payload", "value": "c5e2b84d2bd0f05649f5c33ef0fc76167f91946d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252204, "uuid": "f20441d0-6f57-438a-995b-c9cd7af34452", "comment": "Malware payload", "value": "7b6440c81507a1a9d24765db0f8cd92af50c0245a95f21555022c0629124c6a031974648b714206c145f84d72a95a82f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252204, "uuid": "217ac3e9-1c8c-4dd2-95e6-b4fc5a10ac31", "value": "51F3CFE89A9FC097E663583055FF3BB6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252204, "uuid": "36b5b638-d6ee-4278-94e6-023b34b6c382", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252204, "uuid": "f62aa122-b400-41b1-8f1a-6d5001e914b2", "value": "3072:/f4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:oDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252204, "uuid": "1e8031a1-cac6-42e6-8cca-02d89f656515", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252204, "uuid": "ebfbed9c-e657-4d48-ae72-663805cac6b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252204, "uuid": "468d7d95-c6da-4b7a-a956-e619cbd8b8d6", "value": "8b85346d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ebea5dd-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241776, "uuid": "9ea8d8f9-48fd-4ce0-b4a9-faf6d441cc34", "comment": "Malware payload", "value": "dd0efd5f80f3417f88894fde21f8d45f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241776, "uuid": "f4ea3a2a-9c3d-433a-a1be-9b69a33d2982", "comment": "Malware payload", "value": "72554713b062c4e4e2dd94781858dfc2d9b0572cdd5cbe9739529e1014cf4b28", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241776, "uuid": "c5bb8471-c7b8-4e44-b03d-b9d0a09a2a51", "comment": "Malware payload", "value": "f9a127e9c30610b23d6f5e63bbb82cd104d3d9e5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241776, "uuid": "c1fb8563-55cf-402a-9e16-209bca0f7a5c", "comment": "Malware payload", "value": "0f80373950253fa51bdfc38c4dd0db15b011e0041168eca19d147c9584dce63b6100ce89f9c1477bfb93bcabdb6cdc0f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241776, "uuid": "0f3fe06d-8bad-4252-89d2-3aacbef4fa57", "value": "97F3C085DBABE87FC44A35399071DFFB5B388B149640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241776, "uuid": "4e7f668a-262a-43b0-ad45-aeccbde75f4a", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241776, "uuid": "a1df5731-15d0-42c8-bb90-2121c878bc1a", "value": "3072:KY45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:d4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241776, "uuid": "ae409e6d-4719-4ac7-afe7-f34fdc028ac2", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241776, "uuid": "a50072a3-2e88-44a4-b089-645aa380a0b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241776, "uuid": "0e5a7dff-8ce7-41dd-9456-0e0d87d5f48b", "value": "dd0efd5f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed41855-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252138, "uuid": "22dc1694-ab54-4548-855c-0b06a8a75aeb", "comment": "Malware payload", "value": "1c6ca3e8799284bff19bc6e3c4ecb0e9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252138, "uuid": "f42d8cd2-96ee-4ce0-9588-f968fc964eac", "comment": "Malware payload", "value": "725bcbde17ca87cee195c2dc32abb67a36b23f3973ed94e3042795cf851772f8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252138, "uuid": "75c4a74a-b695-4f7e-945a-5967346364b2", "comment": "Malware payload", "value": "e917fbf84cb81d1d24ae821f5096a0940771d31e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252138, "uuid": "ce7ef923-d1f1-41e3-80dc-715767cbe08f", "comment": "Malware payload", "value": "2b8ce578a3700d48fbc14e3a80c0621bab8fadc4fff11c5ce56d0615a362648c86b6a7524922655add09beb24d932cd0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252138, "uuid": "27e25e06-131c-4c92-ad17-d896b4ded86e", "value": "77F3C085DBABE87FC44A35399072DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252138, "uuid": "73277db6-e313-42b4-b0ed-d1ac5e69010b", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252138, "uuid": "5413347c-0b00-4f65-b7f3-0134a8d52b7d", "value": "3072:DF45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:h4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252138, "uuid": "9d1756c7-d110-421f-85dc-a6aada091d31", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252138, "uuid": "2942f799-468a-423d-ad6d-e61dacc0ab37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252138, "uuid": "419369a7-e8bb-411c-8d50-3be41837ca38", "value": "1c6ca3e8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a739e7-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1620212578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212578, "uuid": "56e4ddaa-0241-4257-9cd4-ab39a18e523b", "comment": "Malware payload (TrickBot)", "value": "4ca16ae7e2edc8cf644798d3233cb3c0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212578, "uuid": "a46bc19c-bdd9-4363-86a0-9e7232d15776", "comment": "Malware payload (TrickBot)", "value": "727364e49deb58916defdce48ae970b76ded4f326e30d56ef713fec6abc8b0e6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212578, "uuid": "d9dd50e7-8fb2-44fa-8865-a2b71f9ffa0e", "comment": "Malware payload (TrickBot)", "value": "93e51bcdfff261381a252045179bd3eb42532b73", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212578, "uuid": "e1ac6c0d-7f3b-4a2f-84a2-6925bd98c1c8", "comment": "Malware payload (TrickBot)", "value": "c57375e0798c8cbad88f2daa85660c3cb545453c8bb9da0d1c7de7c4dae202621c0de79ac3bdc8e2830599360000fcba", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212578, "uuid": "ac37121c-1818-49d9-9e1c-368b324dc2a2", "value": "65842379CE613F2876390DAEDAE323C19865331D9587DAD02903B8571D7DEA0892F2F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212578, "uuid": "cda28be7-7584-4461-8931-693c204358a6", "value": "6144:kuC86eFMDtqvoA3O1ffdQgPioVjqHea3oIns1MY4vIs28CyNRYmqStca1A7Jq9AE:Z3itVOKffGgRe+a3oInesBTttm7JCNLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212578, "uuid": "910cea8e-1bd4-4c2a-b2f3-db5adc3314e4", "value": 378556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212578, "uuid": "95fcb42c-71cb-48c9-8bde-5898d1ca0757", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212578, "uuid": "b0daa9e6-04ce-4abe-9404-7157dc5a6b45", "value": "4ca16ae7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ee536f-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620201712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201712, "uuid": "a3511c15-0ed4-4652-ac2a-a49ec76c1c27", "comment": "Malware payload", "value": "2329d3ac89a6c4e4c9cfada3d51f0fb9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201712, "uuid": "f7b088d6-d96b-41c2-8bdc-d7d75a0d916f", "comment": "Malware payload", "value": "728406539dbbb175ad0e0f346d6c9e563c7b95507e91c71af64f220a382525cf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201712, "uuid": "5a42c427-41d7-4036-aac7-8720ae43ade6", "comment": "Malware payload", "value": "d01bdd19bae05494688d4e187ae06b2f8c41f1ee", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620201712, "uuid": "65caf67d-da10-45d8-a0bf-2062e3986f96", "comment": "Malware payload", "value": "34408452a5a7e305cd5cac81fa3c6e76b7b3b07b15f1ff4d8f2ded787c3ce08da11743b657ca37afe21770ba427635a6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201712, "uuid": "35d7dbe3-e500-490c-8ef4-ee74889e6aee", "value": "41D4F142A773CFFAE9B5EF3A8B415DA45A5AD82F58075FB432492E1885F005C3329378", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201712, "uuid": "9a39ff02-495c-44aa-a30b-8791a9236116", "value": "638cb8100f67276d659948f516017043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201712, "uuid": "508d11e0-350d-4166-8ebf-2f209fe4c230", "value": "12288:lk/OObyKVLYPkEpeuEDxtSlq7Ao/eafJ+W08kPMBfgBKvpkIs:sOOFW4Taq7AgOW08sM5gBaps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620201712, "uuid": "706eca7f-0234-4a4e-8c21-6e1b7203bec9", "value": 635904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620201712, "uuid": "1ba6d781-f4e0-4390-a82f-ab9c69480e9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620201712, "uuid": "d6f70503-e66f-46b3-99a0-af3587076775", "value": "2329d3ac_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "124439ec-adb3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620227018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620227018, "uuid": "b43ab1ad-7392-448f-a8ba-8063963401d3", "comment": "Malware payload (Dridex)", "value": "626faf98a465ebec6de2a51dbb161d09", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620227018, "uuid": "e6e34e48-1a44-4320-a7fc-60be2e63345a", "comment": "Malware payload (Dridex)", "value": "72faea3ffc8bbb0463ff91ba122b2cbb7b5d6d856944c8c47f594fb6b3622520", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620227018, "uuid": "9f66b2d0-500c-474e-8018-c74b65058462", "comment": "Malware payload (Dridex)", "value": "7db771837080ce44096719ece11f61f4dc2fb465", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620227018, "uuid": "2e72a31b-e066-4da6-a202-72ad045394e9", "comment": "Malware payload (Dridex)", "value": "8dfe7fd3a93c897f509adef61c7ecf8dbf7f0d335b0f1421da5e5937b9f09c4143227beecc24c4e18261deb0535547d1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620227018, "uuid": "d8f376e3-26be-43da-a754-1d06c83039f2", "value": "58F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620227018, "uuid": "36a48db4-8e7c-4cfd-948a-3d972e9a8a11", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620227018, "uuid": "396bcae8-9e42-4cd8-aa45-6c7bee88682a", "value": "3072:OiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:FeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620227018, "uuid": "b27ea465-abb9-4518-b6e1-fa34bc23233d", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620227018, "uuid": "c96d3eb7-1b06-4046-9cf8-6f9329a982cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620227018, "uuid": "81f12bda-61ba-4b91-829d-4a092124be20", "value": "626faf98_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e7a1fbd-adf6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255895, "uuid": "0fa7c6fe-8716-49c5-99d9-2fa210ce3e36", "comment": "Malware payload", "value": "09014d2a9ddcd1bc138a8752df0ebfc0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255895, "uuid": "b1fa92d6-e6a1-4a93-ba8e-c1f60e19ad78", "comment": "Malware payload", "value": "731e51f6c69b2a683713d8bbee2424be6780185af6de8c9c25c8a345505d58b2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255895, "uuid": "863f6398-b319-4fe2-8610-392d820d6214", "comment": "Malware payload", "value": "1ed2f31aaa30d5b18b94db69e3cfd68834febce0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255895, "uuid": "86538d5e-9cf8-479b-b2f2-8b4a7321c31e", "comment": "Malware payload", "value": "4f4441174d0554aa75b5c02477c2320c93a9b09a2e2fc5871db776595b4828d24f63d0c9ba71f65d51cd7ed4850f53ef", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255895, "uuid": "e1c1147e-9e8d-4f7f-b3a0-4d5f16d5322a", "value": "28F3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255895, "uuid": "65122853-ff4f-42e8-a5b9-67efe3fb8d33", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255895, "uuid": "f977a35b-aa0d-4aca-a2b9-28601b1ca677", "value": "3072:Ld4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:SDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255895, "uuid": "3239ef8d-0eea-45b4-8505-e2957f0b764b", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255895, "uuid": "3a3aedb0-68de-4b05-b43d-4f88c0b32eb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255895, "uuid": "d6d84f3e-c331-4b76-9f05-7a685f93d0cb", "value": "09014d2a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23314ce3-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209007, "uuid": "73a43ac0-1623-4656-8b76-cf54daac7f94", "comment": "Malware payload", "value": "e11408974011148d11946f60305ecea9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209007, "uuid": "27ca43c6-ab77-4461-9622-0f67a1b75b4f", "comment": "Malware payload", "value": "731f212e53a0f41c33a8294f64468c60dd5cac990d3e2de43c3fb18127afb406", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209007, "uuid": "32caca1e-7407-4b3a-ad8a-8344fd6124f3", "comment": "Malware payload", "value": "e4fb4f412bc35a230429f8c310ba2130215f83c3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209007, "uuid": "f018689f-777e-48ec-bf83-7222c3a591a9", "comment": "Malware payload", "value": "953c1c3640287bbe53b529db30b2434fef4b352623ddb28e5dba177aa85e890b5d9264e016ea727dd0fdb200ecd87f69", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209007, "uuid": "ea11c6fc-0674-445a-9eb5-f9a229e34d67", "value": "3A65016C8B6A05A0E3C5ADF0B6CFE87CA5522E16164CF61C9D172B3E4F807ADD34641B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209007, "uuid": "e2e769c1-fb04-48ad-a796-77c10f27107a", "value": "bcd1baf20a1859f1ecb5d438e80b0489", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209007, "uuid": "dd96db0c-db29-411d-9183-789746098772", "value": "24576:GUqpco7PqMjncmHXAV2yy4pOF/OFI+gjlAI61+6lwtVwRfgAgeweWJxNfv7eGywq:GUqn7qCn/XAoy5G8BOHew5VvSGywN+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209007, "uuid": "0b8e4e85-5f14-49d3-bcf0-eedf04468b55", "value": 1461760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209007, "uuid": "25711787-440a-4b39-b0f9-1f4f6a3c2cf3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209007, "uuid": "b49c870c-525e-4f7f-a656-105a16d05aac", "value": "e1140897_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c93f513e-ad89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620209286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209286, "uuid": "a2c19317-6515-4ae4-a841-83449bed0a27", "comment": "Malware payload", "value": "75c584f55cef85e30e15ab8413af0c65", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209286, "uuid": "5ba0cd74-5bb6-4742-b250-b9d13cee7428", "comment": "Malware payload", "value": "732320e7df67f64d118dce44157b95240d5cbf7a2db10c004a5e73a20d034399", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209286, "uuid": "8ec27541-f627-499b-986c-f5270a710e02", "comment": "Malware payload", "value": "f125b467c5c9398443ac21d832b9b7759ed5b889", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620209286, "uuid": "ca6fd973-01cc-4230-8ae9-e4f81aad8a77", "comment": "Malware payload", "value": "1fdbe9b71b13f89e32f4cc8f733be7df95e16bc7215968802381f092f7cb3b917304b4d7ca86942a1c902e6647767936", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209286, "uuid": "a97b1e97-4a56-4af2-8c38-65e428870601", "value": "71F48C20C00C54BAE67CE4B23BF2A5244C551AF4CB49349776F26D21B96E857FF6E328", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209286, "uuid": "a2807e9e-2125-4c1f-8f49-d7e8b6b203cc", "value": "ac62c7ac20802c7720e58661a0a5643f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209286, "uuid": "528b31d2-5b77-44d5-b451-fdc60bf3431d", "value": "12288:eItNUGs3qkesrMsLxYmBBnSiL/LnUj31DL6nS8TVtnwnhRwUbyTm:eiNUGspksLxYmBBn1/LnUjJ2vTfnwnRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620209286, "uuid": "8661438d-813f-47ac-856d-4dc31471b77b", "value": 769024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620209286, "uuid": "cfc0778b-3b93-4189-93c4-9c6bbef8972a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620209286, "uuid": "e27550f7-ff74-4664-a1f0-d1afe86e49c8", "value": "75c584f5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02b59746-ad81-11eb-abe1-42010a9c0039", "comment": "Malware payload (Ramnit)", "timestamp": 1620205517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205517, "uuid": "c33ea878-2f6a-484b-b1f7-dbabd1fb9d76", "comment": "Malware payload (Ramnit)", "value": "bab24f0e7184e137e6621e732e9da30a", "object_relation": "md5", "Tag": [ { "name": "ramnit", "colour": "#6E87D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205517, "uuid": "7b334d9e-5b3b-4194-baa2-b6882d2acdc5", "comment": "Malware payload (Ramnit)", "value": "734098da5181ec0da88f41dbfb9711ee9001a2b86c1c9d15d3281cdcaddfdeed", "object_relation": "sha256", "Tag": [ { "name": "ramnit", "colour": "#6E87D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205517, "uuid": "3c64bad9-ed85-4f81-a300-401e16961b15", "comment": "Malware payload (Ramnit)", "value": "94bfed80b2abd9bbe365cfb18ca519bdedefb442", "object_relation": "sha1", "Tag": [ { "name": "ramnit", "colour": "#6E87D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620205517, "uuid": "60963ab2-9411-4cbc-a237-51bae88f0953", "comment": "Malware payload (Ramnit)", "value": "fa0f8a7351148de4e7de0beab5cbcb55e717d748ba557bc4df545feddb549ce1c9df51dfc359e38c20301756e8b771e4", "object_relation": "sha3-384", "Tag": [ { "name": "ramnit", "colour": "#6E87D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205517, "uuid": "eaf86514-aace-489f-836d-ab42fbb18012", "value": "907446B9A00EB9A2C0DF853413D599E1D7BF6C9107B041B96A708D65C6508BBF32D2EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205517, "uuid": "551347fd-cef7-4e51-9fef-d5fa663598b3", "value": "a9b4893dc16c287d9c4d9d0dde885f37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205517, "uuid": "9ae2cc12-23f8-4b19-a505-ed4ec6b4eefa", "value": "6144:plYi4Ip8DqDFpgROrl811u5P78bbsBbc1to:sRE8DqDFQyacFgb4bYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620205517, "uuid": "5d45db2f-1421-4d05-b106-858210417d8a", "value": 359833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620205517, "uuid": "19aac4fc-052f-4865-b122-c62d03eb615d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620205517, "uuid": "0020c382-e4b2-410c-a4de-6fa6c1c72e4b", "value": "bab24f0e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc38f13c-ad88-11eb-abe1-42010a9c0039", "comment": "Malware payload (Downloader.Upatre)", "timestamp": 1620208942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208942, "uuid": "e3def353-0d17-4595-8a03-54d09857b42a", "comment": "Malware payload (Downloader.Upatre)", "value": "dea0e56e4ce2fafb80ace3b818eb44fe", "object_relation": "md5", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208942, "uuid": "19a1cab4-df5e-4d61-a3d2-01df7f5edc78", "comment": "Malware payload (Downloader.Upatre)", "value": "7393f83f5d24d5c64e2c0298133f5052404250dfda167591019057b574ed8d1b", "object_relation": "sha256", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208942, "uuid": "f84e0223-a0ab-4e56-9aee-ee57f41dc755", "comment": "Malware payload (Downloader.Upatre)", "value": "ce252a12317c0d0cac83b87a76db375baf05cb94", "object_relation": "sha1", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620208942, "uuid": "4760fe0c-5d97-40bd-a9ad-3ee8c1c4c47a", "comment": "Malware payload (Downloader.Upatre)", "value": "037eeb7a18d28c4896e4b7e17bc1e071d8fb33fd5f9a5712245b1f5ad1682436e4cd58650ffc88e13c5fa8a9f9127f30", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208942, "uuid": "8477f850-43d2-484e-ab75-2f36d681412b", "value": "08E15139ABDA1577E3B78EB2C2F2A9C7E531B4213D02854D41420B090C23F52EDA9B4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208942, "uuid": "a1cac6e8-f989-4a61-b312-d0bcd4849708", "value": "cc40fefa3af5cd00cc28dbd874038a4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208942, "uuid": "3f0de994-aa41-496a-8ddc-5e7f11dd0de1", "value": "96:Z0v4mUWKh9ctgC1RhvnKymV44ShDAyBJ0CeGUAyUL7qKoTgiZ:9mUWKs/tnKfzShkgUAyUyKo7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620208942, "uuid": "3f12a640-f8ae-4b94-bb9d-f00d5e95ea5b", "value": 6918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620208942, "uuid": "deeb00ff-9234-4799-8fd7-e29c4641830b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620208942, "uuid": "77c7481d-9ae3-4f54-9713-1e5932715a42", "value": "dea0e56e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f9f4a0-adf6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255775, "uuid": "0e47a50e-2539-4411-a8ef-6b57c4cfb43d", "comment": "Malware payload", "value": "43ebfba9dcfaf6dcdc9578e8801785b8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255775, "uuid": "934e0554-d7d8-4723-9e11-304d35f61782", "comment": "Malware payload", "value": "73e1acb829c4c15d8b3b58d6ef893d131623581c41f7f06148fca11d0c9eba54", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255775, "uuid": "fdfb76a8-6641-49e2-8e46-1a913df7905e", "comment": "Malware payload", "value": "96c648948d2f09aaed8ec3b45abd4d0754e62c51", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255775, "uuid": "ea51e93b-ca2d-43dd-8eb1-908f1d536c50", "comment": "Malware payload", "value": "7c59ce1dfbc2f2f2ee839b7dd06864662d4cb9f1dcd6b65bb89dff08f06141512ebdecc3b583db48758c1947188f2862", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255775, "uuid": "d42f7a14-0810-4b97-8732-a19f54c61626", "value": "85F3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255775, "uuid": "6972ac4e-ff81-4aa5-801e-3168b7ed33b2", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255775, "uuid": "851730af-d6f7-482c-b3ba-965820f6a550", "value": "3072:Ee45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:x4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255775, "uuid": "6d26d9c4-c3a3-4b42-8a7e-ed3d0ef9dd3d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255775, "uuid": "328fffad-a244-41c1-b5bd-c5d1cb387576", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255775, "uuid": "5e85a9d4-c655-4628-acde-94c89d8ffeb5", "value": "43ebfba9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce1c1de9-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252673, "uuid": "724cd936-d6aa-4e2b-bd86-775d20cc9461", "comment": "Malware payload", "value": "5c355e0e19ef388ab01dfe6fa6c94090", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252673, "uuid": "3bfc9ac0-59a2-410d-a68e-750cbcefb983", "comment": "Malware payload", "value": "742e0a9c1ab4e5f6e69ff8d203977579657d983baca330cda3c337153d04eccb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252673, "uuid": "08dd16da-a102-445f-88f2-92fd8168db6b", "comment": "Malware payload", "value": "9e2b9cec33313cb1008c12b96915973bb647b596", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252673, "uuid": "cd954ae4-9c6a-4af4-85cf-1b1eb5d0fc56", "comment": "Malware payload", "value": "84cadfb4f1e0d1e7179065aa898252868f7198d32e64bcae2638fb8b0cbf8493be1fbb77da7583a5a7f2626a4eac7557", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252673, "uuid": "9013d5f0-39de-451d-98af-4dd966beb078", "value": "4DF3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252673, "uuid": "f7e34935-c64c-446b-9852-925d89d0d701", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252673, "uuid": "dbebc350-34c9-49e3-9fbb-e84be0b2bb77", "value": "3072:eR4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:rDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252673, "uuid": "27899c1f-7ec7-4b77-b769-93646178d4e2", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252673, "uuid": "13d75ac8-a565-4f34-9009-02a81641afbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252673, "uuid": "15a23f1c-0de4-4876-927a-1c03b6c073cc", "value": "5c355e0e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b2ec222-adcf-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620239059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620239059, "uuid": "bb8c5ab9-84f4-4459-a39e-2530347864fc", "comment": "Malware payload (SnakeKeylogger)", "value": "ad96213196331afa54a2881f6f0f5996", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620239059, "uuid": "5ff8192b-2b86-46d5-9d12-c489d783c4f3", "comment": "Malware payload (SnakeKeylogger)", "value": "74780175d8231ad9e60d49dad720501f7cab5fe5d27ee8c44d8e3b2e416c7eeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620239059, "uuid": "1094d93e-8ccc-48f9-ace9-a9264b2f498a", "comment": "Malware payload (SnakeKeylogger)", "value": "fab2ec9f29dc39456e63274700f18557db4bfd99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620239059, "uuid": "175b389a-503e-43c4-a048-434de0e47dc5", "comment": "Malware payload (SnakeKeylogger)", "value": "101852af1a58a5730d3c963b9a6c64bbad756084954d45f98576340a7576fe3d72f806dd46059361daf177e95f5e3707", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620239059, "uuid": "d2106b21-fb89-4e41-b2c7-a98885a29af8", "value": "0CF4123C26A86A56D87E877D2578C0002BF0B63BD773E30DBFD066B76B227518621671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620239059, "uuid": "4165a82c-4ba8-4ffd-bf2b-c3030678cb93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620239059, "uuid": "5193f651-9962-40da-8a6b-de26f412c548", "value": "12288:LNuzk6pSH0/C3Z3iL/AtdTH7wM1WGbv3i+SVEjspls3bwSfSlO5/CJEHy14uOp4T:CSH0/p0xHH1DSNlsrwSfSgoydv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620239059, "uuid": "2409d3a7-16eb-495d-87b8-71cd74af9146", "value": 780288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620239059, "uuid": "592454fe-ea53-4902-9aa6-15eaa0b4cc5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620239059, "uuid": "25f20660-411f-40ef-a59d-bac5957e7a2e", "value": "comprobante de transferencia..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4f2224-adc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234091, "uuid": "ca592e70-2614-4c69-bfc7-859f55d09aaa", "comment": "Malware payload (Dridex)", "value": "44c2cfff4d52192c38c630399128858f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234091, "uuid": "0adadbf4-c122-497c-9039-bedddc427bd6", "comment": "Malware payload (Dridex)", "value": "7478d11cd55336bef102b6ba8f3c5b1e8be14f101f6923f51eee7dc544dabeca", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234091, "uuid": "fa580280-fd19-4d9a-b51f-2ca21cfca48b", "comment": "Malware payload (Dridex)", "value": "c14919d3daba64881830e21fdd58b985db1f6d59", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234091, "uuid": "2829b621-b2dc-4c3e-b82b-6761b6b839e5", "comment": "Malware payload (Dridex)", "value": "9b2ef1f9593cf37c332054c1c7924ad9d051696360d12c11d36df8477115bc273e93914db2b14098610162b261afb586", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234091, "uuid": "b80ca098-5b2a-45ef-8c9c-eb604a166a8b", "value": "55F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234091, "uuid": "0e4eb4b1-4a47-4c57-b55f-f92cedd364e6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234091, "uuid": "b92ef175-5adb-4873-86c3-88b85f7f2cc3", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234091, "uuid": "ba8a805c-4e7f-4602-b294-e8c1ee55e38b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234091, "uuid": "061165ee-16b1-4408-8a45-9ba38604f0ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234091, "uuid": "cbf8f425-e564-4d6e-95f6-583261d044e2", "value": "44c2cfff_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb9b836b-ad47-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620180997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180997, "uuid": "5a0c1726-7838-4af6-bf48-bfe41210d344", "comment": "Malware payload", "value": "87a21ef5a452d4c51b5bfa18e188fe00", "object_relation": "md5", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180997, "uuid": "681e2bd2-4bc7-416f-9f84-55e5d7070f15", "comment": "Malware payload", "value": "747c4bb97d6414329655483305d2e4040120424ebb14fd8e76787fe890de4f4e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180997, "uuid": "44bcfbd9-9d5e-47af-86b1-9147eeb52d50", "comment": "Malware payload", "value": "09d262ae1addf4d49b23fef5c4ad5c7595118d64", "object_relation": "sha1", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620180997, "uuid": "2490d9a1-4562-4a4a-8a6c-6e69ae44c6ef", "comment": "Malware payload", "value": "543ffe7d5b3b9b95fb5fc22060c1904d34243ef393e482c8e733aa00cd827bddbccc7c8f65da1fb386ec0de7176a2c49", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2021-1647", "colour": "#D87A9F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620180997, "uuid": "777f0e10-d914-411e-b33d-7f01ab27929a", "value": "CCE3BE88878AD8E7D4E37EF12907B06A4653DD6D50E3A8D536DBFE2C3031591088DBA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620180997, "uuid": "d736c989-537f-4e51-b26f-fd274a707e01", "value": "84245f630674d6573306664292458cd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620180997, "uuid": "54aa5191-42db-451e-91d8-4e0e0c72b331", "value": "1536:+3icGgKEuISZ+SsxcWRMyEWr4S6knM+3ltHxr1P5zdOjApjVSyz4VeP:aSCcWRMyEWr4S6AM+CkpjoVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620180997, "uuid": "39190c6f-9f95-426b-82c0-a43bb839f4e7", "value": 156160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620180997, "uuid": "f010d0d8-af24-47fc-a91d-85ceacb0d3e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620180997, "uuid": "6872d5a6-4b6c-4a63-b260-dc7700e773dd", "value": "747c4bb97d6414329655483305d2e4040120424ebb14fd8e76787fe890de4f4e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "377df37d-adf6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255856, "uuid": "6844234f-0204-4f17-8a99-9b764dace443", "comment": "Malware payload", "value": "94bf842ef64994f9f2738619f0fa3571", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255856, "uuid": "8dc9ea6b-a305-4627-8183-052221ac029f", "comment": "Malware payload", "value": "748e0b01fb4bfa43769ab75c1eaff7e4cca0994be93180c78e99f14c6805da86", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255856, "uuid": "8cf9122e-6b22-4d49-ba37-9f8584543327", "comment": "Malware payload", "value": "2d44c1dd46a040c852d83c1288e50b3b08cff03a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255856, "uuid": "0124c24b-7308-4b92-b0aa-55f34b5fe789", "comment": "Malware payload", "value": "7d62370527d5f65d67d1a10d44d396eb12fac93ea9a6b9894eb195acb4185e308c05ff8d98356d26113caddda3ab98c6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255856, "uuid": "e687876d-d087-4ccd-aaa3-774dab339ea8", "value": "0DF3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255856, "uuid": "b8b0659c-70ac-4e5e-a991-a25de2c258f8", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255856, "uuid": "141c3480-0bd5-465e-a72c-1cefbad05df3", "value": "3072:4d4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:pDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255856, "uuid": "b203d7a6-f1aa-4494-bf52-68d295a4098c", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255856, "uuid": "ea029095-23a5-4bfb-8daf-d6e5436bac78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255856, "uuid": "8f8d2601-4835-4af5-a990-3374ef7f126f", "value": "94bf842e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7abfb847-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212590, "uuid": "810acc79-d3ce-445e-ae4b-43201d92035d", "comment": "Malware payload", "value": "e8d8d2cb809674275e397d3096ee0e3b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212590, "uuid": "9e333a52-1409-42ed-9ee4-051a731ba483", "comment": "Malware payload", "value": "749ebfe548172995dec447360ac2dcbc53db826c674fac2a8d39c2a44dfecb12", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212590, "uuid": "b1afd926-5e86-4e90-a944-4632cc8b4faf", "comment": "Malware payload", "value": "0a7f8d3ff4d7b22bfbfcaeab6191f0be0644ccd9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212590, "uuid": "89463471-8e89-4c89-8aee-b0d8232d5caf", "comment": "Malware payload", "value": "d4a80731ad33263e9fc3e3c5846591c3c717d25f4aaf69c5e1148f70f35fc9b25f2ea6927fbddb009355f2090fd286e7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212590, "uuid": "99033215-c227-4685-9501-3240d5eee910", "value": "D7758D5DB2A540F5C6AFC178C91B890FF7F13849436496EB02A15B5A2F277D0CA3AF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212590, "uuid": "473a79df-7d4e-4fa7-894a-301c2822ec60", "value": "db469bb3aaf1156758357e3a6bb0f090", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212590, "uuid": "8c1578fd-e022-4e87-9438-14b561710be3", "value": "49152:XPujn/TJQ1NLlSqrU5tUE1etEtLlWiTHfeiEA2RQ6zHvyRWMzTi:XPcn/TJKSb5tN1etEtLlWiTHfeiEA2RT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212590, "uuid": "3417337f-a33e-4adb-80bb-a572ac4ae73d", "value": 1631590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212590, "uuid": "36afe6b6-01e5-4220-80f9-87921e23336e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212590, "uuid": "1fecfaf3-1f87-4ab1-afe9-2b2cdb207788", "value": "e8d8d2cb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a13d3b2b-adc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234130, "uuid": "9ec74715-58e6-45ae-8f00-1219454c7f35", "comment": "Malware payload (Dridex)", "value": "da87b3218d0dfa9e222a07a4b9c6906b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234130, "uuid": "6c8d61d5-a26b-4139-a45e-30f76bb458c6", "comment": "Malware payload (Dridex)", "value": "74b4d6f842d6985adea7d6fabc25c8e12cf6c0cd273c092d347c6f77201236da", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234130, "uuid": "9221cc11-e8b5-4fa6-a714-c764c87b8378", "comment": "Malware payload (Dridex)", "value": "01055c4266e17797512610751a82e61a9cfee383", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234130, "uuid": "8bdf8403-2cbd-455c-92d9-d9985fb1bfa3", "comment": "Malware payload (Dridex)", "value": "37c54953ab6d8f07af5146307fc933278aff76afeb706bbc9f5833ad791f65661c29d510ab07a44963c826468efc41f9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234130, "uuid": "8830075b-7fda-40a4-8da1-e32a7034106f", "value": "86F3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234130, "uuid": "56bfba61-d7a4-4edc-87b1-c6a58de4623d", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234130, "uuid": "742d23d1-a2f5-49d8-bec8-71bd4a3f13ad", "value": "3072:Nz45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:d4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234130, "uuid": "1a4a891f-e91c-4a0c-baff-f7b134b5fb6b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234130, "uuid": "e61bf746-592d-4138-afd8-469bf992a0a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234130, "uuid": "223037ce-d880-4e18-879d-1dafc03f619a", "value": "da87b321_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f1f72d-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241595, "uuid": "3df06647-e0f9-4ae7-b927-9a5839cbceb0", "comment": "Malware payload", "value": "6a20d8217dd9ba92434867077a66bde6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241595, "uuid": "5727e66c-a0ba-4a4a-b16d-4c904244cf92", "comment": "Malware payload", "value": "74b9495df8b160b8cb40bb7826d6f1c09dbc418eae091d92fda1d3c8e5f075ab", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241595, "uuid": "daf86275-df9f-4252-b478-466f1bcdc14e", "comment": "Malware payload", "value": "32ca4eea1a9b7b4c3edec184de1e5289419c2ed2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241595, "uuid": "6e6a6d17-7a65-40b8-a764-0b365989049c", "comment": "Malware payload", "value": "66f5f663e84981360f02c2a59b7b2bbb041d80951818509970b6c0cf65a9113a2713b1f45d7f78cd4c2583b1a9dc9d81", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241595, "uuid": "d9a1b895-5207-47e2-8964-3949735cb9dc", "value": "1BF3C085DBABE8BFC45A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241595, "uuid": "4147ef60-075b-4cb7-8ccf-7c3646074b00", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241595, "uuid": "7a79f5a3-2476-4855-ba09-0b10c9e3e666", "value": "3072:Cy45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:v4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241595, "uuid": "18630b12-64dd-4fbc-8f34-954c9b5cc1f9", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241595, "uuid": "a61d1f7b-fa39-4cf6-850f-69986fa67165", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241595, "uuid": "63f4ae78-f240-428e-9993-3a54903e6077", "value": "6a20d821_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d4beef-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241603, "uuid": "0ca9c0e1-dee7-4eb4-aa92-65ef0781bc00", "comment": "Malware payload (Dridex)", "value": "28220c9a200b1af24cea1ea172c5feac", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241603, "uuid": "6ff1c0b1-d4c2-41c8-a6e7-04f04fc92c72", "comment": "Malware payload (Dridex)", "value": "74c09102f1beb972daa6d50c51cd4fe10895cf19ac48f7bb1ca06a9e2285f5f0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241603, "uuid": "c8455082-6557-456a-b2ce-593120652c28", "comment": "Malware payload (Dridex)", "value": "c6f16f114eb30f592d8667c6c7a8375c87b2b719", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241603, "uuid": "6aee0ec6-5c92-473c-afeb-90df16e7fd38", "comment": "Malware payload (Dridex)", "value": "eeb770469f072e439fe23d1a767ee11f39341616ffa9e76eac0bffa3b6f2b56ff35aebfc66e3e3a86a302bcc4425091d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241603, "uuid": "8495d887-3ff3-4f8f-9011-f60633d05d92", "value": "5CF3C085DBABE87FC45A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241603, "uuid": "69bb8107-75c9-484e-8287-043572d1b439", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241603, "uuid": "95658348-8587-48dd-b984-48613624335b", "value": "3072:bx45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:14KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241603, "uuid": "731e0b7c-9e51-47dd-9ab5-a8fba82ff0b0", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241603, "uuid": "01ca3095-b288-45d3-a7b5-5a4750bf871d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241603, "uuid": "d28959c8-425f-4627-a2bd-82b67559336a", "value": "28220c9a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a19445d-adf6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620255834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255834, "uuid": "8bb13937-6061-487a-b465-fa8c285b5694", "comment": "Malware payload", "value": "a3a504c25ce239686bed1dca3231482a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255834, "uuid": "f030deaf-77f6-4e0b-af98-35dae42d4898", "comment": "Malware payload", "value": "74ebad772244fe30a1607bc6feca22eefc138c9ec9b34ae100f7ae34ccb37170", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255834, "uuid": "784663c1-cc05-44b0-8231-105f01bf6040", "comment": "Malware payload", "value": "8805857ca61d208e868bc2cc5004eba88fe8a05f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620255834, "uuid": "c1e3fecc-6864-43e4-8580-0eb175607e02", "comment": "Malware payload", "value": "d9adf3b2dd9fc7fde28a88da999f47fb0eadce925ec179b80887f1405165947a549951bc212183c61b85c3a15feec2b6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255834, "uuid": "b0fadaf8-904a-42cd-9b5f-9e72ef067c7f", "value": "40F3C085DBABE87FC45A35399072DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255834, "uuid": "c1b51f3c-f713-431c-ad23-f7b776e0b098", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255834, "uuid": "a358d970-38a7-44f4-a60a-edb609294e02", "value": "3072:VF45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:D4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620255834, "uuid": "3126e69d-7c35-4f91-bcef-df7dd4459998", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620255834, "uuid": "a72ecfb9-ecd9-4005-9334-e6f7f39e9d55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620255834, "uuid": "46f3b7aa-8258-4f6e-845c-ef54dc382674", "value": "a3a504c2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8898081f-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252557, "uuid": "0c214731-10bd-456a-9b3f-ca46b3af4316", "comment": "Malware payload", "value": "9d3ba101222c32465bc45a3798aa2fd5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252557, "uuid": "fdb28a89-4137-4e76-89ab-b10d7f4b4387", "comment": "Malware payload", "value": "750b117df51407bf374eda5ebfa183edc0d93c739217517b24614914144de742", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252557, "uuid": "ff33f1ae-e3ac-4318-b718-59620c16dfc6", "comment": "Malware payload", "value": "071281f991467419ff95cb4988fe86159277e292", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252557, "uuid": "f9a70f49-7879-4ec0-9501-a4317c94d459", "comment": "Malware payload", "value": "6cac220810ce5bb28501f2234bc2d8884bb00abfe94b94c21378c1259dcefa5075ffdcc6671dc74edfcd008001895620", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252557, "uuid": "38983a90-a229-4f19-a822-f221a7795833", "value": "91F3C086DBABEC7FC45635399071DFFB5B388B149240C870EB6969EFCA07B510816883", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252557, "uuid": "775f8e71-3664-436f-9e7e-66202d3210d8", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252557, "uuid": "4246ee13-b08e-4fff-b2b7-ccf6d20a723c", "value": "3072:RLDbscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:REcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252557, "uuid": "55a06756-1d96-40ca-97fb-1c324344c19d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252557, "uuid": "f67968ff-95e0-4dd5-ac20-c1b7e7f1b71b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252557, "uuid": "3b396e07-bc8e-445c-a55c-48c258ee3efa", "value": "9d3ba101_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e99505af-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620202039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202039, "uuid": "29bf7e24-3109-44de-b5ef-9764164e5c1d", "comment": "Malware payload", "value": "1c76800f9c0d5d45f1d26bfc1f8265f8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202039, "uuid": "bc6a01d9-459b-4cfd-88f0-04de847d2751", "comment": "Malware payload", "value": "751f8b351081ff6b1d7134e75dd93daee4e3bb2df6c4049c8a7175bcaa899528", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202039, "uuid": "2a6624fe-9cd3-4317-a76e-1349348a1b87", "comment": "Malware payload", "value": "179908ab5e6189a5ec43a65753b66d0cf052e5cd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202039, "uuid": "99168c37-e3b5-4664-bae9-cf8f424c42c3", "comment": "Malware payload", "value": "a70d78eab266e27b432a40412e1549edf16e43f2841ba89f6c0c92f99a4d94f52fccbcc8dca6d31d437755038feb5d15", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202039, "uuid": "617094a1-16c0-4c78-9e67-e90f300ce86a", "value": "72D4F1ADE73F0E53E99C53B6E4E41025266339432519DDB5FEF6C470A222B442133E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202039, "uuid": "4ebf7e29-1ebf-479b-b6f3-1f16947f1de9", "value": "f1eba9a838ceda7617f3eb94edbfc3e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202039, "uuid": "75370d5c-e521-4daa-b0e1-49253fc3b619", "value": "12288:BmSWlNoV+KtoCAMIs5xj1vbcvRHROuMHCSn4Jqldtuy4r:ASuHCAMIs5N1QOuMHCS4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620202039, "uuid": "eac6047f-5dd7-4931-b909-e04bcc9bf18f", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620202039, "uuid": "31be3ed6-b45c-4628-a169-d9ca2aa450b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202039, "uuid": "9fbe622f-9459-4324-b96a-d4d5c96e2658", "value": "1c76800f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6862193e-ad9c-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1620217284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217284, "uuid": "da3b7288-efbe-4b35-ae47-1c28c3f42353", "comment": "Malware payload (NanoCore)", "value": "322acea28d5d3b6a4172d4ff76350629", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217284, "uuid": "f48ad054-0897-4448-ab11-d04e21a0a43f", "comment": "Malware payload (NanoCore)", "value": "755fede7240f600d66e808cfdc6e6cffaed4405eb07d139d632e4e8319929bce", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217284, "uuid": "886a723c-bca4-41a6-9677-cd492cb9b30b", "comment": "Malware payload (NanoCore)", "value": "8be86c9d66a374e7918b316e30a49f9b665df037", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620217284, "uuid": "03e2b108-f95c-45f3-aaef-0aaa1adb2990", "comment": "Malware payload (NanoCore)", "value": "0f715a68357239e2dbc22a24ef2b49f9a8b020f80b66388fe8896a39a4d5e3b39e13530da6150f7c09ddef24080c2065", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217284, "uuid": "0f79553a-a988-4f25-82c1-5816b25dbfbc", "value": "59C52B8473CD2B1CB6AAB345BEBE805A4D2FF8B19737E65E8152631E3336C489641371", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217284, "uuid": "bdf807c4-de77-4168-81f7-76eecae52f2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217284, "uuid": "5b948ca3-d5fd-4e7e-84de-cb8abbd53ae2", "value": "3072:EH1v7epldV1119NwDWTEu885flkfaDCMxAfP6bokxC18WWfCfAJ8Wa5SELHfSOXO:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620217284, "uuid": "4e06125a-240c-4961-ab6b-5b9a728dae55", "value": 2664960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620217284, "uuid": "c66fce48-3b0d-45f4-8538-d1ff66a63ece", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620217284, "uuid": "3b24ba76-a167-4007-b1bf-1e19ff5a5532", "value": "SecuriteInfo.com.Trojan.PackedNET.703.6905.4475", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b51969f-ad9e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620218148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620218148, "uuid": "13e3eeca-b8b0-4c6a-a3c2-c64194428e99", "comment": "Malware payload", "value": "88125dbe8c15bd254962b8bbfa82df91", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620218148, "uuid": "24e33244-9858-4006-b194-d3bda389a53d", "comment": "Malware payload", "value": "756d0b7c72e13c2d4b4ff16010777c710e42a0a61e8667451cbf9b3bb05e7f2b", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620218148, "uuid": "9dd7d38c-e3ab-4b0b-986d-c0c8649043d7", "comment": "Malware payload", "value": "40f18b94d5615c6a82542b79493c514fcd0e1806", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620218148, "uuid": "11f68cab-ff85-4048-9c1d-9f91a1131340", "comment": "Malware payload", "value": "2974291cedbd3be0bc3b54494802a6121b6cc06b9bae5883effcd71520424212053164fa2413426d953630fd233f8632", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620218148, "uuid": "a6b6d737-bc0b-46c1-af7d-c3f0a3857b69", "value": "61E4333EDD6C0229896686E84372F7FD2DF0D2684B79833675252D9E527C0E3352AF09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620218148, "uuid": "823fa78d-6436-4b03-b282-e86493ae3111", "value": "12288:+C2XtYKgtm5SPNWb2y0uQiz1MGrwGycUBfbhIZQhJrDCaA6w858lL14/NMa0:x2d64S8KyLQCHrwfbaM1DAU8E/NJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620218148, "uuid": "abcb9475-ff7a-4db8-9077-0871ce6f5569", "value": 670018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620218148, "uuid": "3297121e-417e-450f-a1bb-dc91ce701abf", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620218148, "uuid": "2e60c960-486f-41ad-b9de-53efb6ddd9e8", "value": "Acknowledgement JMAX060708 \u8ba2\u8231.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "422e8d50-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252438, "uuid": "aa2f931e-04a7-40e4-9570-72f62760894e", "comment": "Malware payload", "value": "397ce8581bd87e914317f855429332a8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252438, "uuid": "7df056e5-102b-492e-849c-1c65ad17ea90", "comment": "Malware payload", "value": "757d7f01074fcc1a3fff6e66fff111ced70db896a0ac39436bdec4ddd75b7cb0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252438, "uuid": "cd9ef3e4-71fe-49b7-a1b7-1e9f35ca3266", "comment": "Malware payload", "value": "0001dc79c7b2984e5f15978294b6b728c4ccdcfc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252438, "uuid": "90dcc5bb-031f-47e1-a4d8-7dd8deaa8d6b", "comment": "Malware payload", "value": "ab0b09af54e36024d77fb761a47dee64e227b21a531cab2fd11645a4931290fa5e66f2b0c18833e8263c0ac0c46795d4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252438, "uuid": "2e619482-99dc-435f-8120-917995ae1677", "value": "50F3CFE89A9FC097E663583095FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252438, "uuid": "4f5dcd2a-5769-43ca-9072-3e62382fde32", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252438, "uuid": "acb7e8fc-39a6-483e-b688-704095b90146", "value": "3072:am4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:YDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252438, "uuid": "1dda1c36-c075-4b0f-b5e1-d365f180c418", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252438, "uuid": "73cb330c-e3b3-438a-a202-9064d70a3bc6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252438, "uuid": "55571096-7dcf-4d3f-a667-cfba8e809a3d", "value": "397ce858_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd05c3d1-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252698, "uuid": "79f37461-d19c-4800-976e-797a71adcd8e", "comment": "Malware payload", "value": "b8bfca76fcb17e133d736450a48772f4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252698, "uuid": "85b729aa-1210-4c6a-a0c6-f85073ef44b9", "comment": "Malware payload", "value": "758bec129044d0fbdacd6e787656cb871b372cfcb653fd878a70a6c54d7700db", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252698, "uuid": "72f7b3de-c502-4279-8267-0ba1886c57c5", "comment": "Malware payload", "value": "cf86727e41ea91b1baa0f64984de9cd3ed79eedf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252698, "uuid": "9a8153cd-c874-4f5c-88d2-e0425fd0d345", "comment": "Malware payload", "value": "99d0346e9b33e1da2e009e322ae270ecc0c79edc376bd303c1ceef6257db5e4ccf214aa64a1b12e968d199b885e4209b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252698, "uuid": "65c3f195-22fc-4bf2-80b1-c83ab3c99ba4", "value": "8DF3C085DBABE87FC44A35399472DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252698, "uuid": "5a6d5e35-8661-4c5a-83f4-a1a6eb9b50b2", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252698, "uuid": "35a64657-962d-4e5a-a92f-44705f439bc8", "value": "3072:0L45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:04KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252698, "uuid": "74d7f3f0-5ce1-45ff-ac7e-4bf245595262", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252698, "uuid": "c378164c-29fc-4ab2-b829-22ae8399df29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252698, "uuid": "42eb9795-9601-4521-9339-8b2d6e16bc87", "value": "b8bfca76_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f8b157-ad94-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1620214077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214077, "uuid": "056afddb-b303-4ccb-94cb-51dbeb6ee580", "comment": "Malware payload (SnakeKeylogger)", "value": "5e0f051691b3cc1cc697fe2c17345a97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214077, "uuid": "a72da640-f497-4e7c-8b3b-7ea1ad2b0ca0", "comment": "Malware payload (SnakeKeylogger)", "value": "75b0144a524ca820dce94d07cc5f878bb6bcf424fd2a187ab54cb54463312547", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214077, "uuid": "6eba043f-a5e2-4dba-ad1c-8ea67724732b", "comment": "Malware payload (SnakeKeylogger)", "value": "57c8e6319548bbdcd6629aeaeb8feaa72456927e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620214077, "uuid": "b3add351-776a-4cc1-a152-82cc629044c3", "comment": "Malware payload (SnakeKeylogger)", "value": "a59e087980c475e71c8d18ed8f37532e145858099a224361bdfa45b7f01ba7b6036c2a4839cefeadf3cab9e26f51de53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214077, "uuid": "aef2451b-0132-43cd-a8fb-c07c7eabfa67", "value": "79F423E5139C682ACB7D96BB103011C11179F7136A47EF487B5A54784CEF3828662FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214077, "uuid": "c5fbe953-8ab9-447f-a46f-8ccd0ed4a5ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214077, "uuid": "940d076a-ff64-4f6e-96c5-1a18c1af5226", "value": "12288:wMt7KIj2LK4514gaq0fuDwcKunWMT1j5UOSSOxOl17kFOYdFW94:w47Xj2LK4514gLAcK45qcTcOYrW94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620214077, "uuid": "41da14ba-b628-475c-905d-453e957719eb", "value": 728064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620214077, "uuid": "32f923e0-57e0-4157-87c0-c780757c0199", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620214077, "uuid": "1f1294a6-f2e2-4818-9a62-64a4f699672d", "value": "Payment copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "842aa2e2-ad91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620212606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212606, "uuid": "3061fb2f-4e41-49dd-bc05-4d90b6255f5c", "comment": "Malware payload", "value": "d10bf3c7494e65afd8eb3d6d042df753", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212606, "uuid": "2539e893-7431-4bdd-a0a2-25cde11991fb", "comment": "Malware payload", "value": "76291b2a92255e7ee394360cbcf4ab24391b2a05275650169c95643bb9a52299", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212606, "uuid": "3f0079e1-cb38-4053-9f5d-1ff6f32b55af", "comment": "Malware payload", "value": "3a4822ba26d777d7539a6f4665522669239d6393", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620212606, "uuid": "31f1068d-d6b9-4239-a606-192abb34579e", "comment": "Malware payload", "value": "3dba545369022011a5b168c09bcdea819cf288ea925232ecb395a6f268eef6b8e925ede7cbff93d63c397b26b516df02", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212606, "uuid": "bb215abb-ff55-4439-bb74-f41b9fa3433f", "value": "82F4BE65F59627B3D22F4FBF4EE59E6418B71D6A225A80BCC0459F7F83E01D4C0A4BA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212606, "uuid": "17565a1c-5e7f-4c1f-8854-7fe31b08bf08", "value": "f286429c6b93caf7b990ba1dfe298bec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212606, "uuid": "a279e3f2-d2ed-491e-807c-1ea423d8fc1f", "value": "12288:QtAkg1bTHKZpe1X8spYwZu8OuqJCkiW/qZCwvbzni1Tm:QtAkg9WHe1X8spO82CBo8CwvPUTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620212606, "uuid": "3edc76be-434b-4dce-81bc-7e63041dd8b0", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620212606, "uuid": "6a393370-51d7-48b8-ae99-e666bf452dbb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620212606, "uuid": "afaa2963-1fbd-4759-8e17-b4fad318432a", "value": "d10bf3c7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d04d0908-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252677, "uuid": "0b56f187-4267-4133-a090-7757477c2be4", "comment": "Malware payload", "value": "ffcadf7eface50ed8846a8aa9f21e5a7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252677, "uuid": "e37fa738-57dc-4f49-933d-085b4133741a", "comment": "Malware payload", "value": "7632c2800088d21244f67bd6fbae0654e8362f1afbcf8deaf22e829ddc69d5bd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252677, "uuid": "82be97cb-1641-48e0-a565-22d85b885d75", "comment": "Malware payload", "value": "81e52755278c67cbe74125042aa69d5c0ca4495b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252677, "uuid": "4ae84cc3-0f40-4232-990a-dc1e7ed9b813", "comment": "Malware payload", "value": "e5c9328b1b9c01f0370e0933255bdbc85c732ba190578c7993009d29a8c92b1e7e0287e3c7982a4758eab459368f64ac", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252677, "uuid": "b12d44b5-a328-45d8-b85d-556f4f4c4fbe", "value": "8FF3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252677, "uuid": "659389c0-566d-4e24-b875-8bbd90571cc1", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252677, "uuid": "176aa50e-6429-4ecb-bb39-becee3d87942", "value": "3072:ld4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:MDBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252677, "uuid": "1d0e5497-a61c-4c2d-aa2c-8610a558184c", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252677, "uuid": "700d4fd1-5965-4c53-b2e5-4f2de356765f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252677, "uuid": "364c2eee-2c59-4898-a9dc-bef8f0b836a0", "value": "ffcadf7e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adbc8c0f-aded-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252189, "uuid": "a8d83f26-e731-4664-924d-4ec499b34dc2", "comment": "Malware payload", "value": "3fc4c9ada08f5e033163a9c95cc31a00", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252189, "uuid": "9bb7db84-bd0f-4d49-be00-6f67856adf74", "comment": "Malware payload", "value": "764f41b29285d1ad19f7bc5f0ad5d34255951cda7e24462e80bfe45847dbd545", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252189, "uuid": "5197c8aa-c0c5-442c-9eff-b9f8af5eb1db", "comment": "Malware payload", "value": "59bc941a2773315be68b1d2923b7f04fc25a1bad", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252189, "uuid": "f6062fa9-939e-46aa-9995-005e23f94571", "comment": "Malware payload", "value": "b6b5cadfbb0b54da495fdaf5ec88e2015132c4dade5a195e479ba3a64522b74e4eb4929cf3a3f3701d1673d4765ac086", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252189, "uuid": "17259d03-bb4d-4e85-aa97-b3ae4351d6c0", "value": "C4F3CFE89A9FC097E663583055FF37B6BA03D8478BC8DD10B281D52F5A1BD39DD09A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252189, "uuid": "e3beb592-c949-4776-8e5c-c88ea0fd4d84", "value": "bdaa0be01ce9860d02cb3111f632adfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252189, "uuid": "044d5e47-a623-4cdd-b0f4-ce95888940e8", "value": "3072:Ff4Dcp/qdOUKcT1GpvO0nygcp0DvA/fxHbeXaUDwOvHvWM:6DBdOlG0nyg1DvwxgZ/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252189, "uuid": "a126c046-d52d-47b5-b45f-e2ad7fc7aadd", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252189, "uuid": "223a10be-1539-458d-8c56-107f1417a968", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252189, "uuid": "b220af55-d6c1-4612-a4a0-18b27433df75", "value": "3fc4c9ad_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e352d0-adc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234141, "uuid": "55e19993-f63f-4510-84a3-0fd9b1a1d8e7", "comment": "Malware payload (Dridex)", "value": "db688bfbe4d82e78cc5ee0ff20000286", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234141, "uuid": "8fadf524-6e33-42a6-9605-b6a0c4f235af", "comment": "Malware payload (Dridex)", "value": "76af3c4ddae1bb5c3401f18f79f29b295ee671401b224095dd82db5bb7a0199c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234141, "uuid": "e5a4740e-9100-4f6d-a992-2a262edabd9c", "comment": "Malware payload (Dridex)", "value": "631af5d9fa5156c88807bbe176a75175c858b399", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234141, "uuid": "facf6356-40dc-476b-bec1-30c604bbadc7", "comment": "Malware payload (Dridex)", "value": "a481f21c8fea57c6caf07734f969e8b6319072ff0decbb26e1cf263b047a8956470da96634d7ee4b1ed755bfa858a55d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234141, "uuid": "4c037e05-44e6-428e-94e5-12cc5e2c1d41", "value": "13F3C085DBABE8BFC45A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234141, "uuid": "a5bd7f70-77d0-4f60-a4ad-b48255230d80", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234141, "uuid": "79c28975-8d21-4e16-8876-0afda817ac17", "value": "3072:Ck45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:94KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234141, "uuid": "b12bf5a2-8417-43fe-8f60-fb5414269d9e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234141, "uuid": "4e7df1fe-7f90-45fe-9be9-86480c5dece0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234141, "uuid": "09bada82-0c22-40a8-b198-8edda5b8b0d7", "value": "db688bfb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df573935-add4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241535, "uuid": "68849571-b1ac-4045-b28c-f60eff2fabcb", "comment": "Malware payload (Dridex)", "value": "5be116990529c267a1dcecd22f62dc52", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241535, "uuid": "2aca1167-a76d-4c80-a319-65aa1e7857b9", "comment": "Malware payload (Dridex)", "value": "76be3b90143b348beacbf410b21e7048db13a7bb5d747a751a748f398ee0a3a1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241535, "uuid": "906b1145-4b11-4011-ba46-cf7d8cf235e4", "comment": "Malware payload (Dridex)", "value": "840844779e4d986cdaa35fcff26c1ede0c645bce", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241535, "uuid": "c427d03c-f532-4e78-a264-418346a3b7ae", "comment": "Malware payload (Dridex)", "value": "6280e704769ed2cea3554003f5fba8a8a4f36ff5c9ca6ebcd707bec5c0adb981198fcb7fd6de4c0e8d28e7363da02f35", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241535, "uuid": "99c2e8c7-1ba5-4e2a-b7b9-b359ccc2f9df", "value": "41F3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241535, "uuid": "faed4c19-79bf-49a2-9870-979c8c6a0208", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241535, "uuid": "b1c78181-06e6-4b30-9708-5ae8eab6b564", "value": "3072:Xx45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:h4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241535, "uuid": "9975b6c0-e24a-42c8-bb0c-34bfd682acc5", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241535, "uuid": "c3ae8c85-c0fc-43f1-8982-44cfed6f9c96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241535, "uuid": "4e107101-243b-46f5-9a46-eeee6d18cfa8", "value": "5be11699_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1185629-adc3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620234183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234183, "uuid": "bd4e5d64-b8f6-4095-a6d2-cb27b063c50b", "comment": "Malware payload (Dridex)", "value": "9869c677f15b2352f6ec9ed4ed16881e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234183, "uuid": "d50f7511-2688-437f-9cd2-e9b50ca60643", "comment": "Malware payload (Dridex)", "value": "76dd34c1cbd82a4f64feb02aecebd7f72cac7dacc3717ac83816040eb7ebd545", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234183, "uuid": "374cfae5-66cd-4be8-afc0-3b7db069a1cc", "comment": "Malware payload (Dridex)", "value": "df083f5f8b3d37ae85862ed79168b8da4c9c0daa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620234183, "uuid": "c43824cf-748a-4b8c-b2f7-978796b6afb8", "comment": "Malware payload (Dridex)", "value": "71ade44000eee3a4e99ce457c07a0ff3e9629867e0bb5127800a14e1dc8dccdc815ece1e1f17fc82fda79fdbc5c29b25", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234183, "uuid": "15e7b368-3535-414f-af94-16f89083d3bb", "value": "E7F3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234183, "uuid": "98b6e56d-8742-4955-ace4-a301ecc13b45", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234183, "uuid": "35eb6e04-d742-49d1-ad9e-8115d2b07388", "value": "3072:li45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:M4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620234183, "uuid": "087c14ee-eff7-4f29-991e-483100472ca3", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620234183, "uuid": "52c1230c-4adc-4e43-9a2a-53ab79dec197", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620234183, "uuid": "dd668ed5-64c2-4343-83c3-916f55859a63", "value": "9869c677_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c3dca10-ad63-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620192648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192648, "uuid": "c9f98857-0476-4957-a3c9-ccd70337748c", "comment": "Malware payload (AgentTesla)", "value": "dfbfbee3e80b0d958c30903bd7ddfa52", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192648, "uuid": "58b0bfda-da96-4573-9972-6774fac1a9a0", "comment": "Malware payload (AgentTesla)", "value": "76f00313f604d1158de7a5bdd8631e541e31ba3ba29082413a599db899b78041", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192648, "uuid": "24bdfeff-e7c4-4f98-8941-589988235d18", "comment": "Malware payload (AgentTesla)", "value": "469591508bdded11060372f0ea8d3ff22e1bd201", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620192648, "uuid": "ba735548-115a-435b-95b3-f3b339d8daf7", "comment": "Malware payload (AgentTesla)", "value": "f2bc0d8262c5acaeb1d846ef76b847dd46acd5cea56ed860baa3bee27b5972110cc1c16c3c568c51d1b24b8afc6fdc8c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192648, "uuid": "68856c43-c01b-4375-894c-52b50eba9f49", "value": "14A42325A6001AF0DB66C3204F2D98687BC7FDD2368AFE03E1D6BC5CCA6664D463C56D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192648, "uuid": "ddd394bc-ef6e-42f0-bf48-43872b7c8a01", "value": "12288:aleBeuMf+4RzudsmEDkfV2R6qXcTWQnA03g+QUevN+pS4QnhZ4JM4DB:alwew84smEkd2RETWQLw+Q/1+pfQIq4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620192648, "uuid": "57116021-ed87-4809-8a1f-9a1065fc528e", "value": 486553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620192648, "uuid": "5ced388e-b689-420b-9bf6-61110244de3d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620192648, "uuid": "6c6d3fef-72ce-432f-9215-cfd82d24d9ec", "value": "DHL_document11022020680908911.doc.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5af0a7-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620252434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252434, "uuid": "9ed5edce-a57e-4fff-8d73-f06aa9074b08", "comment": "Malware payload", "value": "7eaffae7210c64439352a9f0a714047c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252434, "uuid": "d947c1bd-daee-46dd-bbc0-6173da24bc6e", "comment": "Malware payload", "value": "77206751ef8458526487896db847b66eb7c367dfe62c12f20e839e6d76a5e876", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252434, "uuid": "d296f646-3687-41fa-9e6b-cb9cb945c535", "comment": "Malware payload", "value": "db3dc12f756c275031b3e55ee6f72eab7d717045", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620252434, "uuid": "e4494761-5622-4bdd-9e91-edc447d1638e", "comment": "Malware payload", "value": "cf5176281f985cb6a4a9f492e167fb28628ad860604ae4f2da498d2afc3616aac0feb011169531730296c487387f990d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252434, "uuid": "6d0c57c9-b5f4-40b7-ad82-74bb6b9ba3f4", "value": "06F3C085DBABE87FC44A35399071DFFB5B388B145640C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252434, "uuid": "7c954897-dee9-45af-97bb-279c2f9253b9", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252434, "uuid": "6eb38279-5405-4d5a-aef6-d0c12470af05", "value": "3072:AF45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:S4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620252434, "uuid": "dce33309-2c1c-4b55-91a6-abe766c0558c", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620252434, "uuid": "a37a0d1e-bbff-4743-bd7b-540426f31cbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620252434, "uuid": "3f574104-3892-4dd3-9270-52b795bf6d25", "value": "7eaffae7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0a44a1-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1620241689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241689, "uuid": "4fc3869e-d1c7-4d98-92bc-c1f6cbd1ba68", "comment": "Malware payload (Dridex)", "value": "287f8fceebb87bdd191ebd456b201678", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241689, "uuid": "b9f25bc8-9bd9-4fa7-b77f-59117cf14b06", "comment": "Malware payload (Dridex)", "value": "77574c9a2df083821b3cfe0b38462c058402ab65cf3048825c6cb0778f538f98", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241689, "uuid": "cd122a3e-10b5-444c-9544-619a24d7ebdd", "comment": "Malware payload (Dridex)", "value": "4280c7688846f326ea48e004363ea6e6d38c9b93", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241689, "uuid": "f94885fa-c831-410c-b991-db5ea67b76ef", "comment": "Malware payload (Dridex)", "value": "cbea9f183d7c1b3b80f89746b501693c471660eceb32ba6afb4d3a41ac5dbd67aecb15672f846c733375c47eaface80e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241689, "uuid": "b00ccaf0-fbc4-47f0-ac0a-def5f07cdb69", "value": "42F3C085DBABE87FC44A35399472DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241689, "uuid": "4e86979c-a776-4bc0-a72a-344d657cc6df", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241689, "uuid": "14c392b9-0edd-4189-8200-8e2a31250f04", "value": "3072:oX45bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:c4KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241689, "uuid": "21b4f46a-6bb1-4adf-9eed-2b73b79557ac", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241689, "uuid": "c412c930-2723-4c91-bca5-6ae4735cb22e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241689, "uuid": "87dcefef-9fad-4030-8d57-9dbfdbce2f5e", "value": "287f8fce_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d83ed1-add5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620241841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241841, "uuid": "df1ba328-a194-44b6-a42b-5522f0438633", "comment": "Malware payload", "value": "fd7ee2df4fc91dce4a13e74ae4cafbbb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241841, "uuid": "ace161c2-73cc-4348-846e-0ff531283171", "comment": "Malware payload", "value": "778b7ab9ed90682efc366f48d8a48249b4fd52270e7830647bd578c24de9767b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241841, "uuid": "a560cd87-d108-4d48-9410-fbf37ed4103b", "comment": "Malware payload", "value": "dad6516d68e8e186c69a9b73e589b62eb8aff5f0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620241841, "uuid": "7b2297aa-0756-4e29-abf5-cc2c6bc82688", "comment": "Malware payload", "value": "39874b16396188e28a640daad4e45dc76096184ecc1a1af8648b963791bdb536ab6378ee91ee54249215798a07ac40cc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241841, "uuid": "6eba4527-4aed-4b8b-9eb6-601fae03ea8c", "value": "2AF3C085DBABE87FC44A35399071DFFB5B388B145240C870EB6969EFCA07B110856C83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241841, "uuid": "ce53603a-be56-4fc5-9c3e-21bce08ee8df", "value": "fe65a1f7486a2b7fbd4091fc108e3b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241841, "uuid": "4cbee044-f832-43ef-9fd6-182e7cf9a969", "value": "3072:A945bscWrhftr4SOX63M5jY17lh9sDVj9a/KBz9YlYU:64KcMhVkbK3hDq9E8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620241841, "uuid": "5d644201-90d8-4c4f-aeee-dcf75ddceef1", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620241841, "uuid": "f58cf81f-4999-4960-ae0d-ba4b82670451", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620241841, "uuid": "52959234-7caf-4adf-a834-96ef4d90d2c5", "value": "fd7ee2df_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec607ea2-ad67-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1620194742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620194742, "uuid": "efe0a323-0f9e-4291-9c2d-018159081c3f", "comment": "Malware payload (AgentTesla)", "value": "7c58e1a080b3e1675b7f97fc473dadd9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620194742, "uuid": "d90e74e3-d31d-45f3-8e05-9372ae11eb5b", "comment": "Malware payload (AgentTesla)", "value": "7798fbc5415e66c41b39a2f14631ea30ca2214c0a20a6497a6545f146f1b5e93", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620194742, "uuid": "f1f843a6-ae30-4c82-9026-502d2fe43d7e", "comment": "Malware payload (AgentTesla)", "value": "e094e364ba0a493d9d3dcca78803af0c12971391", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620194742, "uuid": "164fa002-f668-4657-93e8-a5d37ad774e9", "comment": "Malware payload (AgentTesla)", "value": "9de6de20a78c6b4a5794493d205f5304e127b33373031d5ddbd9258e2e1baff2fc530be54f4a60cedbbcf26054ea55c9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620194742, "uuid": "6041f0a8-ebd7-4da0-9230-8f15173f93f8", "value": "51F4239E29DCAA09E6BE8337BEBC5442533DD944A943CD3D2CD265AC50C3732974272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620194742, "uuid": "e4a8f143-4ef4-4662-9484-0b824ccf03ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620194742, "uuid": "2366102d-801d-4d85-8ca2-e17339c84be0", "value": "12288:VzMJ0ogxyeCeqa43je7FhoxvXot0skOjbwi7qV7T5h/DHN5OtWyIKbgv2Qk4oe:NVogxyQZ4FvdsjUi7qNTrOtDPWJk1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620194742, "uuid": "b59ec0ba-f104-4f2e-ac20-cbcc0d1f5883", "value": 773632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620194742, "uuid": "ef711e1a-75a2-4054-9c8a-c66d19136f32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620194742, "uuid": "c4591056-b751-4af0-ad45-1865e8d56225", "value": "SWIFT COPY.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed008954-ad78-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1620202044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202044, "uuid": "65f00fcf-0dbd-4f83-8311-fc461e750cfe", "comment": "Malware payload", "value": "ba1c076ed8803d62a99f644b2e765e2c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202044, "uuid": "8e863097-69a2-4a48-aa90-c4de7cb82a38", "comment": "Malware payload", "value": "77cad6582c7eff8196fd3c85018d9a2b68fac767337f67d905e7d772bc402b8a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202044, "uuid": "45a76f71-d632-4c87-97e3-ff32d87ad77e", "comment": "Malware payload", "value": "e069f3d5ddad7bca06a1b5f45da41fe362e89319", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1620202044, "uuid": "ebe31a50-3fa0-4173-9c98-97e0aa8ee325", "comment": "Malware payload", "value": "5f662e94ab586d25269c72555cea605dd202c107b524e2d2f07697bb96430ff40883ceb52cfbe85b3696331d38a2163c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202044, "uuid": "b18bcd96-25ca-42d2-9f41-8127ec91a734", "value": "66D4ADD20A8DB7C2EF96F2B80D586832545B0CEF839285D1CDAFF825D2B066DC9B5D10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202044, "uuid": "a750327f-edf7-4328-a1bb-2c526b496f09", "value": "51a22ccace785bc071e973939cd9708b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202044, "uuid": "3b99d9c1-c9b1-43a4-9ae3-592667efcb7c", "value": "6144:16lui5LgiImw87sJdwWrffCdW++XHqIHVX2EmJOFtooj4fgoX4mR/8ha7UrI683S:+53vB7s7r2WPKI1mJOJjYdPaaFTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1620202044, "uuid": "0eeb3f56-30b9-46e0-af9a-ca44f6d28e6b", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1620202044, "uuid": "0b602420-44da-4072-b09b-c13468e25b7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1620202044, "uuid": "a7a8bab2-6613-449d-a736-4c3d1a70416d", "value": "ba1c076e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8668d0c0-adee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp"