{ "Event": { "published": true, "date": "2021-04-23", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-04-23", "timestamp": 1619222581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "335e7bb6-b965-444c-90b1-27ae63fd6574", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707a716c-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218717, "uuid": "44e06f9e-317f-4eed-843a-85cbe70866c8", "comment": "Malware payload", "value": "4108295e870c9a85a9c9bde781b86cc4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218717, "uuid": "b398bbd2-034f-4629-a75c-acd4f05c8a2e", "comment": "Malware payload", "value": "00007737a7f3ccbfe6ffce8deb455ddc7377e1694693e7fb57cfd3feded1642f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218717, "uuid": "4de5aaae-fc1f-4c2b-b5da-331730670614", "comment": "Malware payload", "value": "40f5469df269af458ae7f6b8a40628e17393803e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218717, "uuid": "ce22f7f6-1620-4a46-b3b2-2a8ff008a631", "comment": "Malware payload", "value": "5711136a9aae1975dc85a34af70cfbed470eea695e278b76bb53735f09379f3e03c3e06aca0e92732db9643d6e8d6d5d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218717, "uuid": "e07fb7d2-8c2f-46b2-be74-8d78d7c3eafd", "value": "45831277DE87624EC502723013782FE64B2C6B729A61050A1774747F2B2B9698CC6FD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218717, "uuid": "355aff15-c831-4854-97f3-d12588d6a883", "value": "1536:kuxWAXdZ2rQD2aCvdyWxaqQ6Rxt5AB/aqPwL3VbCb9:kA2QKmm/Qwt+awaxCb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218717, "uuid": "665e750f-2371-4f9b-a5c3-329585278b02", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218717, "uuid": "6f509b12-2e28-402b-95a5-889f9f29e0bf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218717, "uuid": "64c80e2d-c775-4aac-abe9-1185d8ae39cc", "value": "catalog-1675568917.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d16d5d-a3f5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619156122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619156122, "uuid": "892ae1f5-d21b-4bc5-b397-738b6f9c22ad", "comment": "Malware payload (AgentTesla)", "value": "0f5a0bae69fad7edde7e7812fd895886", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619156122, "uuid": "8234db3e-51e5-47b3-aba4-9a541648145a", "comment": "Malware payload (AgentTesla)", "value": "001306d8cb862a0b5b2fe44ad68652d8c14bc016ce68a710c706510e1e98475a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619156122, "uuid": "229a508e-e21f-455d-836f-a2ddef523b26", "comment": "Malware payload (AgentTesla)", "value": "16e190fce55caedcef702f8b29779563b168a21c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619156122, "uuid": "289287eb-7d31-41be-9504-deaf3081fc3a", "comment": "Malware payload (AgentTesla)", "value": "0aaf193e3f768f503943c47c110ea2f5a96e9bb7166be080b28d35ba0fa5c4b87180b95a48d3726e2e28d04f1b1f9185", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619156122, "uuid": "435a83b6-7b14-4616-b8e6-47ec9b16daa6", "value": "CAF4F1A0355E934DD8AD42B8287527F183B66E96FB97DE1C3DD83A0DAB77C120304932", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619156122, "uuid": "82fcfd9d-06fb-4deb-a625-282ab4c727af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619156122, "uuid": "3e0361cc-b1da-436d-aa56-74d3090b0ba6", "value": "12288:q44zt+Rf/y1ZtjzJSZXK7C7HPg8Ho464rk0qLrJUg1RxYCWkhTP2oHhU:DH1a1Zpzu8yv0uG5UsRLVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619156122, "uuid": "695a3e92-f8ed-4fff-8364-9640d308b43e", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619156122, "uuid": "5f940313-71bf-4bf5-a907-acf4e1e844a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619156122, "uuid": "cf0fc7b3-93c0-4259-8bb1-a14e7df0d152", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8611f0f0-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219183, "uuid": "c83942b4-df2a-4ee8-9fb3-3a4c97b79308", "comment": "Malware payload", "value": "6007aed5c4c13ba9a93eb146618490f1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219183, "uuid": "c3f05d15-ad3e-4262-99b0-f3b0f06de3a7", "comment": "Malware payload", "value": "002fa80c456e70e2ad92754278bd2d7cff2ecc6945ae35c5b40f15b28fa0d5a3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219183, "uuid": "b984ad18-a8d7-4383-bfbc-1cf99609d3be", "comment": "Malware payload", "value": "c6a49e4c2256d6c5d131eb93b0078f9729f0c8f2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219183, "uuid": "3008068c-1e8a-46e2-a1db-43718e4732ff", "comment": "Malware payload", "value": "ab39f008c741fc8bd4e6ab4835896ed4a9d693393d50c9cb5a33e178a60f0fc928260a477710960bd873b663685f7b21", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219183, "uuid": "82c5fe5b-c269-421a-bb93-7d758cd08c62", "value": "CC8312EBCFEA5D988202BF0673065CBBB454280C6118BA7A7EDD11506F514A0F8B7DED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219183, "uuid": "5d147f2b-8504-4b12-9e97-4bc831de35ab", "value": "1536:+ZKLWkP7EBmnbRARpNdZ2rQD2FPdo1f+5ff9fuQjMCYNst+IHClPLqkwD0DCuADW:yKLWSFbkpwQKW25NfuQjMCYNBwltD0D1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219183, "uuid": "14be616a-dfb5-4a03-807d-b287b3721203", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219183, "uuid": "7e43e7f1-6f40-4020-9e2f-086dd12d4b33", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219183, "uuid": "04460e67-e89f-4707-8de5-843297ea656e", "value": "catalog-1929514299.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ffd4d5f-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218180, "uuid": "6d87e2de-4b4b-4be8-946b-77b2724cdee7", "comment": "Malware payload", "value": "533789a963994335d5760b7316d22376", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218180, "uuid": "d56178f5-25c0-439b-86d2-776311f4bb5c", "comment": "Malware payload", "value": "0049b8139fa1854ac546ad42d424e2a7c54afe9e9d476393598ac585b4665d44", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218180, "uuid": "334b3a44-348c-4624-a401-ab172bb0f46c", "comment": "Malware payload", "value": "fc405e5ff9adec6720c22e2fb03da99d019babb0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218180, "uuid": "a07d922c-4fae-497d-8285-f35b973269ec", "comment": "Malware payload", "value": "551a801d7aece0996ae241a3e439f9583f7176465c89c3b6f1d44caef12a5e1a5c8c17c297d3938e567f69c71d7bade2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218180, "uuid": "fcb6c10d-5dbd-41bd-917d-c48687e2469d", "value": "AC8302EC70238A65637345A6DD7E90D32B6A8BBC441DB056A82AB9364A307FFE111531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218180, "uuid": "8280fb3a-1e03-4034-93b3-5e9378af138b", "value": "1536:ZzKTWDE4Qgl8LS4v50FC+p7UjoB8+wXdpUna5ahL2dmTLUVVvi:ZeKDPKLRvaFjp7uXinakEmEVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218180, "uuid": "bde20d81-37ea-4258-bce8-9f4adaa5e69c", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218180, "uuid": "62f7b3ae-b196-4cda-bd02-d0fec7ea0f70", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218180, "uuid": "dbc47776-da07-4e56-ad89-bcdff5e03d74", "value": "catalog-1379006289.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "719b0c46-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221726, "uuid": "fac9b60a-6a78-4402-91a0-babb6687d5bd", "comment": "Malware payload", "value": "efe54d4a69c99b463020700c15139e2e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221726, "uuid": "922ded1c-1105-4514-bdb4-7cd40a9e450a", "comment": "Malware payload", "value": "0067fedcfd8c40e3570ec465aae47e161ab5c6b90232f485dc04f48128f0f3fa", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221726, "uuid": "95da030d-625a-4210-a362-709fb734678a", "comment": "Malware payload", "value": "1d005b7f8cbba041c215e939deb77f7d24916759", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221726, "uuid": "e235cf1e-de4b-44dc-abac-45fc60205ac6", "comment": "Malware payload", "value": "6823f420aeb41a0d7508ce058af6ceac78d62c686dbf0a1cc380601a126f4fde129a10278d8a215736cc27b0bf89b7ed", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221726, "uuid": "06705d76-7538-4e59-95fd-df37443488f5", "value": "3D831317DC6E14DCC06E46E41CB2290D94609FAD801C8489B16EBBCF31E8E499EB7DE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221726, "uuid": "4d8fd8cc-7149-4f02-98ac-9969517d1491", "value": "1536:uNZhdaLgblJKa6wSp6yMvBjqqxPGLuhCWdHsh1oSFWsfEFhHqLWs:cZZJt6l3MvBjqq5OsZdHAO5hKb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221726, "uuid": "bf2b7082-6dc5-479f-93a0-60cb400b55a1", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221726, "uuid": "40ce9ef2-145d-4f23-8e70-2e0ddc721391", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221726, "uuid": "fe330897-6653-42f4-a8de-cd2f27ec57a2", "value": "info-1841731986.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc628147-a3ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619153669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619153669, "uuid": "575c9fc6-5431-4bbe-9be3-06b88ec86f40", "comment": "Malware payload", "value": "7231bac43487064d73f3cc656113ca58", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619153669, "uuid": "fc99c263-c8bf-4a18-ac9d-de7110ad1dd7", "comment": "Malware payload", "value": "006e2299ffc489d0feaec733040d21c2a0641e194243be416b0c018e1c1f2af3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619153669, "uuid": "ebf87e3b-47db-47f3-9f81-6b752477549e", "comment": "Malware payload", "value": "4a1968afee0f8fa8142892c6bee86399c42c506c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619153669, "uuid": "36b404f2-d350-482b-8506-fc0ef5ebf38e", "comment": "Malware payload", "value": "83d00b93583ff0b7101ae92fb54512a6d3000f0e089f516f9b8c308b1c3f37ade1ce8dbc50bed901ccd5a2280b4a62d7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619153669, "uuid": "afa9f017-7133-480e-9106-0fdebf139f08", "value": "AC75E0F0779085D1DACA0B957D9ABA4C6B93F2FBACD50488300AFBF5375B345981D882", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619153669, "uuid": "640abeee-1af5-4b64-8d97-f14c8b9df272", "value": "24576:X6I6I6I6I6I6I6I6I6I6I6I6I6I6I6I6I6I6I6I6I6I6I6I6I625L:KttttttttttttttttttttttttM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619153669, "uuid": "ba2d2441-5749-4cab-b486-bd3dd38b4fe7", "value": 1648924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619153669, "uuid": "0a4ad210-c1ff-48f6-bf03-429a16daef54", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619153669, "uuid": "d8b49651-b46d-422a-a6c2-4318010ca4f4", "value": "Proforma Invoice PIBWH-02314-20-21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fef10ac-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221320, "uuid": "8549f1f3-1b2b-496c-988b-418a8ef05464", "comment": "Malware payload", "value": "f559e4392534dd63443663f2196c58b3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221320, "uuid": "834b8916-1feb-4016-9ab2-d016a15b16a5", "comment": "Malware payload", "value": "009be23aeba8785b6fcabae8285affec56053088c07078ca0a89ebc3b35863a8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221320, "uuid": "66d0f516-9014-4285-b890-cd74376c19d7", "comment": "Malware payload", "value": "5c0dde750d2cfff2d8c6b2d52fccfe1451bda361", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221320, "uuid": "9d14ef54-a32a-4143-9fcb-53e9eab17791", "comment": "Malware payload", "value": "5497685d581b55668ebe91b79bebef9a611b4f4c67e6aebe7a9e2dcfb7f2d01febe5e2c3463b06a616affe44a50b6df6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221320, "uuid": "172da63e-03ce-458c-a481-c55bfb631ddd", "value": "2C83020E5C8426FEB055E7101E3DF8898A0EEFE2C975A604F28DB61CE172B1D75B446B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221320, "uuid": "e4bbede5-2f9f-4c8d-ba5d-59191c20b6bb", "value": "1536:oNZdYvym4HQWVy+sb/5197v7UZoctQ2kPo+4mpRlDi1nUSUqxuuC:eUT+3Vy+U19T7YptKRNpoUSUqc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221320, "uuid": "2e9cf4c0-e64c-4457-aec8-c365e52a2f9f", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221320, "uuid": "fad360ed-0773-459a-84ba-8e1a99e70983", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221320, "uuid": "2fb97e69-c609-495e-86d5-445e6949d7d4", "value": "info-1618036194.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f05551fa-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219791, "uuid": "e59edbaa-e0ac-4e88-8b86-750f25900887", "comment": "Malware payload", "value": "c03c38388b8f7742ebcdeb97d554e989", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219791, "uuid": "7b6995c1-0df7-43e6-8d95-d89ab29364a0", "comment": "Malware payload", "value": "009c33abe9168458eecd2b764f22ab0fbeb91409fc380c7ed18014c3fb3f2741", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219791, "uuid": "fb7f4c11-8258-4ccc-94db-1450e6ead23b", "comment": "Malware payload", "value": "fcefc904f9adc32d3d88e767bcd6312704fb42f8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219791, "uuid": "13c763c1-cd80-4f9f-bdd8-0d09bed3eb69", "comment": "Malware payload", "value": "6658fbe32487373ae60e42162ef1973bbd5cfdcd58cbba777d437144dfc8ad6b2a8ad3cc9848c186470e1a581cd83e63", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219791, "uuid": "7566594a-54a9-47d7-b271-98bfd1d28e51", "value": "318312599B1B7DA7501F3CF31B322A5AB603BABE0C0C7096DB78C2D0E33A51E25642D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219791, "uuid": "663d6f41-bf89-4ffc-8dcc-d4718c51a243", "value": "1536:fsf1lwtMJDrsPSpV8LS4v5YFGrfZg6kxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGN:WcQ8PjLRv2FKeJ9a03fjwe1moYpoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219791, "uuid": "8d4930cd-a8fc-43f7-966e-61c18684ad86", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219791, "uuid": "db336638-54af-4cfe-86d1-06fba44c4cc3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219791, "uuid": "763a6e3d-0546-46bf-8f95-b0615bd99f6d", "value": "catalog-336924755.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6619d1ef-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219130, "uuid": "5070801f-83cc-45bc-9b03-664c29191c3f", "comment": "Malware payload", "value": "acb8ab58986eef72eed065eece9861be", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219130, "uuid": "d5ef738c-5f9b-4cf8-a21c-5eef009bba6d", "comment": "Malware payload", "value": "00a1a811342c9ada72187df6c0650ab124145360d1cd44c9aa36f4d1abc353b9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219130, "uuid": "bfd61e28-b034-4e49-9df9-2f1eee0d1b4b", "comment": "Malware payload", "value": "282fe99c2455f8741865706ad36a0251e06beefd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219130, "uuid": "4fc86987-f2c1-430b-b40c-1cabb635c484", "comment": "Malware payload", "value": "6ebdcae835029597b02e039c117d6ed8a15a50322531518c4daec761cb6d888cda9b64efcfcb050d4d5b7403ba5a2e6e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219130, "uuid": "5ee8f466-e7a7-4555-8809-edf7df74f32c", "value": "D88302CF74E9433D8F3527B648AE1E046261A43F44088ADC75D73BB86B42AB265723C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219130, "uuid": "16a4286b-75f4-4b63-804f-dad2a2bac116", "value": "1536:PAfNtg2tf2vCapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvh:Pijtt2v7mU9j7+XFWtYe14hbOjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219130, "uuid": "d80aad36-98e5-43b2-8a0a-51bc212d5ab1", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219130, "uuid": "b3c6347a-02b0-4bbe-8e3f-784e6451bc36", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219130, "uuid": "e56a1a00-9169-4301-86c2-6e3cd3c34720", "value": "catalog-190457737.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f503d98d-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221517, "uuid": "8a8a9394-41c6-4018-8152-c9c962715712", "comment": "Malware payload", "value": "5ec033f508ca6b3284a04f5477d26ce4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221517, "uuid": "fa4fe196-0e7a-4d75-8fea-701a8ed6151c", "comment": "Malware payload", "value": "00aad77bd2a9308c8f45c7f32750c1325943dcfc66b80237daa170d7ab70294d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221517, "uuid": "4737fe58-2a10-41b6-a765-7d2f7044b0e8", "comment": "Malware payload", "value": "e0149a2b6ca68ee7c0f8fbe338b742e3e21741fb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221517, "uuid": "20e71577-85b2-4ce9-8656-f5c6c0d9f193", "comment": "Malware payload", "value": "c431d850b204818921eb6db3ed0853c6c25b23c36aad0558a3c0c25c910fe0058b64f2f392bcb76214034539ee690359", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221517, "uuid": "3970403d-d1d2-4f45-a4e9-5786776fde24", "value": "128302AC1836AF1DCB09E4E222DC37AC7E840073B1B593DF415E647271A6FB5A8611B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221517, "uuid": "f694f3ed-30e4-475d-b5e3-4e7939e61050", "value": "1536:RataLgbaL+q1zmW7nlTJkv9c/EWd8E//nfYRq1o+VCQHeWnsUWuopyf:RaZ++xW7nVJklMdT//gRL+VbAR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221517, "uuid": "b67b1d27-da92-4f62-ac6d-449d83a78eb0", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221517, "uuid": "52a40adc-2120-4057-80bf-d372f7774958", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221517, "uuid": "05fbe376-a9b7-4a2a-89db-7ab4a8b24b1d", "value": "info-1725147115.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cef7d6c-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219060, "uuid": "64d4850f-e5cc-4622-8f9b-6237d1beec51", "comment": "Malware payload", "value": "dfb7b66478191656fe41d2d886cb6b4f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219060, "uuid": "deab0a18-351e-49bd-b72b-7ec4b325791d", "comment": "Malware payload", "value": "00b314a572adad2a2f34156ad175b2936450923d34cf40ee4f4b9176da968d61", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219060, "uuid": "5576ff7a-a601-4071-bdf1-9da994367db2", "comment": "Malware payload", "value": "91ef6e6ca4a812f1691ad4e3e2fe20b66f10bc25", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219060, "uuid": "58a2c2a4-c236-4d0f-905c-a2c8c99510ab", "comment": "Malware payload", "value": "98b44cd07111e35269ee723a14f2a972e520b0b1104a37319394faf5f996da91796892885474381290689917a6734585", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219060, "uuid": "9bafb468-ad2b-4ac8-99ec-efd0e458b652", "value": "AD83021B6FCB71328056EBB14B352A056663BEEE640C605ADFEF4778FB3205528AC1D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219060, "uuid": "bfcae516-541d-4eb6-b230-45137bbcf9c1", "value": "1536:WRRn2hxDTZQ72ZTYzqcIBxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZiZts:2R2hxDB6IjJ9a03fjwe1moYpow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219060, "uuid": "4efd175c-b701-441f-a157-8e3af4b9281f", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219060, "uuid": "ea85cd73-b690-4f84-a4bd-221a9c496bc3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219060, "uuid": "ad3f2103-b069-4c6a-83bf-62d3779f9e90", "value": "catalog-1864264674.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f83a141-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220300, "uuid": "81f8b825-e9a6-45f1-92e0-708b17aee698", "comment": "Malware payload", "value": "880506638fc0c2f3cb98420d0e9bab66", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220300, "uuid": "36468476-ad07-47e8-a0c6-60d80eea4c09", "comment": "Malware payload", "value": "00e741e69534b7a504fa73a34f3679a4ea9fa24d5a5411067fe9fa11a8c6e072", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220300, "uuid": "38f8a233-065c-478e-9ee4-7df38311eaf4", "comment": "Malware payload", "value": "063926ae7f2c0ed2229bede5e306ec620bda8ed0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220300, "uuid": "54fb51c6-3b22-4ebe-98b8-e99b792dafe7", "comment": "Malware payload", "value": "c5f18cd769cd1145aba8a8f6c065e41488e346ff0f366072be0ea3cbb556ae3641c19e39c660a9a5219ea5e3f25a8be2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220300, "uuid": "95beb3e3-aa02-49a4-ad2d-20c98e914d83", "value": "0E830266E8769CEE419DE0A2E02E3A1837FC11D3E0799787F61E3D4A84379CE5D1442E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220300, "uuid": "a4c940e9-1a6f-4361-b6cc-483f41933615", "value": "1536:QnNHeop+LU9t5t7mgV3eE7JWgtrQZcUT7oqlaHvvbFq9GHocnoe1RqfwSOJrpME/:UrkLUj5tSCrIGUT7o/v096oiBkwP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220300, "uuid": "ce59d91c-793f-4f18-af1a-ad4a17c3ded4", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220300, "uuid": "c5b02a55-452d-43cc-b3a2-233b8f875ba5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220300, "uuid": "8cbe0748-2f48-4433-8e8c-63654c1202e2", "value": "info-1073523272.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde881f8-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219384, "uuid": "222d3788-5e1b-4ff1-b666-fc50b9500a3a", "comment": "Malware payload", "value": "4a95e1c35d6bad56488a86fafc79c69d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219384, "uuid": "818a38ff-c7ba-4bb6-a756-82c1fba67f6d", "comment": "Malware payload", "value": "011399a1874074ad83e67c539760b3416e0e0673f1ce4ec75bc6c1cc6f9dde3e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219384, "uuid": "bfa9dc2e-e67b-4139-8a0c-a6186d496db3", "comment": "Malware payload", "value": "c41a0ae02ab2cda16c186992dcfe8f5872f4b6aa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219384, "uuid": "c2fb9a7a-bc9e-453f-9561-e0580671d9a6", "comment": "Malware payload", "value": "93fb3946a1b44fa3bb7e7dd1ce39aecb8c746a0f20b088d4e6b12f263d622719e44ba2cc30dc5a11add2cb73552bad99", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219384, "uuid": "fbf5b6ad-6843-42aa-b274-5eeaeae2ea6a", "value": "4C830268CB9F8D948005ED0ABB12B8ED7550624C716973ABAFAD1124FF478D5A2328F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219384, "uuid": "338bdd6f-ba19-4f31-9260-d9a521ebf01c", "value": "1536:mA6P7EGmwH1zVQLQDYflSJXvoDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnd:mAY31zVQnIJXaM25NfuQjMCYNBwltD0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219384, "uuid": "cc199a14-80a6-46f9-834b-e3c871f52fc1", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219384, "uuid": "1d3bfb86-59ce-4eec-a105-93952c99b72c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219384, "uuid": "2ef04f33-79cf-4977-a0eb-f779bc57da3d", "value": "catalog-2053327522.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f32b5996-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220655, "uuid": "943699f6-efcd-4bb0-acb3-96cd317a74b8", "comment": "Malware payload", "value": "c40e56e7090f51c394d73617406dec3e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220655, "uuid": "ddef4fc2-eeca-47ec-8cb9-6e2ec9dac4c7", "comment": "Malware payload", "value": "0135ad08aa62dc1f41c0f51b2265c853359f59ea8d6f90703b014973b3ac8d80", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220655, "uuid": "aa2b2553-aab1-4c81-89bb-7573eb7817f4", "comment": "Malware payload", "value": "3534f96295fb88034c581270e774f088f843ad67", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220655, "uuid": "e61f6a12-c279-4051-b0cf-8efdb2f37508", "comment": "Malware payload", "value": "4969f1cbcdd308562582d90428d96167e5b2de14f9279ac15c134e3014064962d4cf3fba6a7750c896d0fc7890ae5aa6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220655, "uuid": "25384e4a-b72f-48a3-8080-6186ad083178", "value": "C2831237380E8BEDC14BF5BE50DBF869F161664A8C1BEB54B7701D9175234265C22B8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220655, "uuid": "aeccf2e6-7d41-4865-8e42-cdf0a771466a", "value": "1536:dNHeZNRPrGXrjk+xnHJ5GbkC6hhcBrasoi8vQMwdjV46CT7:zUxL+9HJ5C6DmrajvIM6CT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220655, "uuid": "455833b4-52c1-45dd-b3e1-938c94d02774", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220655, "uuid": "6a3442cf-8022-4e43-8ed2-6d895c7e7e3b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220655, "uuid": "8b9bcbe4-3df7-46cf-a8d4-a91c0b99949a", "value": "info-1291589220.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00ee0d88-a490-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222396, "uuid": "455192eb-b7d8-44ea-be66-16ea2245bdac", "comment": "Malware payload", "value": "6561117cb623ac3e59072255216df521", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222396, "uuid": "61da319c-2c8e-4911-983d-08a815c10db6", "comment": "Malware payload", "value": "019f33893f0149c0176b7974f8b30807b58d38868b5287d25cb70ff13080e7a1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222396, "uuid": "57725ab0-58b5-4df9-9af1-ec4642d6e8c7", "comment": "Malware payload", "value": "d890ae9cfe0ff017aa6ee1ef700f7840a2e5b027", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222396, "uuid": "1afba58d-1926-4591-8507-34f7c35d5771", "comment": "Malware payload", "value": "a4ca3579982b35a28a62e9dddfa895b4897026c1f2d9185adede96d89efb27e86dae954cec9f6319bbbcfd32048e7ed5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222396, "uuid": "4e2d1a04-5549-4700-914a-0e689f27c878", "value": "AD8302E6AC779C1D818ED2F1403F5E146BF464C1A4A8E39AE9567E499C23DC90D0882F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222396, "uuid": "efdffc37-e902-420b-b2a8-09b86b574305", "value": "1536:w/xKzlSo7mgV3eG17lbkCOUT7oqlaHvvbFq9GHocnoe1RqfwSOJrpMEIpz2Pg:w/xKzlSoSCn12COUT7o/v096oiBkwPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222396, "uuid": "7bc25f97-f3db-4bc8-971c-1a21e3add99a", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222396, "uuid": "c2a2254d-cb42-42a1-a971-6b65c6b37ce6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222396, "uuid": "83830267-7e63-431a-80a0-7127375d83b8", "value": "info-363377761.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c33b396-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219999, "uuid": "4d16cc05-1a4d-4c2f-8312-b5742b107e98", "comment": "Malware payload", "value": "9769822955319d38698ad1cbbd07c46c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219999, "uuid": "2ea54ede-65fc-4c7a-8fd5-16960a6ba9c1", "comment": "Malware payload", "value": "01a69ab003f460eaf783ec60e995085bfed2decc5253480ff02e3436fc09e04b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219999, "uuid": "353c7c38-ecd6-4245-a311-2be279696aa6", "comment": "Malware payload", "value": "3f784cbccaa2de405e69cc34c9acf93033aad280", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219999, "uuid": "e9fff5f1-8781-44f1-a9da-87fd22df47a3", "comment": "Malware payload", "value": "3b4913ae26df8f6388bb42807ee74a5538b22ca60f655a7d1f4ff982a9c02d637b3b31d131e68cfad555c6050a3bc664", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219999, "uuid": "e4a734d7-adf1-4871-8434-ac426970d429", "value": "F08312FC792BE3DDA97084DDDC6DB1E706AE49699049B0925C0B3F322060BFEE815539", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219999, "uuid": "0d5baa47-e0fe-4188-80b6-57f56cacfa9d", "value": "1536:vKruams3cgHHyQZiwotTC3pjHjoB8+wXdpUna5aha2dmTLUVVv6P:p+3pwvtTC3pjDXinakpmEVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219999, "uuid": "ac32eaca-7a39-4872-aa0b-4c95017ae910", "value": 86930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219999, "uuid": "9588456c-d6f1-4465-a69f-361fb448c44b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219999, "uuid": "9c3b2fb1-0d40-4393-9794-f3a39f73b863", "value": "catalog-459471283.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702ffa6b-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217858, "uuid": "9a578831-58c5-46c4-9929-297d4a045584", "comment": "Malware payload", "value": "fbe8cb5b0488b0875e7c848ff01d5867", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217858, "uuid": "31a79fc6-ed73-4f09-b5aa-9259dd038ef4", "comment": "Malware payload", "value": "01abb2e8d31a89318f2ce5d9f509eff48a773db2c12f669d39a2da5231eacb0e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217858, "uuid": "3c2f5f42-2d24-4adc-9c81-a1eba868247d", "comment": "Malware payload", "value": "7f5ca16e9d26ea9e231b9e7e0a11397f2e11c4db", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217858, "uuid": "4c602f87-b61e-49b5-8a15-74f223aff729", "comment": "Malware payload", "value": "720ae149945dd8b208bd8027f27b02a57595db1b36814683a4e28d5621228f33bfbdf643900b3f26a9d7d89dd5e8a772", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217858, "uuid": "a50afe83-f0c2-4ea5-a8c8-767e6956e745", "value": "0683028BB4E9433ACB3513F65CAE1E0422B1A47F140CC6DC79973B786B53672A572388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217858, "uuid": "93068830-1d7a-4555-930a-11f944bf27f7", "value": "1536:cAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvX:cijtuPmU9j7+XFWtYe14hbOj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217858, "uuid": "437c61fa-9a81-4cc0-a7fe-afc2601d46f4", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217858, "uuid": "4b58d8bb-fa53-4e7d-aa0c-c35f3d3afb78", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217858, "uuid": "841114b3-cb01-4e39-9ca6-e005eee0558b", "value": "catalog-1199491177.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a520da-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218288, "uuid": "092fce84-3c77-424e-bdf9-9762db5b5565", "comment": "Malware payload", "value": "78281e9856bee789b80a1ca4b85e1cae", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218288, "uuid": "d9fc2349-1595-48b8-becb-e624b111f97d", "comment": "Malware payload", "value": "01af471dc5d0c286db46bb7075194ffdcbeb09e088e8bdbc8f9151042832c392", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218288, "uuid": "843c9c15-a72c-468d-9f58-1662da6fcc7c", "comment": "Malware payload", "value": "f4f173a44852d2bc1648e98faf9eff3708503e33", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218288, "uuid": "89a670ab-7aa0-4061-98f2-2237f4193cb7", "comment": "Malware payload", "value": "f637500859f0081be2b9ffe88557de3aacccbd5e9fdaa6dbbfa86f6d327fef47f372c13bd24eb3dc12610a3c1e5e8053", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218288, "uuid": "0883f272-3e3f-47d1-8900-14ae443f4d8b", "value": "818312A4C79E0CD4C1558E0D7B22F868B901711C312865E7FA9D58B57B538D8A2B3DF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218288, "uuid": "c347e808-2dbd-4b89-91c3-7d80f3697c71", "value": "1536:5EBf1lwz7up/vqBuKXxP8JXvKDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnW:5QcvuBvaXxP8JXoM25NfuQjMCYNBwlty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218288, "uuid": "44253e50-63ba-4650-993d-a720b5d1b514", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218288, "uuid": "43688d4c-a115-4434-ba9e-6635892da7d3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218288, "uuid": "26575208-c0c2-4bff-9d45-3b52a2cea09d", "value": "catalog-1426666473.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81312ff0-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221752, "uuid": "9d20d290-6f1e-481e-b083-e41b154ec24d", "comment": "Malware payload", "value": "25b85a80fabfd1d4819539296d3e1492", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221752, "uuid": "e8cee67b-ba2a-4bae-a37d-7e7e78eb4217", "comment": "Malware payload", "value": "020b4dc019dd122acd41f3cac810b5da6f9a772ec3b574a5d7ebc3c8691b78b0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221752, "uuid": "6a89810e-38aa-4c1f-a370-b17758d092ef", "comment": "Malware payload", "value": "f10b9a840328e09c24bd9cfe24c9c91dcb82f947", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221752, "uuid": "05a5d24a-db79-47f6-99dd-c86a4bdfcdb3", "comment": "Malware payload", "value": "e47710d6ed90e189ccbfa11d81c5887472eb7650efac1d2692d4d2bf1843a5c78f3b6d34b60b86fb5032f51d9270002c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221752, "uuid": "cf45356b-0688-481b-9ed7-e929fc63938a", "value": "468312ABE5376CF9C19DF2D7A22F624C36EC85C0B0364286F61E3E16C5996ED550480D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221752, "uuid": "a776e26e-8755-4d09-82c4-0c4094db05ea", "value": "1536:RHZbN5m6RtUlLHfAkZ8kISNq7xWgwMQZcUT7oqlaHvvbFq9GHocnoe1RqfwSOJrB:pBm6XUFHfA210waUT7o/v096oiBkwPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221752, "uuid": "c79a152e-8643-4573-babd-4f3ccecae9c4", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221752, "uuid": "7239b9e0-7dad-449c-a80e-af64286b0735", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221752, "uuid": "badcceb4-f6ff-43c9-ae44-4bb9cb6ddb2c", "value": "info-1858079439.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d41f753-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219464, "uuid": "9a31bd0d-8516-4aaa-b6a2-bf794d2b151f", "comment": "Malware payload", "value": "88fd9f55ef9958e7380057505f51e971", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219464, "uuid": "de792ceb-677a-4611-a2e6-defe9d33c80c", "comment": "Malware payload", "value": "02194c83d2669e0ef93ce30616822ab9ed0ded63d5bd81ee0c927749a6ec5dff", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219464, "uuid": "d3d3bac5-fc82-464a-bdbf-bd91f24b2d72", "comment": "Malware payload", "value": "7b80a1ef19cd054e12b0e9c86b4327b0f604fb38", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219464, "uuid": "799172ea-3178-4f98-9c1b-bdf6ab63f58b", "comment": "Malware payload", "value": "ae47eb56dd094dd8e63d3328e57c24be923b7584948fc38e4754bee841a35d941ab11c1dc890c745a8fde2ee4399629e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219464, "uuid": "0e12faf3-a951-48e4-91a4-b9e4011a4203", "value": "168302EA71E60C6858FDF51A1A6F79552DF8F3A18F721336D38684366CF11889CD0304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219464, "uuid": "4306d83c-b14f-4552-bbce-a4f73685e654", "value": "1536:5xRn2hLUf0IPct4r94hhs/9AGEiFALqCJI3+xOtGkwdO2eDiFX9:XR2h6PceEaKUFALAOxeh4ONqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219464, "uuid": "9fa2ea56-fe9a-4a9f-bf6a-2d38acf3fd00", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219464, "uuid": "d7463856-c0e4-4e92-b224-b9b1ddd0257c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219464, "uuid": "d52968ee-2d4d-4f89-a77d-a87dac5f9a4f", "value": "catalog-2103382502.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e450fb21-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221918, "uuid": "15132958-a6e5-412c-b154-dae3080a2351", "comment": "Malware payload", "value": "675c1db117f8ec417a1ecc92c5c2bd5d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221918, "uuid": "c4a94fd6-d8ab-457d-becd-bb1688231eee", "comment": "Malware payload", "value": "0228018fdda5e443cf351592e7dd817f35cdb78c043eb4ff6d6a9489c1d4afc2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221918, "uuid": "813e6d14-2733-4604-b9b9-1a34e35df8d6", "comment": "Malware payload", "value": "33c2600fd4633615bd234cea51a4d7150f6d999d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221918, "uuid": "5b7d3c65-e4b2-4d38-b77c-eee3bb18026e", "comment": "Malware payload", "value": "0e98cb611c57a362f71b47416d0765a8ba4e024f9941172aef4c6eed5498825511f34f325389ce22fcf39eb2b51c7578", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221918, "uuid": "ce280c02-4525-4190-a00f-869d33733fa1", "value": "6A830215A4BC866780F305A229307BC78AC0EB9B584DC003F1348E27E4E6BB6857BF5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221918, "uuid": "dde42ed7-6fd7-44b4-8caf-49fa1443d3ac", "value": "1536:it1QVGeGug5dwSp6yMvBjqqxM5Y2VXw1QFsrGq9ZMlmZQTQdu:+AG7u8l3MvBjqqqXw6Af5du", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221918, "uuid": "dc8e7928-0857-4af9-bf59-5919c30b5749", "value": 86792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221918, "uuid": "4da1183b-7551-4e71-86e9-ea620d133ba7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221918, "uuid": "68b2ceea-5e56-4a3c-a589-1f8124a3686a", "value": "info-19750076.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f31c5b99-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219796, "uuid": "2057218a-662c-45b5-80ac-a0df1db7c6f7", "comment": "Malware payload", "value": "6ccd4b064df90f8046db291df9155079", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219796, "uuid": "3ba3217d-9ec1-4b76-9d09-dd61daf37560", "comment": "Malware payload", "value": "0246984830cbbe6ac2f70c2904b8ade1a2ddc0af682e9999b36df5f6f014e278", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219796, "uuid": "517dab6b-3cf9-49bd-994d-e75de00eafc7", "comment": "Malware payload", "value": "2776dd35199a49004f06a41306ac8bd6178c1215", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219796, "uuid": "a8ded168-8df5-45ee-ba88-ed842d43190c", "comment": "Malware payload", "value": "4dfeb9309f773ee584edac971f8d22be6f4007e2f50a10948078c0ae3bcc97dba18cf402ac10485b9ffacfe7e4427a1e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219796, "uuid": "855d4e33-5f13-455c-a71c-61b4dce2b781", "value": "108302176BCB71328046E7B14B352B09B653BEDE540C6056DBEE4778FB3205568AC1D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219796, "uuid": "63410068-bb7c-4ae4-b3e2-a237ae6d28ef", "value": "1536:GRn2hxVTZQ72ZTYzqcIxxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZiZtW:GR2hxVB6IzJ9a03fjwe1moYpoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219796, "uuid": "c6338316-43ef-4fc0-9212-55be5dd8e812", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219796, "uuid": "cc11fd30-906d-434f-848a-3ed4df4afc13", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219796, "uuid": "9c5434fa-0683-4481-a724-7fed4349c394", "value": "catalog-339158506.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c9dd6ef-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218255, "uuid": "88f08674-905e-400b-b6dc-1a476740279f", "comment": "Malware payload", "value": "50bbcdd85c38926543ac72af4452593a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218255, "uuid": "956415c5-ad84-4da0-8939-80fb0df4a1b4", "comment": "Malware payload", "value": "02907767e0dd99f20f53327032b258dcbea4fd26162314b1806df799901a9657", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218255, "uuid": "c551afae-eef1-474c-a404-df1a33c9bc42", "comment": "Malware payload", "value": "27bb5d4f88b000438477fd98b96b6e7a5f753f70", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218255, "uuid": "c419f3cd-4fc2-4eae-b684-945a03b1a002", "comment": "Malware payload", "value": "7f729829e3807e93bb783462fd1c650ced10ebf6c212568d4b374bfd6a8144b8042b1665987bee138bdfe1976ba95ccb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218255, "uuid": "e77360f3-be21-486d-bb30-fbde6bb56274", "value": "C0831277BA712DFC1822E521F128EB5E29FE2E43B155085DCA7C153751422EF3E942A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218255, "uuid": "97ebdaec-8f9a-4735-974d-87c54674bf20", "value": "1536:yMeaAK6Vo+9WNqQaiwotTqFUAAWBu3SNZzTJAsB0Ic6DMADMt5zC/IDIz10Gl:5VAPocWxvtTqFqCNBJAIlcAGIz1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218255, "uuid": "69050fb4-cafd-4f34-a96f-a72eb6c6c7d1", "value": 86930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218255, "uuid": "3ff7d86b-f866-491e-91f1-6c0603c4b123", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218255, "uuid": "f8b33bd8-203e-4f0e-977c-9e65ba105fe4", "value": "catalog-14145903.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9a92a6f-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219753, "uuid": "3b0cd08c-0145-4275-8ed6-4e919974e386", "comment": "Malware payload", "value": "47e1196422ecb67919d50d00b4cb46a8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219753, "uuid": "eb93e25b-f054-4365-9310-94fdb8586bdd", "comment": "Malware payload", "value": "0292fb5eeea82213b3e2fa97ecde4c4edd0b50ccac836858aab190ef23a05c18", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219753, "uuid": "70794ef6-84fb-418e-ba24-7fcad1ba8faa", "comment": "Malware payload", "value": "87bda4c1e356f79cda0d7b3cbd68024ce620aaec", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219753, "uuid": "e7b5e598-c606-407a-9433-28e8953b4685", "comment": "Malware payload", "value": "6d98316c0c8466ed10326aff923396511bcaed556dd88751b584cef93298f26933a7553d3226cc8c25d7cd8495dbdbfd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219753, "uuid": "eea80ffb-3db9-453c-bc7c-f918ec0611e9", "value": "918302EC70238A76637345AAD97E94C32B5B8BBC441DB056A82A69364A307FFE121531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219753, "uuid": "368f3bfc-a472-4819-b555-87fde3b7bb8a", "value": "1536:LzKTWDE4Qgl8LS4v50FC+p7UjoB8+wXdpUna5ahL2dmTLUVVv8:LeKDPKLRvaFjp7uXinakEmEVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219753, "uuid": "a5ca79d8-044b-4c42-8566-61b807aa4232", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219753, "uuid": "03fa591a-3735-46e9-a69d-df1ebeb12d4c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219753, "uuid": "2b2a2efe-9770-42c0-8749-35a7f7d426d3", "value": "catalog-321925130.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c09e2f2-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219918, "uuid": "64395c7d-154e-4514-8c43-066a4e99814d", "comment": "Malware payload", "value": "b85d0e666860a0b8262376900d2d6288", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219918, "uuid": "2d8def4e-6441-4113-9fef-623b944d8da7", "comment": "Malware payload", "value": "02bc3bbff74e5ee900104c5896cba9e48b15b63450b93133370ec35a9a2034f6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219918, "uuid": "e4deaaea-32b2-41da-b605-b49909add620", "comment": "Malware payload", "value": "7728485d8aa389ac3e2bf37aad7f34757fdb8a40", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219918, "uuid": "d7292eea-980c-4565-a93e-1d947ff01088", "comment": "Malware payload", "value": "3062795b82b454dd4d8a6003f81a6a831aa5dae45e7703bbe66c22f7b10077024205a9fbf99824e8048602631f1f63e0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219918, "uuid": "8216af96-1306-4b13-9cf3-cffcaa74002b", "value": "5E8312EC74238A66637341EADD7E90C32B6B8BBC441DB056A82B793649307FFE121535", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219918, "uuid": "209ca5e8-c9aa-4be4-b126-7d500494f76c", "value": "1536:4zKTWDE4Qgl8LS4v50FC+p7UjoB8+wXdpUna5ahL2dmTLUVVvD:4eKDPKLRvaFjp7uXinakEmEVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219918, "uuid": "9f7de440-7791-4b93-a336-520423eba093", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219918, "uuid": "5368a39d-7206-4d7b-96fd-acc7e1ceff2a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219918, "uuid": "3a503414-a07a-42b1-a9f2-df109dc28533", "value": "catalog-416369060.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "412d3329-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218209, "uuid": "60ee303f-ecb7-4876-8c53-c2d0dee883c5", "comment": "Malware payload", "value": "696fba26e25234687f1e583464da075b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218209, "uuid": "9dfaf227-1851-49d3-8b31-71aaff04aff4", "comment": "Malware payload", "value": "02bc9d792f4d1443a13a69f9803e32396d5a24cba08b493d682336817a6197c7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218209, "uuid": "5bb12c8c-5085-40fc-860c-fba6d9f6b216", "comment": "Malware payload", "value": "cfc422d1aacadae4edebcf1a1bdeff7b109793d7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218209, "uuid": "b7dfd8af-8d9c-4ea6-8a45-7838a9574e48", "comment": "Malware payload", "value": "675cb69ef6b820e6e7ef02a9e4ddd9609deb676f1c126a270f1d3d6402a98950dfdad151e42cd6fd9e1116a5396b9427", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218209, "uuid": "e6672520-d90c-45ac-bf48-7ea2a85fc70e", "value": "188302CBF9E4436E473526B3986D0F455A40353F401067AC26B936B4AB67E77C8AB2CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218209, "uuid": "ea5186f3-4f23-4bec-a6c7-ae9ee30ddf59", "value": "1536:qE9eaAK6VMMJDrlBQNdZ2rQD2FPdoeVadrj7ZIXFWgKilkAq14HE6M5XL2l92Vy8:qyVAP71BQwQK3U9j7+XFWtYe14hbOjh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218209, "uuid": "09aa72a8-aa19-4416-a625-fba9fbe6a1b2", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218209, "uuid": "a3de05d8-801d-4d50-8297-d294dda531b5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218209, "uuid": "06672ea4-e1ae-4fc6-b3d8-d16ba0a3bcc0", "value": "catalog-1394615550.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1371f469-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219850, "uuid": "97d7bfce-4ce7-4c74-a73a-d4d1980d006e", "comment": "Malware payload", "value": "29edccb54158fe7331292dc5f85ab346", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219850, "uuid": "b117bd86-988d-4d34-ac19-285372297590", "comment": "Malware payload", "value": "02cb65a693599a37662656ba7b8de45bde74a5fd3af113edfeeb8934527e46da", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219850, "uuid": "21eab5ee-22a8-41e3-a609-fca1dc890808", "comment": "Malware payload", "value": "6276ee1fe3e98ac40471bc991ae8c8979f452d9d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219850, "uuid": "0dfa10de-c70e-4544-8e14-66d21b8017ce", "comment": "Malware payload", "value": "1b4abbfe41a88046569d78c855637c7beb9de03331a4b064ca1feaeac06ad67d188a38dcec826e38845a4882c3c9a52f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219850, "uuid": "e3bad51d-3e3e-439f-812d-aee9a5df6481", "value": "508302E925423ABFC8FD951D246F3D402EACB2E56D2201F7D206D93770F5A98D4D4318", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219850, "uuid": "99fddfa3-0f98-49e1-ab6a-d506b535eff2", "value": "1536:gF5u1k94TfvqBuKXxLG1ZQUcDwiFALqCJI3+xOtGkwdO2eDiFXu:gF5fsvaXxLG1ZQUcD1FALAOxeh4ONq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219850, "uuid": "2e90679c-5379-4d42-9e6a-69b3e62d51f4", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219850, "uuid": "2c00f67f-44c2-41fc-a68b-58d993d58ba7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219850, "uuid": "bbe12026-34ab-4dfc-8d7d-b837647a3cce", "value": "catalog-376004201.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "907461ea-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218771, "uuid": "81557a9b-37db-4216-ab8d-10ced0bbf277", "comment": "Malware payload", "value": "e121b35464ea4bf2fd9bdbc615fa02c5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218771, "uuid": "d14c7f39-ef5f-457e-b200-b4ac8457a41d", "comment": "Malware payload", "value": "02e2d30bcdd21cc92c29fa19ac3a142630380ee986cc4bcd7855eb12e0773b65", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218771, "uuid": "541d4494-7029-4949-b962-6cdf7935b857", "comment": "Malware payload", "value": "79b78d84acd8dc4f87cb1b304d34de9bad2547e9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218771, "uuid": "ea30da82-1d64-466c-9145-9cd362e0ac49", "comment": "Malware payload", "value": "169f09ccaad96176d5021236ef7bc8303ff47350dd14bfb4ccd5a1c1f7284414fc24356563da71b30ccc056ed77601a6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218771, "uuid": "c402cedb-456e-4552-8639-8cdad8fbc339", "value": "6E8312FD7A1F94D4A67096AFC5B7A4D12B918AF8D41D70B3090A3F3AD460AFBB121170", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218771, "uuid": "2668e182-bf8a-4e03-b23c-03c621f7ffcf", "value": "1536:IAS5fEoWthIDbflm7UjoB8+wXdpUna5ahL2dmTLUVVvP:IASyoW4w7uXinakEmEVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218771, "uuid": "67372bd4-5174-4dfd-9975-01d3de5af4d4", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218771, "uuid": "d9c7d0b7-38a6-4edb-89ce-f13f788fe80b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218771, "uuid": "caccbf8b-3a3e-40c8-8bff-3ec0bcf76580", "value": "catalog-1707363884.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "429a85f2-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220358, "uuid": "d5495845-c2eb-4118-9696-4ea188dcd802", "comment": "Malware payload", "value": "da7e987390883d32fb72fb9dc37b22a4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220358, "uuid": "5d31f756-09ce-4f98-bfff-80b71ff94fe5", "comment": "Malware payload", "value": "02e44892b3f3c751020a599c97ac4f3b152984f498775fcc0c95e3e490147758", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220358, "uuid": "35c61c93-2fba-4456-844a-5adc22cf9a82", "comment": "Malware payload", "value": "d2d9abc6a37410d8346c1d5b9360df3a6790c251", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220358, "uuid": "32bbffe3-4b59-4e16-a5ab-5ea201d541d0", "comment": "Malware payload", "value": "655083b2dd7f761c65b716843bf8a6cd106c6a0af3dad65ab5fc65783b0d08f50cc3074bc8bb7449bb82760f3687c151", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220358, "uuid": "372f40fd-b6aa-4daa-9f0c-161dbb3e2666", "value": "CE83121A99BD1CD9C0BB13F00D73094D4860EFAD411C8449F10AE68F78AEE85DEB3AE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220358, "uuid": "0d2aed6c-0939-4a6c-a68a-e66efe99e686", "value": "1536:/t1QVGeGAg5dwSp6yMvBjqqxPGLuhCWdHsh1oSFWsfEFhHqLWw:LAG7A8l3MvBjqq5OsZdHAO5hKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220358, "uuid": "c4ee2a1e-c2b0-4087-98f3-f52f5ef8ca34", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220358, "uuid": "b34e6926-3e9d-44ea-b393-fa77ad257e4d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220358, "uuid": "5afd0a74-fc5e-4352-8e4c-4953cad27dc5", "value": "info-1108025015.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a8d9d0-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219845, "uuid": "c8c99201-7cad-48c1-9674-be9d440657f6", "comment": "Malware payload", "value": "2c13aabdaa9c1f16887dc2e770a49a6a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219845, "uuid": "ecb975a7-b512-4b43-8e63-aef3beb9cf8f", "comment": "Malware payload", "value": "02ed38894842509e3e1c314e0fe7f51e2d76de31a1eb07b321e8195334e43af2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219845, "uuid": "e5384017-65a7-42e3-b388-382221a1cda1", "comment": "Malware payload", "value": "bb0131774d975bd1c07fb5b8ad3d5755848393ce", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219845, "uuid": "fa6ae993-719b-4d3c-973f-68e56fc5d322", "comment": "Malware payload", "value": "7f63f6dc80e720396b6d3a010ce76ac8e320c1ffdc3d04b0dcacefa097cd80191d241d6aba3643f709dcb29697140db8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219845, "uuid": "18da568e-956a-48f6-84f2-72eed436776e", "value": "F48302CBE9E4432E473526B3986D0F455A40353F44106BAC66B936B8BB67E73C85B2CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219845, "uuid": "1cc66bc0-a5bf-47f5-903a-5a6d581ea0b6", "value": "1536:rEIeaAK6VMMJDrlBQNdZ2rQD2FPdoSVadrj7ZIXFWgKilkAq14HE6M5XL2l92Vyq:rzVAP71BQwQKLU9j7+XFWtYe14hbOjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219845, "uuid": "43fea7c9-3788-474b-9194-610a97ededef", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219845, "uuid": "95323ec5-2518-428f-a55a-f4b97c686a1d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219845, "uuid": "958d1c4d-26af-47da-8ea7-6f928e761f1d", "value": "catalog-37537838.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36209d53-a43a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1619185548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619185548, "uuid": "4c0424ae-f603-4635-8e4e-7290f0f31787", "comment": "Malware payload (Formbook)", "value": "14e8a51e1fc5d212d5198b8c50ff20b1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619185548, "uuid": "b6eed0c7-6291-448e-9b2e-6711c3b0fc99", "comment": "Malware payload (Formbook)", "value": "03053e470fefbdd6193ba38d6b77dcaa62ed233cc8f753788c1ad7462b32d37b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619185548, "uuid": "5b0b049f-cd34-4eb6-bcee-ab1c1f1df2b3", "comment": "Malware payload (Formbook)", "value": "25f5b54c16affdc44232eccf7f1e5087ff18b11f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619185548, "uuid": "7fde522d-1796-4d2b-a51c-714bb031bde4", "comment": "Malware payload (Formbook)", "value": "7bf2e36e3ff61c1e0ce367078e2962dcf79ee235e510ba19c8bd78ee040bda966b39bacf3a919f191b21239b1ca86325", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619185548, "uuid": "da0ea851-fcc6-45bc-9ea0-0d706d050661", "value": "5505335C334508CEFA8D37A8DA13C1962CD42E45DFA0D9D989FAF812D51CDF3C4166AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619185548, "uuid": "a2f405de-7c97-4264-ac55-8f32ee1021fb", "value": "24576:70g81Dju9kt1LRRmXfLjoeupsXMP2/g6LjRj07dw/t/T:70gq/u8+PLkrcMP2/nBWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619185548, "uuid": "560f70ee-197e-422b-b7a8-e3f5f9caa3bb", "value": 830393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619185548, "uuid": "21465c4e-04ba-4909-b1e9-886e5112dfb9", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619185548, "uuid": "ddca036d-42fb-4872-8b82-05ecc840635c", "value": "_New Inquiry pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a166ad4-a427-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1619177448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619177448, "uuid": "5c69eff9-13b4-4a7d-a98c-427bf5381e2a", "comment": "Malware payload (ArkeiStealer)", "value": "8c0089d0542de84a876d22874208daa3", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619177448, "uuid": "7df42c73-e481-4887-a8fd-9f626680a633", "comment": "Malware payload (ArkeiStealer)", "value": "031def4c4a5777dfdf5a789590e26cc840ca75db0e51f02cc45b954a407b1ecc", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619177448, "uuid": "0d8b8b15-69be-4705-9d29-7bb4464107a0", "comment": "Malware payload (ArkeiStealer)", "value": "246bd6d1715acdd15cdd8cde4e0227812985dbae", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619177448, "uuid": "4c286c69-84ee-48dd-9cc9-0f5069967046", "comment": "Malware payload (ArkeiStealer)", "value": "0b622d4958b2d89a28920c9c8c13c45b09fccad449e0dbd436fa609301968f165b3d4e3a570651283cd98c6576be6cb3", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619177448, "uuid": "f62a40ba-cb71-45d0-bf9c-75a7eabd3f8d", "value": "F6D4F01133E1C232D19214724525CFB18FBF38351A299AAFBBC05AF91F657A1EA1631F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619177448, "uuid": "c39d2977-ce64-477b-b5b2-89452d471cd1", "value": "23f1e68344716b56a4d1f4cc32903797", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619177448, "uuid": "b6bb2d3e-9282-4695-b133-d72cf1b7656f", "value": "12288:VoXEuYj+f/DhCagKF1VSX25c2rfNQ/4v2d0afLXhnJ9ohj2Dvk:VgEDqf/DhaKF1b6sygeLhJ9ohj2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619177448, "uuid": "6c2db417-6149-4f1d-96ec-7f3dcb513d15", "value": 651776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619177448, "uuid": "5abc3ac2-3538-43ca-8742-7ae3c2dd02f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619177448, "uuid": "29585061-3bb3-4d72-9f7e-7e6d6380ad84", "value": "8c0089d0542de84a876d22874208daa3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83275330-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219608, "uuid": "5b0c0848-44dc-474d-a312-d2816c9ba29b", "comment": "Malware payload", "value": "4f50a6c6dfee6efdd1a94cbb3cfc19c7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219608, "uuid": "e12af4dc-3631-43d3-b67f-cc47fbeeea69", "comment": "Malware payload", "value": "0332e2edebf6a0c4aecf226c10d8d654e25c22b24ff56269b967a23b2fb236fe", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219608, "uuid": "03180d69-2e3b-4e05-9531-6978ca2c8a99", "comment": "Malware payload", "value": "7b091d815c3d17009b49f8d46c99541cf941088e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219608, "uuid": "cb54804d-1eb4-46d3-a1a9-e6c1fb6be428", "comment": "Malware payload", "value": "77793daa6a8f421f3acd7c70d91b94bc6406d915b262b112456ca44452d0c94bb4bb9a7ab401ce37becb8a0b52e0081a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219608, "uuid": "9c921608-0727-46f2-96c4-51e796bdac0e", "value": "35830298CB9F8D948005ED0AAB12F8ED75506248716973BBAFAD1124FF478D5B2338F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219608, "uuid": "7e7feb0e-e047-443a-bd5f-37a3842ca691", "value": "1536:lA6P7EGmwH1zVQLQDYflSJXvoDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnt:lAY31zVQnIJXaM25NfuQjMCYNBwltD0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219608, "uuid": "b00a1523-132e-41a0-a519-57d85bdc366b", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219608, "uuid": "5429dc6d-f112-44e9-9b7a-ab697022ca63", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219608, "uuid": "0a7ccd25-fb68-4a9a-a152-5544dc042f73", "value": "catalog-236681968.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d06888b-a41f-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1619173883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619173883, "uuid": "ba0e4b68-c847-475f-9192-c37ee64397d1", "comment": "Malware payload (RemcosRAT)", "value": "030daaca1bd4fc284e4b4ab63d1b6419", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619173883, "uuid": "da09c506-87fd-494e-bade-e490f612d7b5", "comment": "Malware payload (RemcosRAT)", "value": "033f4d8bd914597ee146ea8761a3f79fceb4f49af99f411e9ee94775ed298179", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619173883, "uuid": "46c219c5-d5ac-4996-949a-d0b8b0259780", "comment": "Malware payload (RemcosRAT)", "value": "088aa59dc4185f60d450087899a4964957e49319", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619173883, "uuid": "9910d57f-b95c-4df0-8de2-8c6564737a14", "comment": "Malware payload (RemcosRAT)", "value": "c13756bb976bb85727ad0eb44592e591984dec91a85b304a727416cc749dd2ec5558b0429b94298cc4dcab2a9b1a73b3", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619173883, "uuid": "b33bd64d-dd78-46c9-86de-5d887a815fce", "value": "8D83F26623A0C5F3C7331BB11F392B63DFE6C9121291938B5B849BD9B5676C2490F683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619173883, "uuid": "e365d053-480c-43e7-b94a-66860e86e41e", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619173883, "uuid": "97d3d0b0-642c-4a26-a3e9-fb495aec7900", "value": "1536:FErU9XLGOA9yMHI7jsOzDcXbdThA9b1MbI3E3w0EXv5LJxZKGCl4p6cnF:FEre7GjyCaFvcXbdTq9b1MbIUb4RLJxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619173883, "uuid": "93f6fc40-6174-4c0a-9c2d-e81e202bf8ab", "value": 86769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619173883, "uuid": "13441b51-c60f-4976-95a1-413f59678dd0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619173883, "uuid": "d8074faf-55e2-4804-a770-72815c377d6a", "value": "0900000000000000000900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab54743b-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219246, "uuid": "53aaf98c-7e4c-439a-a6c1-b917e6dd47f8", "comment": "Malware payload", "value": "51bf7be2297b6c6a51fce03adec23d44", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219246, "uuid": "1790b363-93fc-4589-afe9-458c63c751d4", "comment": "Malware payload", "value": "035c465052f743667dd74788f984aaf8f65c98675a2d59bd4312bd1ae7a838d0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219246, "uuid": "19a54bb1-c60e-4d75-8edd-576d5861dd3b", "comment": "Malware payload", "value": "9995c132cf3a62cdf4c7493ef2472825c93de9f4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219246, "uuid": "97cd13f5-650f-400a-9607-83f7ec581226", "comment": "Malware payload", "value": "73de0983e74fe9f25cf7aa0238bc769ee656bd03973ebf03766faa8cf0cf90c9886f07ba4e27703499245e8092a07054", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219246, "uuid": "94226071-5659-4cb2-ba2c-adcae4d9fcd0", "value": "7B830276DE8F8289C016B23003787EA61F686B7146A1141E6BB0747B2F5B9BD4C85FD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219246, "uuid": "2efeb680-2aad-4738-bfc1-2f074706a45f", "value": "1536:JElHCzlWAXdZ2rQD2aCvdyWxaqQ6Rxt5AB/aqPwL3VbCbk:JSCzh2QKmm/Qwt+awaxCbk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219246, "uuid": "8ac76c77-6e15-44c0-80d6-b71ffcafe77b", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219246, "uuid": "7155be41-3e1b-4580-9195-1b00259b2e0b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219246, "uuid": "f1967469-47b7-4fbc-b88c-9f0309d9fce2", "value": "catalog-1956647897.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "729d2c40-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219151, "uuid": "46752729-0607-45e0-8a4b-e4e1bd30e8ac", "comment": "Malware payload", "value": "92272e4a93f4271aea3225c042d74f3a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219151, "uuid": "0eefca91-7264-4108-9420-f8cc7e2c4233", "comment": "Malware payload", "value": "036caf4fa42823e6f50428b25ca6d0042a7283450094e1da0541055c103d74b1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219151, "uuid": "535cfc20-de94-4ff3-907b-7bc249e9392c", "comment": "Malware payload", "value": "8754bd3d95588d4695ddc0e078a08974df70e711", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219151, "uuid": "f4a465fd-195e-4efe-b545-81004b6e224f", "comment": "Malware payload", "value": "7f084b2255b6163db4aa65e0ea94513c943030cc1a8137a47bfd8ef08831bdbbdb3371cb37dc4c7e192254af74374bf0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219151, "uuid": "ed786469-a63d-4077-ac2d-2d6142f20c52", "value": "538302CF74E9433E8F3527F648AE1E046261A43F440886DC75D73BB86B426B265763C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219151, "uuid": "4a822ca0-63b0-4f82-8b10-4057988b3e2a", "value": "1536:5AfNtg2tf2vCapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJv/:5ijtt2v7mU9j7+XFWtYe14hbOjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219151, "uuid": "1839ddb1-b495-4808-950a-3d4eb8152eca", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219151, "uuid": "d2b5de80-9c70-4e6c-babb-097d5bd18793", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219151, "uuid": "ebb86cee-4929-4f67-8c45-7775acb27b75", "value": "catalog-1915364763.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140ee122-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220710, "uuid": "362c5d49-68f6-4258-a42c-690db81d970b", "comment": "Malware payload", "value": "c413a7abdd9ca0e6f72260a265fa586b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220710, "uuid": "ccf4cf87-fdc0-425b-b867-78b864f07872", "comment": "Malware payload", "value": "036e40baa8a90f993f0fefdc6b4aebe0f45f3833e38688e88bef4517df193d3a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220710, "uuid": "1396e7cc-cfa8-4e63-ae75-aca04b953bad", "comment": "Malware payload", "value": "7cfdfda2ee15efa5100b2842a60de87a2a80a867", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220710, "uuid": "377366f4-e86b-467a-a21c-e4c351e83c04", "comment": "Malware payload", "value": "f38e85f9c77aed34e26741f4f04c3d85b93b071c76cfe9fe8faded1c47a2b4e321493abc9b034ae9802657be8886e7bf", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220710, "uuid": "05944cdc-5ab2-451e-ac83-2d68ebbbe654", "value": "D9830215A0FC86A780E315A229307AC64AC0EB975C58C043B1349E27A4F6B79857BF5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220710, "uuid": "fa4f6feb-957c-41b1-ab2b-f421ce229d43", "value": "1536:Yt1QVGeGug5dwSp6yMvBjqqxM5Y2VXw1QFsrGq9ZMlmZQTQdq:gAG7u8l3MvBjqqqXw6Af5dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220710, "uuid": "91c1f088-e0e2-4642-b7c6-7a696eb4007e", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220710, "uuid": "63e200e5-927c-4c3b-9f13-cd3f8b8e1a73", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220710, "uuid": "0d25f359-5101-4099-9584-38475cbaa54b", "value": "info-1329022947.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db265194-a3f2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1619154901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619154901, "uuid": "d2f64492-6647-4b31-bce7-9b929e41a8e1", "comment": "Malware payload (Loki)", "value": "dbf5d7083f7df6217077f5ef95b6796c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619154901, "uuid": "80684fb0-982e-4113-adbb-9a0acdf2aa40", "comment": "Malware payload (Loki)", "value": "03a2ee302d6591e077fe75af3e7ab57860dd031dab177e4c5b320eea272b4784", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619154901, "uuid": "6fea6eb5-2cf3-4561-824a-dfee46602216", "comment": "Malware payload (Loki)", "value": "2f2d5fb42bee95aba29fed8a7f2cdf559fc88681", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619154901, "uuid": "580c0777-06cd-4a84-b4cf-26850e07c1c9", "comment": "Malware payload (Loki)", "value": "1f669a134b7a6123009cc330cb928d90598a21a26bbca9320f185770c45096460b3605f5806ac49184041e76887f2330", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619154901, "uuid": "7ab755a6-c8e6-4fb1-87df-e1cdf839cfb3", "value": "8FC5334BB9D3DB84D1BE07B6A17A5E142C958C106420CD0A37AC3B6671FAB7156C7B0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619154901, "uuid": "faca4c41-1e7b-40f2-9c9d-dfcbe13b2e93", "value": "49152:K+yRQ/AJarpj41f3++hnuxPJppHZqzZM5bjHMNV9rWXOkoSj5jlDVlbhQtFuDI:K+sUpjM9uxfpHZiwfSJWXO5a5FzbR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619154901, "uuid": "a8a058d3-0ff4-4fa9-a6ea-3c5df31fe7d4", "value": 2552320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619154901, "uuid": "bce4d25a-d331-4d46-b5cc-2fb19c3d5a8f", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619154901, "uuid": "bb1989e1-ff38-489a-bea5-6a8eb2511345", "value": "Remittance Advice - MA CONSULTING.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b5eefb1-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221742, "uuid": "e1adacb7-dd5b-4592-b12d-b3b43801d5aa", "comment": "Malware payload", "value": "fd13ea43526749039617097241d399e5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221742, "uuid": "84e10e5f-6908-4bde-becd-09a6a7ef5cc2", "comment": "Malware payload", "value": "03a32e03f048708ff6590640a27447d0692186bd53b3fa8be6a62af716495dac", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221742, "uuid": "5089e4e5-14c1-4225-80a0-cd42fa3e300e", "comment": "Malware payload", "value": "a8a7020ee7509936fcf5253ea8400a9e91af1969", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221742, "uuid": "100bb093-4468-49fb-86fc-85447759cdc9", "comment": "Malware payload", "value": "70679f416875fd7041bf538bba2e86412314c1d20cbc2ef6cded8fa0f68e326b2a1c5bad6b91f9c2a56fe88fc5c05230", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221742, "uuid": "649060b0-9593-4d35-b3c0-c417e8f0f96c", "value": "5883120798BF24ECD07A6BE01D735C4D58B0EF68801C8588F269768FB1D89E64B9BDC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221742, "uuid": "f83e0503-e8b7-4ce0-ba2a-14a73bb1eec1", "value": "1536:najHZbN5m6RtwWdwSp6yMvBjqq1PGLuhCWdHsh1oSFWsfEFhHqLWZ:narBm6XwWl3MvBjqqdOsZdHAO5hKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221742, "uuid": "630536eb-a023-4605-9ff0-47c74397df4e", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221742, "uuid": "5605e6ff-0958-4f5e-b78c-a0aab2e814c4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221742, "uuid": "3bcd4528-1ee1-4f5b-8991-fb21706ecc88", "value": "info-185003362.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea37a4a-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219466, "uuid": "3b4dc212-2303-44e1-b1e8-057c2be2abdb", "comment": "Malware payload", "value": "e4f946236f1185438013d3b6969a1f0a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219466, "uuid": "c0941f18-5cdc-4c1c-a512-e8fbf4ed4d4f", "comment": "Malware payload", "value": "044eaf523605af964ed2078468a2a2a8151505fe2b3f3d138a43d03897bee79e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219466, "uuid": "c0e87ce3-0919-46f3-910a-6b497a27f987", "comment": "Malware payload", "value": "6f1043dc1c2501222056adaffbc9d0d748ba6242", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219466, "uuid": "e92c8ed8-9953-43df-87d6-47c2fc9c8590", "comment": "Malware payload", "value": "071c10b5beefd9f48be3ff9797877e228da0516cda74abdaf80a6a86317b68a76592396bcd07f7f41ba5667c0beca36e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219466, "uuid": "21ddd161-4193-4965-8300-5bd9ad454a00", "value": "AD831232FDBA2BCC5C1DD820D0256DF4496FCD9A959333B859682D32208D67D6B019EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219466, "uuid": "1da4f987-6297-47a2-9223-a0c738846643", "value": "1536:Tg2sNyMfHfrqQaiwotTqFUAAWB9Te87VqINbtezgVRxr9AiUrQTKXs8FI+bG:ZM3XvtTqFpe8JqmdIrLjFRbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219466, "uuid": "fad7304a-88d4-47f2-91a0-58f8b0e23b80", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219466, "uuid": "0e5bff61-0753-48f1-8561-da4bd4b627b7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219466, "uuid": "80da9359-0f94-4576-b5c2-98e5eb0c0dbb", "value": "catalog-2103531279.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9130fae9-a484-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217484, "uuid": "71ed15d3-eb29-429d-8b1a-a1dc3dd23abe", "comment": "Malware payload", "value": "2ae6d7e5ba12e6a1540a2491c6781eeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217484, "uuid": "306114ee-6956-4fb5-ba2a-01e867108ba9", "comment": "Malware payload", "value": "045b46f34cbdc86df12d0da280d979a517b4e8a94cc44c34403767119ec959f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217484, "uuid": "5b1f57ed-b5ab-4521-9835-ffc36097fc53", "comment": "Malware payload", "value": "67ad46d9e7094f8b899a0719eb6126ac5f0246fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217484, "uuid": "7949869f-5ba8-413b-a4c6-f2703b67e6d4", "comment": "Malware payload", "value": "5bcee563c2d78beb6b9f6a2834e2530601ef7aa5c4d668b344a5c88613fde9a8abd2d283932a6e23d725d831bd9bb9d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217484, "uuid": "1021a93a-4eda-453e-8bd4-3d848d1e0469", "value": "598312EBCFEA49988202BF0773065DBBB454280C6118BA7A6EDD11506F524E0F4B7DED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217484, "uuid": "18140fea-f55d-4aa5-a395-3f55ae118853", "value": "1536:PZKLWkP7EBmnbRARpNdZ2rQD2FPdo1f+5ff9fuQjMCYNst+IHClPLqkwD0DCuADX:xKLWSFbkpwQKW25NfuQjMCYNBwltD0D0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217484, "uuid": "dd05ba4f-47ee-47e6-aaa6-eccee1e4b241", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217484, "uuid": "a2e6da60-b134-46d7-9561-cea0443eeb14", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217484, "uuid": "b25477d2-b5ed-481a-bfff-838b17ff049f", "value": "catalog-1032741382.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ac7bf3-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222140, "uuid": "475d481e-317c-4b5e-a10e-7eb2238af47b", "comment": "Malware payload", "value": "dd08431bf34bc04d871fbc7f54de4998", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222140, "uuid": "3d24d963-1357-41c0-8a95-b2fa2987eb44", "comment": "Malware payload", "value": "045d3e55a9c7b4f0bf961a6df189d8d611808e442b09572f7da0ac1ebe5bba69", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222140, "uuid": "c687ef94-6313-4122-9e3e-5b5803773b61", "comment": "Malware payload", "value": "dc95a640cd8e563682fd7adeccfe10a764e01a78", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222140, "uuid": "e3e72be4-9e57-48c4-b22e-6b95bd71aa9e", "comment": "Malware payload", "value": "432c72bde3d614ab9ed296ed46c555b3bd0ddb09f89609c5393dfd7cb1121b8aeb445fa7c5c20fb5afee99fa5054bd26", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222140, "uuid": "0558c48a-8266-4564-b2f6-6e9491044184", "value": "628302E6AC779C1D828ED2B5403F5E146BF464C1A4B8E34AE9177E499C23DC91D0882F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222140, "uuid": "cfd5461c-a8ef-415c-9bc3-c590d0440447", "value": "1536:maxKzlSo7mgV3eG17lbkCOUT7oqlaHvvbFq9GHocnoe1RqfwSOJrpMEIpz2PP:maxKzlSoSCn12COUT7o/v096oiBkwPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222140, "uuid": "204ce34a-c0e6-4f53-95c2-8b436695549c", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222140, "uuid": "f6e1e30c-c976-41a0-9a37-55c82d27b6e2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222140, "uuid": "8adec008-37cc-4ca9-8a65-005a268d3666", "value": "info-215306962.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5341c5d-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218001, "uuid": "aa9c2808-1ee7-46b5-ab00-1872ed67b26c", "comment": "Malware payload", "value": "c773cdcb41b4a3fb271b541d7fa884aa", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218001, "uuid": "f81cf4f9-78ec-459c-a097-49d784677e19", "comment": "Malware payload", "value": "048b2abc60385eb5fc7342b85cc867fb00852cf5e061740e6cd1c69853e614a0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218001, "uuid": "f1bda384-f5df-4821-8e42-d35811d33490", "comment": "Malware payload", "value": "f2e577d40b43b395a20400c3b196872e7443ddf3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218001, "uuid": "4eb9dc82-a6b2-4f0c-a279-5ca712b5990e", "comment": "Malware payload", "value": "19ae810d04f9516d95b3e030d8fdf47790a84c48c9d3bc85736a842bc3f75892944695744fccef46cf518930957c3adf", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218001, "uuid": "71fd4eb8-9731-4f26-938d-da92439ff84d", "value": "B9831233FCBA2BCC5C1DD820D0656DF40A6FCD9A959323B859682D32208D67D6B419EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218001, "uuid": "42976dcb-8265-47cc-9578-762e093dc01f", "value": "1536:cg2sNyMfHfrqQaiwotTqFUAAWB9Te87VqINbtezgVRxr9AiUrQTKXs8FI+bf:SM3XvtTqFpe8JqmdIrLjFRbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218001, "uuid": "ba7ca99c-b130-4de9-88e9-9e1fba0abfee", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218001, "uuid": "b3533545-7cd1-48ea-bde6-583127b27c36", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218001, "uuid": "7577a5bb-9e48-40d2-bec8-505cf54638f4", "value": "catalog-1279421064.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a92b45-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217837, "uuid": "a264cc67-3562-4232-a73c-f35e8d648a51", "comment": "Malware payload", "value": "a0a278ecc374c8589cd1d63c4abba4e0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217837, "uuid": "eb739d42-313c-479c-9ea0-931a10798b8b", "comment": "Malware payload", "value": "04bc95044ee099ea9480722b83bbf63a2f466884094114e7dda08323fabed70a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217837, "uuid": "ba906e23-cb04-4ea1-994f-b36e99500ee4", "comment": "Malware payload", "value": "7fb999b998e4a2351e383b20dc5668612e93158f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217837, "uuid": "06c4164b-f44c-4aaa-9e9f-d1dc76244dd3", "comment": "Malware payload", "value": "bee0f3df95cafe1474c5b3ef580910342f2703c705335fcbc191f65a77f462381bd5240f1aeccb23c904487a90040a83", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217837, "uuid": "14da12af-dbc3-4970-92ea-8621205b7b25", "value": "7D8302CB74E9433E8F3527B7486E1E046361A43F44088ADC75D73BB86B526B26573389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217837, "uuid": "c2a9c34d-9804-46f2-8a59-c7b700c9e0b5", "value": "1536:aAfNtg2tf2vCapQ72ZTaNqeo6Vadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvE:aijtt2v7aU9j7+XFWtYe14hbOjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217837, "uuid": "4d5e7286-4d30-48e1-8b3a-9e43f0156d6f", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217837, "uuid": "3bca9dc2-7866-4118-a0d8-05a64246ef71", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217837, "uuid": "9991c338-9649-4917-a94b-ed5aa5bce706", "value": "catalog-1189393164.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f25a182b-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220224, "uuid": "ea14941e-08b2-4df7-bfc1-f789483b3e65", "comment": "Malware payload", "value": "bdf35dcf4cd4ba323aae4a221d78197d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220224, "uuid": "a0f777e3-503d-49aa-aea1-944e6de1774e", "comment": "Malware payload", "value": "04f336646616384436592a9cd1b9151db5358e65523c558c818f6b1a04136434", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220224, "uuid": "e707d66c-8e82-486e-af32-6dd03bdecf4e", "comment": "Malware payload", "value": "7dc6da80f71d58a6939dcbe26c2d8ab77a4ece7e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220224, "uuid": "04ff1622-519f-4b13-9091-39df0055e6ef", "comment": "Malware payload", "value": "2ebb243a0a7227de3ecbe9c6dfba572c2bee4b949a7985fc3b0da203b205eba18924ba0be1fb0d642e14b12042e32b35", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220224, "uuid": "bd1bde0c-7241-4ec8-b02e-1b8964c4fe5d", "value": "DF83124D35EDC040E27F7D60536AAD5901B86F4BEFFF9164CA6961329901863EA0368E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220224, "uuid": "e9c1e32c-54c6-4da8-b481-e94be713ae3e", "value": "1536:4wJNfD6jITxi7UnLkb/Yw3LCq1GeOuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzb7:4wzOEliUne/L3LCq4kO6xoKDShicdBMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220224, "uuid": "7434afaf-2b91-48e0-88ff-db14fee9ab79", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220224, "uuid": "5f6f0d45-df12-479a-8221-edff42cc0d88", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220224, "uuid": "11d98cb9-e4b5-4a58-86f6-a13c9502be27", "value": "info-1022692460.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb5a3960-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218494, "uuid": "e3cfec5e-c27f-4377-8789-2b1848f7ea8c", "comment": "Malware payload", "value": "f208f757c3714c4e46c979c9a3f37896", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218494, "uuid": "9276f8e3-f5a8-4aa7-871f-b0527ce7b232", "comment": "Malware payload", "value": "0504d53698f45d58a482644a23fd36083cdde9a56ccea52b64f3662dac5e85d2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218494, "uuid": "09347574-b785-492b-9ca2-228d9e2528e3", "comment": "Malware payload", "value": "f880c0e6414f888e8e3ddb5a90a441aef6257284", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218494, "uuid": "a92fdb07-9143-4724-a20f-bfb83bffb63e", "comment": "Malware payload", "value": "f5d24298f51b7bdea6ea0075a79c08d1410fe77dd173a02b22aa7f9f3f7b1122d5b823cd0cae40562bbdd1315f7b0399", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218494, "uuid": "23696b40-7a6e-43c7-bfe4-b9665591a240", "value": "228302EC70238A66637345A6DD7D90C32B6B8BBC441DB056A82A79764A307FFE121531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218494, "uuid": "deca96da-7b02-4e5c-9128-dd68e06cd731", "value": "1536:HzKTWDE4Qgl8LS4v50FC+p7UjoB8+wXdpUna5ahL2dmTLUVVvz:HeKDPKLRvaFjp7uXinakEmEVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218494, "uuid": "8457d49c-f39e-4df4-ba92-85902e0ea319", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218494, "uuid": "dee5300d-cd14-4d61-b170-3eab7a212939", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218494, "uuid": "8a88898e-c6fa-4cd6-b7bf-e3641fd72a41", "value": "catalog-1540100706.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85811cd-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218435, "uuid": "d0db2f51-9009-4020-aca7-0fa227f6cf56", "comment": "Malware payload", "value": "1bfbf95aec6cee660aa83232a5a9c8a6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218435, "uuid": "5f9d0533-8e3a-4565-81fc-c76a88b47055", "comment": "Malware payload", "value": "0531efb4d423b276d20aa8ac462ff62b405dbc7c8f6093445ae74482a66d9c59", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218435, "uuid": "ec765237-8e1e-4de3-be55-6214259bf5d5", "comment": "Malware payload", "value": "8e26df4bb729acb5edc670e4c993205a3b484f9f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218435, "uuid": "a0e12e23-8f9f-48b2-ba44-e2a5f76fec0e", "comment": "Malware payload", "value": "fb5e312cd24e7b1158aed4d45dac7652af121d860f2e1c020b1557e307dbee5db039dadb67122c58385d7a557b4d63a6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218435, "uuid": "b0864062-48f2-4404-ac22-8f34c3d60fd9", "value": "078302CBB4E9433D8F3517F748AF1E046261A43F44088ADC75D73BB86B526B26572389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218435, "uuid": "3fc28bc3-47da-4dc3-9559-cc3c76b37fea", "value": "1536:kNAfNtg2tf2vCapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJv+:Mijtt2v7mU9j7+XFWtYe14hbOjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218435, "uuid": "3a207e45-b189-451a-8305-7e9dddb19dc4", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218435, "uuid": "9e8a948f-4495-4c56-9ff2-8556efe47c95", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218435, "uuid": "7e10870e-7d6c-4c65-afe5-609e0db62963", "value": "catalog-1499785246.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c44f5cf-a468-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1619205369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619205369, "uuid": "a0883a3a-5256-46b1-9a9f-efb4bc401e4c", "comment": "Malware payload (njrat)", "value": "a98996f2f05e685f0ddd41c361b12e72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619205369, "uuid": "1ae74c1a-f464-4194-9f69-e4b8c733f403", "comment": "Malware payload (njrat)", "value": "053a5b96a91092684b9d1e5cb7132f6f3453803b3865e2f8649d4e23ba5c8db7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619205369, "uuid": "041f17cf-e8cf-4daa-b113-b7edc6ffad18", "comment": "Malware payload (njrat)", "value": "b5ea491a32afe082c7a272af2a7f4f8447b07d03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619205369, "uuid": "f2cf613c-b51f-4dec-8a77-63afa29c565b", "comment": "Malware payload (njrat)", "value": "04fc85d35390fd43dab8c2b7ed8063bd767bc01716ef7e3bbad2453bec26909d35e8363d8d22f386a507388588a83595", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619205369, "uuid": "2da77d20-1233-4603-8988-bca6783b95f0", "value": "6A836E243AEB4019F1B3AFB65EE4B5A6996FF773370764AE109003864B23981DDC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619205369, "uuid": "634590f4-82ac-4110-8182-205ee33df285", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619205369, "uuid": "a9a8c98c-340e-441e-9db3-6839ee1e30c8", "value": "1536:HyRxR3uR51AOarWzNDNSBSeuxaTMF4s+K23gFrnhrFL4gwAObz/:SfR3usazauxa6E3gFrNOHT//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619205369, "uuid": "c2f36d1c-baf0-4490-acd6-82e71375a912", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619205369, "uuid": "e00c5009-cc10-4242-8b14-3034a8789071", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619205369, "uuid": "bc8855cd-a15f-4521-9cc1-21564c1fffe1", "value": "a98996f2f05e685f0ddd41c361b12e72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d7b4f4-a416-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1619170249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619170249, "uuid": "a508fa2d-0e82-4816-a0a7-9d086dccdb1b", "comment": "Malware payload (ArkeiStealer)", "value": "413a3afdb3c8d249a1c44555e1111a86", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619170249, "uuid": "de2c33bc-79e0-4f85-a91e-487aed0e68a4", "comment": "Malware payload (ArkeiStealer)", "value": "05489477d2152d2c6854707d7eb96ef2178b0d7c83321f42a03588ffe2dfb21d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619170249, "uuid": "77e24086-ce8f-47b0-b4a8-8d7cd5a343d7", "comment": "Malware payload (ArkeiStealer)", "value": "286d96c680877aedb31d15ff768f410046770a3f", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619170249, "uuid": "a29d6680-b7ee-4a7f-91da-2d0549bd63bf", "comment": "Malware payload (ArkeiStealer)", "value": "15e467e4926ac34ef9058bf1896af3c425fa23615ddb5c6562078260a0da2554d08ec93662503dd54e5f4f95406f03f0", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619170249, "uuid": "7b87a310-db37-46b7-a5ba-2d2c73c059da", "value": "B3D4F12232D0C072D1A220F68116E7B05EBBBC7159255A4FBBD41FB91F37791EA193CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619170249, "uuid": "2060efd1-f8c4-4cf2-b287-4d9c08eb2de4", "value": "4646402e8350961fa61813204180433f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619170249, "uuid": "125457fd-de6c-4a7f-9589-8aa6438ecbf2", "value": "12288:jOqFgk6zbrjnsut4KfCGGuVmiXpFYPB7MsZjkWfXz9ovXKlQ:jXFpmbrjnsutjqGGuVdFYPBdjkcXSvXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619170249, "uuid": "d2280c09-a06f-4bc8-8310-cdadaad53147", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619170249, "uuid": "00ade601-01c6-4dee-8fa9-fd0a6512d850", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619170249, "uuid": "53022315-81ee-4bc2-8316-f350618be7cd", "value": "413a3afdb3c8d249a1c44555e1111a86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac0906c-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219996, "uuid": "1a5843b4-b258-4fe5-a4ed-b9dbcd45f40a", "comment": "Malware payload", "value": "1921b6e6e20f266845fdbfd5333b7d93", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219996, "uuid": "ec496025-4ade-4c9f-9a81-2f19da5c6ff4", "comment": "Malware payload", "value": "0556eecb8ac91940a2c8c4c7fee4101ec35cc1c305e91a6c311fcffc89d20e56", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219996, "uuid": "9b179d56-1014-4013-bc8d-b5147da33a69", "comment": "Malware payload", "value": "57f7d25ba6f262d1b1f201d9a73342b6b8f25693", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219996, "uuid": "75598083-489a-4b55-8b46-3dbd120ab935", "comment": "Malware payload", "value": "19cdb0c7881fb9460efc4d353c5c3f76bf2616564712bffb1565ed9cdd251b5be52521b204563ee3b64082083cba093e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219996, "uuid": "d156753b-8f9b-4bb6-ab88-137926ea1334", "value": "99831277DE8BA18EC102723013782FE64B2C6B72996115062670747F2B2F9794CC6BE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219996, "uuid": "166884d2-d162-4b86-bad1-21a6ec472586", "value": "1536:uHuRWAXdZ2rQD2aCv0yWxaqQ6Rxt5AB/aqPwL3VbCbT:Wg2QKDm/Qwt+awaxCbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219996, "uuid": "a6dbc97a-2ac8-4e61-ac8b-4aa578b44808", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219996, "uuid": "00f98f97-e1ef-42c6-8355-c181a77ab6ee", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219996, "uuid": "717b5681-4041-4a81-9675-c99d3596ee30", "value": "catalog-458387575.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5000aafd-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218663, "uuid": "f62ddc17-830f-4c41-9212-a35a12df49bf", "comment": "Malware payload", "value": "065dcd4e34ae54139327a41e7dfe0a61", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218663, "uuid": "88a9301c-bd0a-4113-9484-a8d6909cf78d", "comment": "Malware payload", "value": "05746714082d38346a790835cc3940ed22045696eacfc743bef4e21eab0db954", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218663, "uuid": "fe01643f-cc28-46a5-8cef-756e4ce5dc12", "comment": "Malware payload", "value": "76e89cade62ec1ec49efc4a5108ca0ad75702129", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218663, "uuid": "e8e7c60e-d7b5-42d1-854d-406f8ddc1518", "comment": "Malware payload", "value": "72dc1806af546e752370024bb03d100955b78e89cf73572189b3d225a6f4e4ac69229cf76977886bfd9af526da3bb6bb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218663, "uuid": "476f5b17-4e71-42ad-8537-f11b57c6b8e1", "value": "E18302D7DDCA225D743DEC74C5620C990E15CA77D106362C61DB3BBA1A96E3E6200CA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218663, "uuid": "301e0f44-1f83-4962-a3a9-87e803d33251", "value": "1536:juRRn2hxZRGfEnaj1ZQUcDpTe87VqINbtezgVRxr9AiUrQTKXs8FI+b5:aR2hx3Gtj1ZQUcDJe8JqmdIrLjFRb5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218663, "uuid": "ba2fe33a-4b2f-485b-aa94-a9ce24c8927c", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218663, "uuid": "25060ba3-aa78-48a5-8cad-697c57da386c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218663, "uuid": "d67fae21-fdf3-4148-bc8e-6e2d180ddfe4", "value": "catalog-1659483752.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f600c4ed-a419-11eb-abe1-42010a9c0039", "comment": "Malware payload (Amadey)", "timestamp": 1619171697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619171697, "uuid": "9c09e6d4-fa67-428d-b797-4423d3af8231", "comment": "Malware payload (Amadey)", "value": "7806508028c78ff39211cdfe01a070ef", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619171697, "uuid": "8734ad9c-80ec-4912-8e43-3175a37ace79", "comment": "Malware payload (Amadey)", "value": "0590cd6ecc0865f09c48eea98b04ff75fb49918eb14c0b0c53ce8215650acce3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619171697, "uuid": "b9712fb6-6e66-4af2-87fb-f96705fb65d6", "comment": "Malware payload (Amadey)", "value": "98814fd881d0db27245910475cffa5f6bc645406", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619171697, "uuid": "a704869a-8a7f-4986-865a-cc2baf889a98", "comment": "Malware payload (Amadey)", "value": "3a449e5264d53c2d6427ee48b1639223bb9fd93b8458f20655855c5f13671d062cae6e79d1f2b4a97a1d9bace68af35a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619171697, "uuid": "cb6126ea-3bb2-4aee-89ea-da23fed50759", "value": "00C53383F391F7F6E0A6023261B28ECB99A7EE31255599E29FC777BD5972851050F003", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619171697, "uuid": "f95d5d51-d892-4f6f-b60c-82bbe22527f9", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619171697, "uuid": "7d462174-c310-4870-8f97-ac0ea3902e81", "value": "49152:Y7mY8pH4TXwyAuFjkzxF3uDfxKqj/qSmJYPKWOn6/YiM:Km34TXOgGxNuDfxKqjDyWQGYiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619171697, "uuid": "dd08d649-d772-458b-8868-89088ff1be15", "value": 2558134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619171697, "uuid": "6901aca9-902a-4b72-ae75-09538c7b50c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619171697, "uuid": "dc4a8e43-9858-4c12-a9bc-f7e86e077ed4", "value": "SecuriteInfo.com.W32.AIDetect.malware1.20102.31484", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "438c68be-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217783, "uuid": "db1b400b-1df4-4a0e-968b-6fc4a9e60817", "comment": "Malware payload", "value": "f441ffe7850862cdfaeefd14bf2a38c2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217783, "uuid": "74292674-aad3-4ccc-9140-892e5954ec01", "comment": "Malware payload", "value": "05d891645f4efdda58cfcf52dd018020f83fab5193e08579459f8d4c09a00872", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217783, "uuid": "2d1b01e2-02b0-4a0e-b567-1bbd0c055489", "comment": "Malware payload", "value": "e66f1f00260dc5e33252777adbcc28e258f39fef", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217783, "uuid": "396eeac7-0b31-4401-af6c-1ceb6a1c1bee", "comment": "Malware payload", "value": "34a5ba466c19f46fc940054dc60ae9c56397212c851a87b89b7324acb596b25bdc6b7d956cff0e27e90b2fc65841359d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217783, "uuid": "3c862e6e-2fa8-4f96-83e4-7a1621ea61e4", "value": "85830277DE8B618EC502723013782FE64B2C6B329A61150A1670747F2B6B9698CC6FD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217783, "uuid": "68384731-6445-495c-ac6c-9db0393575b6", "value": "1536:yuxWAXdZ2rQD2aCvdyWxaqQ6Rxt5AB/aqPwL3VbCbf:yA2QKmm/Qwt+awaxCbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217783, "uuid": "f1dd5aa6-6697-4058-8712-81395a442bbd", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217783, "uuid": "fb1f9746-7c39-4d49-8ef8-7fa86cf59366", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217783, "uuid": "f318ca0c-289c-41f1-9532-8e458138457d", "value": "catalog-1163598998.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0801129d-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218113, "uuid": "bbd4930a-3246-4445-aeda-406012c2ac78", "comment": "Malware payload", "value": "2310706ee3e7e8d3fd37835c40f70957", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218113, "uuid": "926a832d-937d-49d7-ad46-1ea402352524", "comment": "Malware payload", "value": "05fc68e5991debdd9849f15e4bb219cc81e233308c775ebfa5921111dcd9d4ad", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218113, "uuid": "f4f0e26a-c5df-44a2-b5a0-40f8a4a8dd01", "comment": "Malware payload", "value": "4aa39a5eb812cd87099c1db5db159489e3d9a416", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218113, "uuid": "a2d4b79d-5cc8-4299-9794-0de0d42ed359", "comment": "Malware payload", "value": "72356432d800b7c4393fba4bba54f95a9a6baa3b7c7a5597ffa785ef11829ec1d4ffa7bda92517dc439cf15ac8408788", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218113, "uuid": "c40b27ab-0fe9-48e6-b7a1-33bd87a59221", "value": "CC83028B74D9433ACB3523F65CAE1E4422B1A47F1408C6DC79D73B786B53672A572388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218113, "uuid": "e4688c2c-95ed-4b27-887e-5d7fb6de9ff3", "value": "1536:ZAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvU:ZijtuPmU9j7+XFWtYe14hbOjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218113, "uuid": "a04dd698-5cb3-42a6-af93-8563de35dc4a", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218113, "uuid": "3295eede-6168-4f2f-a966-b96bca775489", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218113, "uuid": "d6df84e8-7050-4b5d-830e-4068e7c0be5a", "value": "catalog-1334104849.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3683613e-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219909, "uuid": "ec2ab0ba-3108-4e3f-bc3d-2ee0eda09f01", "comment": "Malware payload", "value": "f095457ddda51de4c0449812175501b1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219909, "uuid": "77a96057-5485-44bc-bc99-392da6a74242", "comment": "Malware payload", "value": "061c669777ef9f757f25aca76a9fb47d490d784cde07563279560758041ff229", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219909, "uuid": "b6937dbc-5172-4888-881b-d793ffbab7e9", "comment": "Malware payload", "value": "5a790c155c0f17294e66eaa5fbd3350dab176092", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219909, "uuid": "70fa7b4f-2be6-41b7-aec5-70b173202c8f", "comment": "Malware payload", "value": "bfa634ab5d63f80ae5e158086e2f68de7581ff2d9663294fdb1231d827d16162946385fe000184a3bcf71d7f27e4e750", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219909, "uuid": "077dca85-833d-41d5-b3ba-bbb5247f89d9", "value": "038302EC70238A66637345A6DD7E90C33B6ACBBC441DB056A82A79364A307FFE121535", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219909, "uuid": "b4a0a3bc-a5ec-44f3-bf6a-19dafd0d029c", "value": "1536:6zKTWDE4Qgl8LS4v50FC+p7UjoB8+wXdpUna5ahL2dmTLUVVvi:6eKDPKLRvaFjp7uXinakEmEV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219909, "uuid": "267b29c3-777f-4e0a-9adc-2525ea302411", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219909, "uuid": "78d5114c-2b54-44c7-8485-53ba79b02de5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219909, "uuid": "192a68ff-f9a9-448d-9d17-975184ac2506", "value": "catalog-408456459.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc47653-a41f-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1619173881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619173881, "uuid": "7b31354f-3b48-4172-a4d5-31705734b93a", "comment": "Malware payload (RemcosRAT)", "value": "daf7bff018ced74ccc2029cf3b307b76", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619173881, "uuid": "b2c544b7-0bec-40a6-935f-c574ece5ee18", "comment": "Malware payload (RemcosRAT)", "value": "0660f3fe8f678619a303a59953a93feaf0250f9adc2c901e51f13ddde0c16811", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619173881, "uuid": "24d0ee17-0302-4f3a-9d99-f8d5faeb5ea6", "comment": "Malware payload (RemcosRAT)", "value": "92b3a9ae041f121badae212d65233fd25f4a2e77", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619173881, "uuid": "87317b31-9888-4479-a6c3-64ee57778584", "comment": "Malware payload (RemcosRAT)", "value": "f2482dc0c3ce3b58f9e3c26d211d4a869daf3715d897af6314e92305e89f1da3d0cec1be814694e806885db1dcfb4c05", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619173881, "uuid": "f83c2d1f-b61d-4a8b-a367-439670575573", "value": "7463025012944794E560BBF11E1C3EEF4902EF5271E4EBBBDED83249D196A0E4698FF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619173881, "uuid": "1213a812-c6fd-48bf-8847-0f0809a07ddd", "value": "1536:KjDmoMAjr8rowWxjfwpRGbI3E3w0EXj5LJxZKGCl4p6Fnr:KjDcAdXZmRGbIUb4FLJx8GCyp6Vr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619173881, "uuid": "edf81d9e-85ba-4c4c-a6fc-f200a1d44d8f", "value": 72773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619173881, "uuid": "8c4c4896-fb69-427e-a1f1-0112c2594592", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619173881, "uuid": "c64432ff-de79-430f-970a-62050a211a98", "value": "_0900000000000000000900.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa21e8a5-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219673, "uuid": "341fc33a-955a-44e3-b65c-57ff4103a8e1", "comment": "Malware payload", "value": "167359cbed2d2f7efac4972767ca7840", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219673, "uuid": "73fc8779-7683-4010-87bd-fc32fb0175b3", "comment": "Malware payload", "value": "067b16b93c937b65310910732fad599c3d356c88e73d3cfe742334d6f87e4c2e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219673, "uuid": "721538e5-90d2-42e9-bccb-8a52503c8f49", "comment": "Malware payload", "value": "2974c2facc7faf542aacac4b3b338e87789811aa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219673, "uuid": "b941a390-bcd5-49d0-947b-076c69f7e4bb", "comment": "Malware payload", "value": "ffbe8a9cc371042137d0ed84415e9f0d38c471de6b403838e24e8c46a95061b02c56f30be473189e060c9932b0c7c9c7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219673, "uuid": "52f63b58-24f3-49f8-80fa-61ab01b2faef", "value": "A183028BB4E5433ACB3523F658AE1E4422B1A47F140CC6DC79973B786B53672A572388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219673, "uuid": "2f56f5e3-0990-4aaf-8508-c3fc2a2598aa", "value": "1536:tAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvu:tijtuPmU9j7+XFWtYe14hbOj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219673, "uuid": "b598b05b-9484-4de5-87f5-705536f3b659", "value": 86930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219673, "uuid": "acac1cdb-3f76-4bf0-a9f3-24becf9bfa8a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219673, "uuid": "fad66037-3506-4d92-9e8c-753cd86c7e2b", "value": "catalog-27571571.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fff41ad-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218153, "uuid": "6167c442-5a18-432e-a063-0193dc2beb58", "comment": "Malware payload", "value": "60ed04fe4e2dd7544168593aac36e6ae", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218153, "uuid": "9899fb34-d530-4132-ab21-8105215d7cc0", "comment": "Malware payload", "value": "067fcfd46883312374de5ea0a9e1dd98c24e4e69778f28cd4c2efa82e173d3c2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218153, "uuid": "6bb26710-48d6-4e39-ad8f-62aeba781a1f", "comment": "Malware payload", "value": "36c745dac720c38d3d48cff1e9f3ce4f8cc058f4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218153, "uuid": "879f9e9c-b41e-499e-9e77-100956ea5a49", "comment": "Malware payload", "value": "bd4956a71c82a1445d7a7e09f8069b384b2dfa2e80fc6d85e06ac3017525fe62bc5e060bebfc78fbe9394b51ba5c34c6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218153, "uuid": "1e979e58-7074-44e6-a741-6caf24f5df3f", "value": "B88302588B9F8D849011ED0ABB22F8AD75106248716973ABAFAD1134EF478D5A6328F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218153, "uuid": "983a894b-866c-4a2c-b3b5-de4fa76f9eb5", "value": "1536:7A6P7EGmwH1zVQLQDYflSJXvoDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnv:7AY31zVQnIJXaM25NfuQjMCYNBwltD0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218153, "uuid": "4303bafd-acfc-4598-a068-fa2b7911bd87", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218153, "uuid": "aef23faa-36a6-41f3-9d46-8463c40e0026", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218153, "uuid": "4dde1d4d-25d5-49dd-b41f-510421c621a1", "value": "catalog-1357090729.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe655a2-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219414, "uuid": "8928bf3b-522c-4514-af06-47c5539f7db6", "comment": "Malware payload", "value": "48214145a12c0ae5339a3afe6823fee7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219414, "uuid": "a1b320ff-d031-43db-981e-dbcd3f6c057d", "comment": "Malware payload", "value": "068785d99439052c3f83c25e198c59c28741bad733c859d37a76835227cadd8c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219414, "uuid": "5d56ba04-4623-4600-a3ce-d530bae3e0b1", "comment": "Malware payload", "value": "d4b4a73f989030b77cadcb60803bee54da23be1f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219414, "uuid": "fd5d4f27-ea7d-47f1-bcbc-eaad3f20c971", "comment": "Malware payload", "value": "44fd4b86790f588e44e5c3a458915899eb80fe33e3d26e43e938e7b928eef2ec1014c75b2ec540ad4b27011bae7dffbd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219414, "uuid": "0b8d0ae9-90cd-4b81-92e8-bd5345e49dea", "value": "B18312FC7E1B98B4A772968FC4FFB8D5179249E4E019A0E35C0A3A36D4106EBF612570", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219414, "uuid": "aef36e51-c760-4734-8652-7f213588071e", "value": "1536:QfAS5f/KPDChIDbflm7UjoB8+wXdpUna5ahL2dmTLUVVvD:qASl+Dbw7uXinakEmEVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219414, "uuid": "e0de1cf1-1d26-489c-a76b-1e2715f8bfe7", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219414, "uuid": "3cf91c9d-3e5c-4bdf-a9c1-e10ab12f2be6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219414, "uuid": "1cb224c2-2c69-442c-83af-bcdbd82478e7", "value": "catalog-2077915069.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "399cfd39-a3de-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1619146040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619146040, "uuid": "dc5dcacd-ad4c-49bd-9f41-9dc6ade3499e", "comment": "Malware payload (njrat)", "value": "5f0019e7fb92f3cb682455071ee8ab97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619146040, "uuid": "c8dfd6f1-16fb-4338-82e9-b9801b9005ae", "comment": "Malware payload (njrat)", "value": "06ad7362da85485983ad456f7c853847bcf29bc5b22969b8b05b62f7d54e07d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619146040, "uuid": "8b4a51f6-c40e-457e-b78f-f89e19007dd0", "comment": "Malware payload (njrat)", "value": "493769996c0cd9cd04b73d248f57ac390805ae3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619146040, "uuid": "4708f89f-5a5b-4073-84cc-5f9ae43aa71e", "comment": "Malware payload (njrat)", "value": "1fa94e96ffe1e585f249bc223190b0e34c6df0628b1d895841418111e9a90ad1d9b9fad42c794b9b1dd397b5b56cf4c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619146040, "uuid": "6719e2e7-8ab2-4801-915d-9958e4b37bd8", "value": "74E22CADFBE64466D2BC09B50571950053B4E043E523F77E4ECA24EA2B6B3D84B84DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619146040, "uuid": "105dd063-6605-4435-bb8b-29f673cd4cae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619146040, "uuid": "fa8f4e36-f911-4abe-a25c-426ef518f730", "value": "768:RV5DgJZLrGzxhucGpiqnbhvvC7QmIDUu0tiI66j:9UKghR4QVky6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619146040, "uuid": "2a14b9de-6982-44a6-aa32-4e8eb4007902", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619146040, "uuid": "c1149bd7-9743-41eb-b147-d69855b80712", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619146040, "uuid": "a1f69a3e-284f-410f-868b-507c8de54170", "value": "3fBmYYea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8037b054-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217885, "uuid": "9fb4bd6d-3a13-4479-b346-f3b4b28edace", "comment": "Malware payload", "value": "d2135ec559d8f771218a8c24af3062aa", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217885, "uuid": "aab928f2-2f28-43b2-9520-22754fad682e", "comment": "Malware payload", "value": "06be62429fcd0d6b16d1072952224ae8ef530ccbc8bfeeed709ce79defe130b6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217885, "uuid": "624baa15-72f8-46e4-bcd7-422f4afc5730", "comment": "Malware payload", "value": "9f94bedab823ea89923e87907dc8f32fbc25d327", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217885, "uuid": "a3be7bd7-0f29-4af1-9bd3-f3fc7cbd2336", "comment": "Malware payload", "value": "ae8b2795c47b587be2febec9e41dd1b613e5ca1fc281703c79cefc757b2d5e5267660a531766f0a83e919d0dea7b1e1a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217885, "uuid": "d2c061ed-4f18-409f-8942-5fb398bf56f0", "value": "3C8312979E9A3B9E2458AC39C57B5CD10905CE37C157301D22283AF62C1BEBF9B054DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217885, "uuid": "5968c228-6a9b-46d8-b67c-39b37aeaee27", "value": "1536:vMaAK6VMtJDrlSnna6UAAWBHTe87VqINbtezgVRxr9AiUbQTKXs8FI+bB:vzAPq1Sa6ne8JqmdIbLjFRbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217885, "uuid": "a132789c-4099-4a0b-9fc0-55607175579e", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217885, "uuid": "239e7260-6ed1-467b-a55a-df9d230fd23a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217885, "uuid": "5e2a4975-ef4c-471a-aaf0-825d91914a20", "value": "catalog-1219939280.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9f9055-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220214, "uuid": "51ca99a5-669f-42fe-9fb9-9db414cece2f", "comment": "Malware payload", "value": "6d1ec586d307e4de1ba8eca4089d5235", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220214, "uuid": "c5dfdbac-a2bc-49a2-b692-c83072b59162", "comment": "Malware payload", "value": "06cc4d12ab20898491206fbf34c6ed1f1735c79bb6c718be036fef2ade5e1ef1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220214, "uuid": "656ef3cb-cafa-4b5f-ac9a-6146a2ed5195", "comment": "Malware payload", "value": "9c9f120eb6fcdfbd583d9af426277299023c2792", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220214, "uuid": "7d888910-af7c-4641-b4dd-59fe79d05c4c", "comment": "Malware payload", "value": "666ce23c6eeb5a0d62bd9607f7647ae83e45a65102f40c63f5d024b05d55c44eeb139d99290ffd398284d7a036ed6bd4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220214, "uuid": "6b2694df-b2ca-4539-8391-e755b06e53d7", "value": "3D83124D35EDC041E17F7D60936AAD5901F86F4BEFFF9164CA6961329801863EA0368E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220214, "uuid": "69272635-8ba7-4b8c-8e31-f2843d2404c3", "value": "1536:0wJNfD6jITxi7UnLkb/Yw3LCq1GeOuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbl:0wzOEliUne/L3LCq4kO6xoKDShicdBMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220214, "uuid": "d7344da1-0e0b-440c-814d-dd0e56c3c5ce", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220214, "uuid": "0591b413-0326-4345-a344-e07620e87965", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220214, "uuid": "33dfdb3b-a146-4ff2-a370-b627adc82f95", "value": "info-1016937042.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9c54e2-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221124, "uuid": "ddbb8215-2c5e-458e-a308-44fd9d8860f0", "comment": "Malware payload", "value": "fe350c616476d0a8e5a5468db59dc831", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221124, "uuid": "e0c12b53-2b73-46a4-9a4d-44b11ad01bf0", "comment": "Malware payload", "value": "06cf3a52c3d371f23f92ac31c3c7b5972bc85d2ea958890f75b166b9be6a4bec", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221124, "uuid": "26ee3e2e-86a0-4ebd-bb5d-ada46f8625ce", "comment": "Malware payload", "value": "5a0090147e8a40a77f693c6ec525fe93e13948e6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221124, "uuid": "4011f88d-49fa-4d80-86c5-d7a9097b4a22", "comment": "Malware payload", "value": "41f0ec056582f9f09fb83c7cc6c8058b6aade364316aca60d4e9a8d54416fc236c6535d8617dc6bbe458ed5dd38f1973", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221124, "uuid": "8c01199f-ff5f-48da-9baa-38e14f1d9133", "value": "2A830266E8769CEE419DE0A2E02E3A1837FC11D3E0799787F61E3D0680379CE5D1442E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221124, "uuid": "dcdc66c1-9e13-46f0-ab42-82cbe537f2fd", "value": "1536:fynNHeop+LU9t5t7mgV3eE7JWgtrQZcUT7oqlaHvvbFq9GHocnoe1RqfwSOJrpML:firkLUj5tSCrIGUT7o/v096oiBkwPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221124, "uuid": "a0704129-415f-4e3f-b43c-fe1e4b41bbf1", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221124, "uuid": "403482b6-ac0a-45f3-a13e-4432f71e3085", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221124, "uuid": "87e731c3-8997-4a66-824e-c27e46e99f76", "value": "info-150478611.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "095e2d7e-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218115, "uuid": "cf9d0b62-0153-4767-a2f9-32c4f29c2322", "comment": "Malware payload", "value": "a3bed3b15864fca70223b8a17662cbc3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218115, "uuid": "df916080-f6c9-4a4b-8f13-52d879060f16", "comment": "Malware payload", "value": "07050cd60bc84d35cc29df6b2298a11f7bc81ee01ab5d1e2cc06c7bcc10b7cd7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218115, "uuid": "0580258c-919a-4006-ab74-df6a9cccf82e", "comment": "Malware payload", "value": "9b50653834ca8c76656fd74eeed8377bc36add4a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218115, "uuid": "88f0198e-cd94-46ff-b6af-a3da0b86a6c8", "comment": "Malware payload", "value": "c4174b76287bbf6a88c8eced09ff4a291e4ccd218b8fb745659bfde5be3e29af7ff249c99df4200d105468bd6815cd88", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218115, "uuid": "79184193-58b3-4719-96c5-a79ee77079c5", "value": "738302CF74E9433DCF3527B648AE1E042261A43F440886DC75D73BB86B52AB265723C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218115, "uuid": "ea3afce8-2b7b-4b96-874b-c1730d0e5a0d", "value": "1536:FAfNtg2tf2vCapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvN:Fijtt2v7mU9j7+XFWtYe14hbOjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218115, "uuid": "a665b779-a5d4-4043-b057-5cb65c42ca3f", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218115, "uuid": "5ed2f64f-baec-486e-86d3-ef4c1c7b7c5b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218115, "uuid": "40605855-ab7d-4b0e-b0a5-e2e8bc655f5b", "value": "catalog-1334311542.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9788d813-a484-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217494, "uuid": "4e7eaa56-123c-48aa-a616-e635418f4f72", "comment": "Malware payload", "value": "75e5588755b3cceec5bdfec5ed2d4c87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217494, "uuid": "15e19481-0b0e-4f15-a5eb-6bec5d3f2d96", "comment": "Malware payload", "value": "075c19a0f87db42462450ca6ad214dab940428b96a384392230cc5fee574b687", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217494, "uuid": "ee9aa51a-6d14-4300-9931-9a1f36c70180", "comment": "Malware payload", "value": "6b986ed8a1d820447e0abfdb01e81873d9d19a85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217494, "uuid": "6a5bf4f9-f870-4870-b46f-6857e3caccc2", "comment": "Malware payload", "value": "51d9a6e92264a3f399cce11efee95e7629ab8bd155ca9caa8325238ee157aee080f71f118a0a1a1c294f8516b6b5cb17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217494, "uuid": "62064576-d8c0-4ac5-bbe5-9cc929743ad7", "value": "188302CF74E9433DCB3527B7486E1E046661A43F400886DC75D73BB86B526B26572389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217494, "uuid": "0a04f63a-9600-4e89-926a-9aeb3a9d200b", "value": "1536:zEwAfNtg2tf2vCapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvW:zHijtt2v7mU9j7+XFWtYe14hbOjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217494, "uuid": "46e5db00-1abe-451c-8628-90cd5f5b567e", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217494, "uuid": "5bf83226-f660-4a21-a245-c87a6dfcb60b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217494, "uuid": "475ac77d-c7db-4bfa-8de2-1174f9d06253", "value": "catalog-1038147246.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e766f4-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218940, "uuid": "c0685c8b-0eb6-4fdc-a35b-6a293387b6b9", "comment": "Malware payload", "value": "a0eeb73bde700a045484b623e850f07b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218940, "uuid": "9452b91f-f772-40c2-aa4a-3372ea8fbc05", "comment": "Malware payload", "value": "0763f31f55d938c7edd8b9ab7fbcf032807515c56f0294c1115de628f014dcd6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218940, "uuid": "3a4b736e-6b34-4d59-9299-949d315a401a", "comment": "Malware payload", "value": "5f02e71929803f8e9fe9f7253690086943b12b19", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218940, "uuid": "00e67969-2e87-40fc-8895-418c75599bf6", "comment": "Malware payload", "value": "c4c0ba0d408966ac870095ee0d69f406685fa4d3d9bb09e050220f1ae315f3d427aed1e862015d75ad46e796775b5296", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218940, "uuid": "64e307b7-96a8-4300-973f-e271deaa81bb", "value": "258302CF74E9433DCF3527F648AE1E042261A43F440886DC75D73BB86B52AB26576389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218940, "uuid": "5d3e48d4-009c-42ed-89c9-e5d8345c45ce", "value": "1536:KAfNtg2tf2vCapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvz:Kijtt2v7mU9j7+XFWtYe14hbOjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218940, "uuid": "bb433032-9386-4cb6-85a2-c9a2600edd76", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218940, "uuid": "91a6b4c6-13c8-4d3d-8445-c28797e5ab67", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218940, "uuid": "1ad3d7fa-4f88-4716-a660-a8c03b695ee5", "value": "catalog-1796593810.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d240a4-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218196, "uuid": "fdc9b1c6-fb52-445e-931d-7dec0ee98cae", "comment": "Malware payload", "value": "11f920fa3aa3bcd439ddbf4b8975b8ec", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218196, "uuid": "e3a0cf05-fe54-4349-a185-c17ced81225c", "comment": "Malware payload", "value": "07904985d8850bee49f375441bc483be545609bc4e64ae2db9800eb65a96c3b8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218196, "uuid": "d6b01e9b-aad4-4102-ba41-3838821d1bd2", "comment": "Malware payload", "value": "45ca72efe804b50da7e95ee4789a4492929597ed", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218196, "uuid": "f2d1eff8-c96a-410c-a2fa-9e6fc1366fc2", "comment": "Malware payload", "value": "1ad12db04cb4974b44619104a15680aec3b2b40af01d370c7f64859330ad1f0b0a41616c3bd6258d86163c8b26d017af", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218196, "uuid": "e837662a-b5ac-491b-b05b-25b26d6e82d8", "value": "B4830276DE8F8289C016F23003787EA61F686B7146A1141E5AB0747B2F5B9BD4C85FD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218196, "uuid": "f87f07d5-6737-4195-bf46-1bf8d4d29a15", "value": "1536:iERHCzlWAXdZ2rQD2aCvdyWxaqQ6Rxt5AB/aqPwL3VbCbF:iyCzh2QKmm/Qwt+awaxCbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218196, "uuid": "1def2906-38ec-46b4-9e65-5e67a127edef", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218196, "uuid": "26c19eed-a6de-47d1-a0be-4498383c8fe4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218196, "uuid": "cbcefb74-d6e5-4c96-9375-d020920290ec", "value": "catalog-1390859320.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15abea62-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220283, "uuid": "4dfdae07-403b-4f60-972e-88249dab2c9a", "comment": "Malware payload", "value": "b53c3a469decd5ed16fe2323d184cebf", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220283, "uuid": "5a19489a-eac1-466c-b047-cbd1a7030a4f", "comment": "Malware payload", "value": "07929e51f26f267cee8ef147c0af0749d80dec1ff227235bfa78e7fb0f2c8d18", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220283, "uuid": "530226de-1106-44e5-a79c-7c49b42c59f7", "comment": "Malware payload", "value": "0a285d80ea727ababdd018affaa842dec7e3a49c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220283, "uuid": "8d896df5-e769-49d1-b24d-fb2ecaaa0081", "comment": "Malware payload", "value": "4f2ebf09ab24cb01332e0b963c111a067390291441266fc0cf11644b91528d719214abde566727407d2345c478b61aaa", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220283, "uuid": "0dc1a541-20f8-4802-930b-d52f5376a439", "value": "818302CE31EE01486A7B386470B7F54B50FC5F5B3D73B6288231A570EA114B57A126AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220283, "uuid": "077773f7-ebcf-40e3-9ba4-17f8675484d8", "value": "1536:gwJNfDtI/W4UgUlrZKFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbXYZTa4hp/:gwzpIpUhlrZ6O6xoKDShicdBMM1/XPQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220283, "uuid": "98375165-a3e8-4658-bd91-11e56d197651", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220283, "uuid": "341ad48e-8518-4b39-871a-aba39973ded4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220283, "uuid": "c4c973c6-8107-408a-b539-4331880264fe", "value": "info-1057970756.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d5be99-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219297, "uuid": "05e2fc92-d2ac-487b-bb63-8b275a0ca24a", "comment": "Malware payload", "value": "ffcc11af285a939b35a3e21e8a495803", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219297, "uuid": "fe1e1284-3d8d-4d35-86b8-493af714bf1d", "comment": "Malware payload", "value": "07a0d342afd448848581d7fcc16e3884b7dd193383bce94e079deb284ec6f5f6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219297, "uuid": "5ab56c5a-c7ab-4674-b2d9-bd910fa7eb2a", "comment": "Malware payload", "value": "36a8a4e4da3dc5559a77a56484ad5a1aff388d4a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219297, "uuid": "61af0c76-69d8-4455-8cfa-36de8fffd1be", "comment": "Malware payload", "value": "fd07d836664036e68fd718f1230ed5110f76d2758ce7d122602ac8acaee3899c84f04135da889692f32ab7fd5614b635", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219297, "uuid": "c8b95d51-60b2-4b1a-ba4f-4fda7be92e99", "value": "3D8312599B1B7DA7505F3CF31B322A5ABA03BABE0C1C7096DB78C2D0E33951E25642D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219297, "uuid": "015c42f5-8383-4055-b9f3-72a9c2f98f54", "value": "1536:p0f1lwtMJDrsPSpV8LS4v5YFGrfZg6kxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QG4:ccQ8PjLRv2FKeJ9a03fjwe1moYpo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219297, "uuid": "178711b2-1020-4125-b6e5-e8182a7b8680", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219297, "uuid": "0cd58c3c-52db-4256-af5c-92b971532c08", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219297, "uuid": "bf54914b-a340-485b-92bd-fe5578fee167", "value": "catalog-1998548315.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ffa40b-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218034, "uuid": "d36dfb7f-2dea-42bc-a7cb-d84c13d23e8a", "comment": "Malware payload", "value": "822976c56cb68faa3eae60a0558cee47", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218034, "uuid": "fbe2821e-7609-44b5-8831-f2416a0095c7", "comment": "Malware payload", "value": "07b99dba169b48ed1774141563b6e24ad731ab82d7c29c35c7409d0de70d3648", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218034, "uuid": "561d0c5e-5c79-47a5-a116-5df09317d1df", "comment": "Malware payload", "value": "e80ca2fac7ca4b325cbfd9aae1dce8611db5947b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218034, "uuid": "66d04484-99df-42d7-b4a3-5a54a80c9c3a", "comment": "Malware payload", "value": "aa5f516a42be2f4aeec021db60c3a698a73453d4e2e8508e045665ff808b9243ee0a17edfbc7b5fa43981c33714d0a60", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218034, "uuid": "8301c706-6685-439d-aedd-2de6ea5ef5f7", "value": "14830298CB9F8D948005ED0AAB12F8ED75505248716973ABAFAD1124FF478D5B2328F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218034, "uuid": "16ef63cc-7326-4a53-ba63-2457ee8b1518", "value": "1536:RA6P7EGmwH1zVQLQDYflSJXvoDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnJ:RAY31zVQnIJXaM25NfuQjMCYNBwltD0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218034, "uuid": "c841f091-fcf7-4560-8721-869dab32ded0", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218034, "uuid": "58aeda4e-2b29-4c1d-b92e-3c0517d9232c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218034, "uuid": "48841b7b-099d-4e91-ae0f-a401c804e1e9", "value": "catalog-1304536568.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6daf3dc8-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220001, "uuid": "b0f0a716-71a4-4cad-a2b6-a514530f853d", "comment": "Malware payload", "value": "925e046850b69d0e58f7bd0c691dac6d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220001, "uuid": "8e89a127-2ec0-4a90-836e-523b0ffdd756", "comment": "Malware payload", "value": "07c5aa2b653d016100c181529a174c3c5f024c6159519f7203d30f97e4ea3c33", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220001, "uuid": "e0d5fe9d-7a3f-46cc-a866-4a56151c88cf", "comment": "Malware payload", "value": "e1997ef308c0a10e120519cbedcd23d45a499ffe", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220001, "uuid": "e8fc055f-dc47-4a85-9c71-8b9a44e2711e", "comment": "Malware payload", "value": "d9ea60af7e266aa5a56a6f7551e5a59f8045e7c1b4abd36502096b675bc8796e99cb11e00ba29140e61abc6adf3596a6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220001, "uuid": "e5dcf980-870b-4d20-b669-b85606081611", "value": "9B830232FCBA1BCC5C1DD820D0256DF4096FDDAA959333B859682D32208D67D6B419EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220001, "uuid": "7df12cfb-6b04-4ac5-9d20-16fea3d78d1f", "value": "1536:ng2sNyMfHfrqQaiwotTqFUAAWB9Te87VqINbtezgVRxr9AiUrQTKXs8FI+b3:VM3XvtTqFpe8JqmdIrLjFRb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220001, "uuid": "5dfe99c3-3aca-4af9-9d9c-453edf2677a1", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220001, "uuid": "06304fce-e3dd-4ab6-a7f8-782f21770577", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220001, "uuid": "aa2dd264-a831-46d2-a9a9-5cfcf520ca3b", "value": "catalog-459634010.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c15d0235-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220142, "uuid": "84c2fca0-5ba4-486d-9f44-b2e6596bada6", "comment": "Malware payload", "value": "47277ab4d3d4ae665cff36322392d9cc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220142, "uuid": "3c3c8ab8-4efb-49ff-b3af-04c29d3a781a", "comment": "Malware payload", "value": "07e81322bf3bb764dd5ad02bd3f735152760bfb2ebba95160d0225b5f342422a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220142, "uuid": "fc6aa8b9-d5aa-4833-9d74-8f34e3d46a1d", "comment": "Malware payload", "value": "5a970faaabdbc6420ea40211e16e79c8472d4c60", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220142, "uuid": "7fede9fe-6921-4bdc-b7ee-135cde50a351", "comment": "Malware payload", "value": "85e69a9bd04f174c9193a10c9507a8f0dbba3e9f7afa74b5aded73fab8e974dfa610fca2cd46e054806aa2834345608b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220142, "uuid": "8cf6c4a0-6247-4b66-9591-ad49641a70d6", "value": "AC830298876F4C9C8005ED0EBB22B8E975505148F176B3B6BF6D1134EF468D9B2738E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220142, "uuid": "81c98153-0b87-4590-a28a-1ba0a63beec5", "value": "1536:5A6P7EGmof2vtQLQDYflSJXvoDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrne:5AYn2vtQnIJXaM25NfuQjMCYNBwltD07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220142, "uuid": "3930c94c-ddaf-40be-b4c9-0d84b8ff9670", "value": 86930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220142, "uuid": "fb1122f8-0e44-4d26-98a4-38dc6b202b47", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220142, "uuid": "8d77a1a8-7a5c-4d1b-a1fc-651374973eab", "value": "catalog-541815232.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1750768-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218800, "uuid": "58a02946-101f-4ec3-8513-d1895b050839", "comment": "Malware payload", "value": "0e2a2efbbac47c662277dd7c7ebd05c3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218800, "uuid": "8f391461-03b7-46dc-84b5-1e9344626d03", "comment": "Malware payload", "value": "081098516e6ca23c66ea0de8961aeb596578bf47039614ee42ffd4588f33e44f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218800, "uuid": "263a261d-49f0-4f44-ae33-7958028148de", "comment": "Malware payload", "value": "bd8bf11a7e2a7050a87822409306a1b1927cead2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218800, "uuid": "6449590b-52ab-4475-9549-9a7372c80bcc", "comment": "Malware payload", "value": "58a13fb326e9c02382c84e3cf984997818d852d9e2b50adfdf1c7175ffa8d95460bc631d47505ef46c1a83974c575c8c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218800, "uuid": "fb047797-e4dc-4203-8f1e-2603befa8792", "value": "6B8312E4C79E0CD5C1558E0D3B22F8A8B911311C3128B5E7FAAD58B56B534E8A2B3DF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218800, "uuid": "e0261a8a-3c60-4381-8407-9532d3eda334", "value": "1536:WEbf1lwz7up/vqBuKXxP8JXvKDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnS:WqcvuBvaXxP8JXoM25NfuQjMCYNBwltW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218800, "uuid": "a2909820-be28-4b0f-9c95-58fcec69bb0a", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218800, "uuid": "1d7c011e-ab04-46de-a1f8-6945f640b779", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218800, "uuid": "53deaccd-b907-4e84-96ce-b0664234a027", "value": "catalog-1719927229.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "674a83da-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222138, "uuid": "695e6ea1-a7f4-4110-b24b-c6fcb5e22ee9", "comment": "Malware payload", "value": "d40827a19d17456047b1820d6bd7d725", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222138, "uuid": "bc91d8e3-6df3-43ac-9a83-70aae47e59be", "comment": "Malware payload", "value": "0815cf5b83b4b92ab41341a3b2eaa399d000c19895c3461ed164977caeb5633a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222138, "uuid": "c5e6222e-577c-4586-98e1-cfe3e627ad4c", "comment": "Malware payload", "value": "f34779be7f31760ffff5096dfc3798856868d069", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222138, "uuid": "c8e4102b-d05c-410e-be28-6740869b90e1", "comment": "Malware payload", "value": "c1863e2ff516c9c1194dc3a1d954b25588a2e132564a4397287d6a9864e9afe80fff6aca1a897e65dd4d352103056c17", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222138, "uuid": "c40e811c-0925-410b-8fff-15d8e3901377", "value": "A7830215A4BC86A780F3159229307BC78AC0EB9B984DC043F1748E27A4E6B66857BF5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222138, "uuid": "fb7d5102-0cac-48a7-a9e3-f2d721383712", "value": "1536:st1QVGeGug5dwSp6yMvBjqqxM5Y2VXw1QFsrGq9ZMlmZQTQdG:sAG7u8l3MvBjqqqXw6Af5dG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222138, "uuid": "a71c44a9-2e38-4f04-be97-8c45a2731fc3", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222138, "uuid": "5e577122-efd7-4c15-93b0-e1e123155e91", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222138, "uuid": "766511af-208b-4e30-bdda-afab2a0c8ddd", "value": "info-2147278615.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0aeffb-a3cb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1619137861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619137861, "uuid": "993051f4-09c6-46f8-8ba4-6f24f96674fe", "comment": "Malware payload (Loki)", "value": "18a77bbe88860829cfcef382b57cf513", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619137861, "uuid": "10143911-30ac-4803-8b84-2e79481f7dff", "comment": "Malware payload (Loki)", "value": "08311c419d042dc9548f695e38c83f0040cbf3f94a593125837c8d93331bdcdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619137861, "uuid": "84c1e559-7f1a-495c-a902-8e967a0ce1fc", "comment": "Malware payload (Loki)", "value": "9fe5875d672be812384946e4e4441ee9f8b00f3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619137861, "uuid": "3c6174a5-e3e3-4721-ad83-993a337be68b", "comment": "Malware payload (Loki)", "value": "704891e618e5f1464f06e6e7025699eafd549c22b4c2e4e1b2fe3b152a7491fdfb8757283fa94b716c2f21cafe76e60f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619137861, "uuid": "7b146811-c861-48ac-84b2-6b659588005d", "value": "A3057C9C7650B6DFC857CD36CA642C60EAA0B467430BD303A4A316ADE94E6DBCF151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619137861, "uuid": "35f638be-38fd-4520-b013-d78ac7fc5f4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619137861, "uuid": "1c86232e-2de6-48af-ab5e-16d8590b1266", "value": "12288:7N+OAGitQZl7anLtMjprmBntFriQXTJxjXxp2+162n3NXhLZQxieSgv3/RVs6LLL:78WitilCSrm1tp14+16iRL+xieuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619137861, "uuid": "2c423b83-1a54-4b5a-8b24-2919d3b73dbf", "value": 797184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619137861, "uuid": "1c114293-9bbe-453c-bea0-be11d5bf6e3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619137861, "uuid": "e2e186fd-6b44-49f2-93d7-4d08e4aedc49", "value": "quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57262a02-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217816, "uuid": "3a479787-684e-449f-b59f-25036a17bdcf", "comment": "Malware payload", "value": "dd35deefc73874c94228f6846d8bda9e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217816, "uuid": "ec44d6fe-dce3-4c07-9cde-fb0f28c38cd0", "comment": "Malware payload", "value": "08312175162976f256d28450af7d07cb6b1d0037b9caaccd3771dbb1a0861327", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217816, "uuid": "c2412376-aac3-4532-83db-50c88583cc7b", "comment": "Malware payload", "value": "69bff7d978058be61c2ebe6fab905a0a584778e5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217816, "uuid": "47d6a95e-d1a2-4477-8657-7cdbcce452e8", "comment": "Malware payload", "value": "21a4dbde9b904ed15847ff1ba99f9cb78916310422f6e2f2af0a573056897280f08a747ca3e108cdbbd8826f1867a219", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217816, "uuid": "6a6cf564-7c6e-4c13-96c4-ebd443a21cc7", "value": "398312EBCFEA4D9842027F0673065DBBB45428096118BA7A7EDD11502F514A0F8B7DED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217816, "uuid": "c34a8800-a6b4-4fc9-a750-076b965fc0d0", "value": "1536:m1KLWkP7EBmnbRARpNdZ2rQD2FPdo1f+5ff9fuQjMCYNst+IHClPLqkwD0DCuADj:eKLWSFbkpwQKW25NfuQjMCYNBwltD0DI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217816, "uuid": "4998c5a0-d7da-481a-b3f6-b2030d242be8", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217816, "uuid": "d106be31-55d3-43fd-8048-eb28d613e4a8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217816, "uuid": "6ff34703-0b4f-4a0e-8258-53e67365ed65", "value": "catalog-1179160191.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94046096-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220495, "uuid": "133406f8-df9d-4a32-8482-7bafa6548b69", "comment": "Malware payload", "value": "89910800f0f84ceca39b163bce9da65c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220495, "uuid": "7ce76a9d-f496-4aa6-a0be-c4abb11df277", "comment": "Malware payload", "value": "08318aeede16809bd98a672c5069203e991c353b055fd55b2cbf3fdc22d46acc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220495, "uuid": "a1edbb76-c4f1-4f8c-8480-78ed10758e27", "comment": "Malware payload", "value": "3b22f6ab3df9f2fef06916638e64e2a8164f4c05", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220495, "uuid": "6a86a1db-7d9d-4bd0-ad76-e433ffdc158f", "comment": "Malware payload", "value": "d9b1068a54b98748bc0e01121a7556daed8ab17ec90bdb53182938ae6cfb6789cda98eaa8a9b3838005c995a0f85e26c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220495, "uuid": "bfb74136-0d17-4053-9d71-2ec54cc70f0f", "value": "5F8312A128BC40DBA38F6BB3956216C2897413E143BC4F9B6317333939A09DFD92B354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220495, "uuid": "2103e517-e6d4-4318-8b92-7bed1c09743b", "value": "1536:44s6qinLPXZ54w3LCqBqh8CWb/bLCDxxp/ERd9QnGlRTH7qrelcJ:44PqmL/Z5r3LCqBqh8nfLMZERQnGnTH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220495, "uuid": "7d31715d-b5f8-4771-8e8a-2a276e2ad084", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220495, "uuid": "fa6b29a4-fe79-4bc3-a3fd-1307603da82f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220495, "uuid": "c0d14e10-a0eb-4495-90ed-49778c9f8406", "value": "info-1193566143.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d91fa9c1-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221899, "uuid": "ed45806c-6e9a-4b66-8366-62c311c4d9d3", "comment": "Malware payload", "value": "fd52c6df16d99f6a59fc6694d4de7ec8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221899, "uuid": "45abca65-1613-4207-ab0c-0623ab90baa1", "comment": "Malware payload", "value": "083afc52eee364f03d8f6e609c958bcd9d6e9ff1cf3bb9e87b2eea726cd710cb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221899, "uuid": "3490330e-b194-475d-9e4b-3300467f6abf", "comment": "Malware payload", "value": "f26d1ba48872ccbd64b0380f6add9fea551d1dba", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221899, "uuid": "39b5417d-d938-4487-bafc-1554471f8ea7", "comment": "Malware payload", "value": "ccaf879988b9c0afa0b660dd0030d1e1341ed51daf0c4049f599a42130ed41b3ae5916c5c94cfdf1c7d563fa3d7499cf", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221899, "uuid": "4f419b34-08a7-4f54-a924-2bee4fb83ae9", "value": "3F83124D35EDC040E17F7D6093AAAD5901B86F4BEFFB9164CA6961329901863EA0368E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221899, "uuid": "22c73327-a229-4ccc-a212-e1ab286e1db0", "value": "1536:HwJNfD6jITxi7UnLkb/Yw3LCq1GeOuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbF:HwzOEliUne/L3LCq4kO6xoKDShicdBMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221899, "uuid": "7b95d27f-682d-48d3-93fc-df00b257b229", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221899, "uuid": "0c4fdeab-91f4-482f-8b2d-2df3936e9c6e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221899, "uuid": "1364b28a-cce3-4419-b20f-2b2e836ca4f6", "value": "info-1963244259.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a157f5-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217860, "uuid": "0b37914d-99e9-4621-a4d1-6adbe7d450a1", "comment": "Malware payload", "value": "85df2af7a65b0cb2f0326b519c78285f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217860, "uuid": "1cff00c4-8e48-4847-8620-ae2523604022", "comment": "Malware payload", "value": "084ddb61300b4cfa17b9f92050447b9b833aeeaad1daac56eba93da9fb3f7ea7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217860, "uuid": "dde3204d-efdc-4132-a7d0-92cd642bc72c", "comment": "Malware payload", "value": "83bdc58a97c9fd08285d2193854d9c066f943f52", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217860, "uuid": "096be2e4-25d8-4e15-95ff-c21acf28452d", "comment": "Malware payload", "value": "43c04c01fc56507464dbc3eb7317670f6400e7848cdd8f485098c90514e4ad0262c99d69cb2d58a85fb9b71696e6e999", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217860, "uuid": "eb586008-2d89-4881-9f94-c917f19f2695", "value": "718302D872AA59685CFCB61D2EAF79491EFCF3A54EE20233E244811674F1698ACD4314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217860, "uuid": "acf595be-534d-4baa-97db-f8dbec2cac2c", "value": "1536:K6WaUf0IqrKC4r94hhs/9AGEiFALqCJI3+xOtGkwdO2eDiFX0:+q0EaKUFALAOxeh4ONqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217860, "uuid": "16f2db8c-8e3b-4c62-a3d2-5e18679f3fbc", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217860, "uuid": "5a24fe89-d6d3-48c2-9ed7-a50608cd12c4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217860, "uuid": "90f1136e-01db-4676-a612-ebc7ef338eae", "value": "catalog-1199550189.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88fffcdf-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221336, "uuid": "f19c0d40-ed4a-43bb-8cba-e7f93cde5102", "comment": "Malware payload", "value": "1cb5457517874ae37ca656dbce4b0cd2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221336, "uuid": "cfb72867-ffdc-4b0f-a606-b9290a6de3d2", "comment": "Malware payload", "value": "085f2c0b75537512554aa278f8a360af0c9171e6cd1d781af5d49cb7e753d12c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221336, "uuid": "d0fde748-235d-4031-968d-11a7c5df7ebf", "comment": "Malware payload", "value": "ae82c807c1b51003c6330b352bf5e81c7f2997bb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221336, "uuid": "2c3b8045-c8e7-4fb2-aa50-9bf98f0b318f", "comment": "Malware payload", "value": "48545bc553b0ad4435be177e117c7be821bf1933e4aa457d28aabd80e23c354b3ffc594de5de07950229d99525c127d0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221336, "uuid": "98093170-b82d-46c1-a45a-036bc4ddece0", "value": "FE831207856158FDF16ABF01273DD4CFAA4ECBE1E92559C0F20E7F65D2A3399225440B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221336, "uuid": "bfb7e95c-6e6a-4114-845a-556a50bafc4a", "value": "1536:9HZbN5m6RtLlLHfAkZ8kISNq7xWgwMQZL197v7UZoctQ2kPo+4mpRlDi1nUSUqx3:NBm6XLFHfA210wN19T7YptKRNpoUSUql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221336, "uuid": "23b6c776-3289-4cfb-a64c-f0af780de7fd", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221336, "uuid": "1b166c95-163c-4af6-afd7-25b4bc935853", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221336, "uuid": "0733d6da-6686-4384-a162-03dd6ec15115", "value": "info-1626306617.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffbb30f8-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219817, "uuid": "1e33aa01-8f88-4963-ac11-ee7fd5777ce1", "comment": "Malware payload", "value": "e64afe7da41388c212d4f7873eb83465", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219817, "uuid": "5e6c1155-4ac9-4a81-8688-41951c4c4d17", "comment": "Malware payload", "value": "086eb3994faea360b75af62db745a8a34a6c4bbf901a791cb255597d6c30625c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219817, "uuid": "848b6f1a-f177-46d3-99be-804a0bc69a11", "comment": "Malware payload", "value": "06dd0625a8d0e9474da17e53038cd0d56cb78117", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219817, "uuid": "4baf30d0-a437-483b-a491-f68f78dfd8c2", "comment": "Malware payload", "value": "c3bfa3da76b83592c8f8a5e41ca9da459ded6fac7ac5007c2902da4d69b1ead1c4237f924504ecc713c97860f09463ca", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219817, "uuid": "45d50310-0c60-4f49-9b85-6b620dc4d96d", "value": "E78302EA654236BEC8FD951D306F3D402EACB2E56E3211E7D207D93770F9AA894D0718", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219817, "uuid": "ee3b888c-897f-48fd-8dea-2a04862eaaf8", "value": "1536:DaF5u1k94TfvqBuKXxLG1ZQUcDwiFALqCJI3+xOtGkwdO2eDiFXvL:mF5fsvaXxLG1ZQUcD1FALAOxeh4ONqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219817, "uuid": "2fc3a9dc-6ffb-46ed-b262-5fe1e1de2e29", "value": 86930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219817, "uuid": "4f7dad78-bed6-4ba7-b1b4-a565cad1d048", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219817, "uuid": "9f224930-5895-40cd-a272-933f07379e9b", "value": "catalog-356120057.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e5a853-a418-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619170891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619170891, "uuid": "82aa6abf-1170-495e-8342-f71a71821230", "comment": "Malware payload (AgentTesla)", "value": "8d257998290818e934b4b07851d9caf9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619170891, "uuid": "a8418ce4-f6ab-49a8-b7a2-068090039c4c", "comment": "Malware payload (AgentTesla)", "value": "08d1225431604a297ab36cc4b46a4b43bfab9ec19ec33aa1c769c329c2b4d6c9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619170891, "uuid": "1f1a7dae-9a57-42e5-836f-ca8a16f46d57", "comment": "Malware payload (AgentTesla)", "value": "659439bbc9f6d984e0443c0ce2abd2a242010def", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619170891, "uuid": "521ad8e3-4df4-41db-b35e-1d7ffeb3d0a7", "comment": "Malware payload (AgentTesla)", "value": "55ea4afe2e6e054b5f1894e9a0262770aed641b94a12fd3e5cc105fed9a17c28298c79b5aa25fc23b335278eb7d71dd4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619170891, "uuid": "c5d2342b-38c8-4e5e-b95f-fd1e72311c33", "value": "6AE42338CCBAA5D10518558EE8FCE480A247E7656AC7FBBB711EC7529CC7321758DB80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619170891, "uuid": "eb6085ba-b0a0-46e9-aea9-241ff485abb5", "value": "12288:E3ez+1GIGXYrN2/Qb/z41L/48LSIT+s+ktt0opywv07d2is:ELUIGoJYCke8GIT+2ttgP7d21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619170891, "uuid": "b4bca9de-a940-4e04-9c1e-39b12eaf9543", "value": 674943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619170891, "uuid": "34d4972c-cba5-4ba6-8720-49757f36ce68", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619170891, "uuid": "d9d727cc-ad95-490c-b576-c8f90c454703", "value": "_ae6854gfhj.png.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa7ab33-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218386, "uuid": "b64ecd58-b532-4819-a21c-181ae62902c9", "comment": "Malware payload", "value": "70e2b9fdcee764fed8551bf563326400", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218386, "uuid": "88187dee-0ad2-4a8f-a531-9cc89b89a848", "comment": "Malware payload", "value": "08da9475b51759542e3f9bf0b7b5101075d69afb8078c35a4a15a864cd8b54e8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218386, "uuid": "5087f9ae-58fd-465f-88ef-5a92d429eb92", "comment": "Malware payload", "value": "68d93a364b09521068d6bf6870821f0df7a56581", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218386, "uuid": "e82eb1b5-2371-47bb-a46c-8068fd65450f", "comment": "Malware payload", "value": "da87d805da0ed065ec96d1bf72e92bdb310688009735ea35655d65243d90e5ac8b179679be50847d81c700bb1ea45319", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218386, "uuid": "650caa52-ad35-4b49-8515-bac8652d0088", "value": "B38312E87E2B96D5A7B04A4AC5EFF4C61F954BECC46AF0A31D09BE3588306DBA115034", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218386, "uuid": "6557ae72-38be-42ea-acb8-6cc284c2e3d3", "value": "1536:cJAUAlZ2YmkLx3wRBD7flmTUjoB8+wXdpUna5ahL2dmTLUVVvz:eAUAlIYmANQwTuXinakEmEV9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218386, "uuid": "ef54fc3e-aeda-4ef2-8cad-fdddff0587f0", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218386, "uuid": "d22e89a5-3df9-4ba3-96eb-0f1bb4720f88", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218386, "uuid": "961c99d2-ec08-4122-a26e-d22b5909c5e0", "value": "catalog-1480653772.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a297456-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219056, "uuid": "39cbf499-dd12-4a13-a4cb-61979c4cec25", "comment": "Malware payload", "value": "a2075d2f0e72081aeb190465262d8ef8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219056, "uuid": "fdc11487-9571-4cce-8f8f-2ec964f9724a", "comment": "Malware payload", "value": "08eb953c67c58a73c4741518191157e6420263eec013929ae90a54523a1b6716", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219056, "uuid": "edda71c0-6b4f-47b5-8b51-030ba9790958", "comment": "Malware payload", "value": "e78c0b053aa7be4292179a4869dd96f8b5e0db5a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219056, "uuid": "7081025c-3b0d-4791-9f9c-e1a362e52a32", "comment": "Malware payload", "value": "fdbff9bfc82184f31da7fdc610c61f7e6986a8916c3b6e147370ff0fd0a5f13ee0eb23431251eae402dc667720e2067b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219056, "uuid": "25adbdcd-74bc-453b-a247-1d4ffa6b6546", "value": "7B8312EBCFEA499842027F0673065CBBB45428086118BA7A7EDD11506F524E0F4B7DED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219056, "uuid": "48270dec-e142-473f-8097-dc7b751c63b0", "value": "1536:CgKLWkP7EBmnbRARpNdZ2rQD2FPdo1f+5ff9fuQjMCYNst+IHClPLqkwD0DCuADc:DKLWSFbkpwQKW25NfuQjMCYNBwltD0DL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219056, "uuid": "5d8ee6ad-24e1-41d0-bc08-d1dc39d58397", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219056, "uuid": "62bc1173-0b2f-45a1-b434-4cc65f721e1a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219056, "uuid": "ac00aa6b-e87b-4090-92de-0e4d5d7c7c4c", "value": "catalog-1862934891.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f74f0971-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219803, "uuid": "ee171f04-023f-4839-9c65-d57e3ec2a7d6", "comment": "Malware payload", "value": "f4c43814217707c1f7c044ceba48cde3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219803, "uuid": "0c9a7008-0436-4455-b187-c89972474c97", "comment": "Malware payload", "value": "093cf85ae766accd7220a375ddbd9ec02d39836ed33bc76441a50f7f361d3cac", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219803, "uuid": "827f9842-ca0a-44f9-8a78-cced8b2bb247", "comment": "Malware payload", "value": "78e2b8c1420fc55fc00a40f23f5eff8ec45196a4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219803, "uuid": "fd4d52ba-d445-461c-8cac-7db5582cef7d", "comment": "Malware payload", "value": "ed6e2a6815d2f33a2807c448e069bdd6bf09cedea70be9f585c18c7c0832bdbad4d44a054ad304e49a4b48e97231cf1e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219803, "uuid": "34d1a3c7-a3b8-4848-8797-a28ae7bc8b6b", "value": "1C8302CBB4E9433DCF3527B748AF1E046261A43F440886EC75D73BB86B426B26572389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219803, "uuid": "fe87c863-3544-44ca-9f46-00a322bfdf72", "value": "1536:1VAfNtg2tf2vCapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvZ:jijtt2v7mU9j7+XFWtYe14hbOjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219803, "uuid": "c3190a97-5c20-4470-8a0c-87d6fd5f4218", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219803, "uuid": "3ce7b1b7-d1c7-4744-a46d-a73abc0ce8bd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219803, "uuid": "b50e5fa3-16c8-4235-a833-f55bdc73b13f", "value": "catalog-348562400.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "258b5999-a42f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619180796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619180796, "uuid": "81dfcf84-d404-4652-997c-3c6a12e4ab70", "comment": "Malware payload (AgentTesla)", "value": "3ab8f2cc58fc70ed1deaf2dcfd3e7dbc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619180796, "uuid": "1d377a21-95a2-45a8-895a-63040a28a281", "comment": "Malware payload (AgentTesla)", "value": "093db73690608ca5021aa31d91238534409110470a7e60b4f6b118e4ea9abc10", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619180796, "uuid": "18b3e131-d268-42d6-bc8e-18902120cd76", "comment": "Malware payload (AgentTesla)", "value": "dbe0e2b99af8ba9125e01572b025df0120e3d76a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619180796, "uuid": "f71fb7b9-4d0c-48b9-bf93-de6924e34a4e", "comment": "Malware payload (AgentTesla)", "value": "6effbc73a3469b7ac064c44f6c22c67e92b77ef559f7b24852f3bd415a311ecb6056000662d5a052ae6dea1a35d3e0d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619180796, "uuid": "6386093c-710d-4bc8-a8f8-62cb49423b05", "value": "53C4235303925F8430A1B40663E5A792E9E05A6B98A34F5FC7F47BCDAD03F3B6859212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619180796, "uuid": "ce6a8458-11a1-4345-90a9-4362c8f0720b", "value": "12288:k4+1BC/Cv4tSBH4rPBirsSQVl5DbxQuShnQx5Y2jB7qcu:k44Fv4EYL/uQk2xqb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619180796, "uuid": "b3229b32-fd79-42b6-9112-a78bc559d1c7", "value": 559449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619180796, "uuid": "a0a499d8-5e88-43a0-ac0d-4a2b644f4b6e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619180796, "uuid": "d1391a80-e05a-4fba-a56d-7c9671903e5a", "value": "Bill Of Lading - MNLA08005.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d26cb45-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218551, "uuid": "b59e6b80-3136-4dca-809d-92d5a8d1945b", "comment": "Malware payload", "value": "9bfb53d82c368916b8086caf5be52003", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218551, "uuid": "bd1d30ab-3959-4575-a8ab-d876846bc0d0", "comment": "Malware payload", "value": "09572929bcbb509da552a46dfebf60456f39faca399b8e9ee565d73db0238cc0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218551, "uuid": "140048ec-75d7-4997-96f3-73f457d3c98d", "comment": "Malware payload", "value": "dc5a83d8c900f8c4d537f11547076fa0e144d726", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218551, "uuid": "d8c78418-5bf8-46ee-af1e-bb527afe802e", "comment": "Malware payload", "value": "c1fcdf8408ca066f2f6ac47083467c6a3e678c8b60afe38c41cd1efbf5bb863073715fd49d6554a393b21f53b4bbad58", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218551, "uuid": "fbf8ab2e-0b67-4840-8333-053785834da3", "value": "9D8302CBB4E9433A8B3513F65CAE1E4426B1A47F140CC6DC79973B786B53672A472388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218551, "uuid": "fb8e52fe-f605-444b-95c8-123232fb74b5", "value": "1536:2AfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvB:2ijtuPmU9j7+XFWtYe14hbOj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218551, "uuid": "2695a3f4-4629-4744-bea2-15ac4002abb2", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218551, "uuid": "3e5c524a-1983-4066-87ab-74b6743fd9e5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218551, "uuid": "8da32e53-b3d5-4458-87cc-ed4346a874f3", "value": "catalog-1586684455.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde1874c-a484-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217666, "uuid": "d820153c-21d2-47d3-aa7f-2c5b9a528422", "comment": "Malware payload", "value": "a0a7ce85c991f8941cb1bcd254a21f8b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217666, "uuid": "5559896b-12a0-41a9-b782-4bd0d3f32cfc", "comment": "Malware payload", "value": "09854789f4d7b6b4e85005cf78efc2c08375bc2d61271fde0ee4782abc1b75d3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217666, "uuid": "f78d102c-fd3d-408c-8755-5dcb6e89e380", "comment": "Malware payload", "value": "c624ccefe2f2f563b5ba67ccf6d031c9338bc3b7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217666, "uuid": "6cff7f07-5008-48db-bb8a-fb8f102d8e15", "comment": "Malware payload", "value": "dcf27feecd3c5955c041a41b5929fe69aeca77b94eb6a428a43854f3fabe233209d3ab89e054324ad370b31fc591ee9d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217666, "uuid": "999616ee-3101-4d81-8bc3-0af6072f9dc1", "value": "7C8302E8765AC752D370434DCABDB48637A68EE8900DE043BC0B7B3F6C126BB5425565", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217666, "uuid": "43431703-8090-4f88-8681-e514bc8702bd", "value": "1536:GFNCZ2i7uJeZQ72ZTYzqcIkUjoB8+wXdpUna5ahL2dmTLUVVvO:GFNCISue6IkuXinakEmEVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217666, "uuid": "ca66d689-df74-40b1-9080-1d6974890cd6", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217666, "uuid": "49e5beb9-2bfe-4860-bd90-6377824eadb5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217666, "uuid": "033f289a-b5f6-4725-a2bb-d881dd778b21", "value": "catalog-1096454695.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d62cab-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217918, "uuid": "fceafeca-3fa9-44c6-9031-3a45c15d1a64", "comment": "Malware payload", "value": "8283743543dbd4b99bc8cbbda5d686c1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217918, "uuid": "f3e2e08c-2b4d-4f54-82c1-821c62e77447", "comment": "Malware payload", "value": "0989d73db126b50eb68178ef61fb5b99ce52510a51808c2a5519153a464fa38b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217918, "uuid": "beb48c56-47aa-4bc5-a01f-60e57c2f79b9", "comment": "Malware payload", "value": "f7174733120340b36fc5e04b85a420a441d2a2fd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217918, "uuid": "de0eab8d-a38a-47c1-9c17-e7b92407f63e", "comment": "Malware payload", "value": "ea928899301857c31273fbce813825b9f9ff29a5d4a8bddad611e1c341e3f4f5b717391c09b15ca545277165efc07df6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217918, "uuid": "c2b0c5f3-03a9-4aa2-a577-4cf47e084976", "value": "608302D58BDE8814C4019D0C7E3ABDA57560692C700EF2E6BECF0B50BB5349AD1F2A75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217918, "uuid": "a28f3d9c-4eb4-4dc0-ad79-e69391cb1fc6", "value": "1536:QLYnBKjsMlbCIv4DhQ72ZTaNqhJXvoDLf+5ff9fuQjMCYNst+IHCkPLqkwD0DCua:QLYZIvU7JXaL25NfuQjMCYNBw0tD0DCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217918, "uuid": "28e4a504-14f3-442f-ab9a-40ec1517292c", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217918, "uuid": "dec306d7-daf3-43b9-8d1d-1cae861661e0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217918, "uuid": "fe5fdc3c-5f39-47f1-be06-49679249f7e1", "value": "catalog-1235559765.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40af743a-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217778, "uuid": "db6f6eb0-bca0-4f81-a15b-d73b379deb84", "comment": "Malware payload", "value": "64e88a34c736f872e7ade8be77f76c71", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217778, "uuid": "619a28f3-d036-43e0-a7ca-0d6944022abd", "comment": "Malware payload", "value": "099c64a0cf5a6e02267f6bf2329346834c00767405c4ccf478a9eb4e99183086", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217778, "uuid": "17922762-af4d-4ec2-b024-2f2a8eca2161", "comment": "Malware payload", "value": "5b198b68dea08efc590786d17efb3fb3f03f63ac", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217778, "uuid": "6f49cba6-eb73-4dc2-9b28-83d93fc4355b", "comment": "Malware payload", "value": "86c4d155436e20cb9cbcfa39040c0c8c1c343c418d8426f797fae6b53ebec1321b0dc53349f4bddffecd3f0ca26a9690", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217778, "uuid": "40eed254-e299-4534-b67b-4b7a32267b2d", "value": "738312EC74238966637345E6D87E90C32B5A8FBC801CB056A82BBA7659307FFE121531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217778, "uuid": "477f2da9-e1b7-4e0e-a360-7e28b041b480", "value": "1536:YBzKTWDE4Qll8LS4v50FC+pTUjoB8+wXdpUna5ahL2dmTLUVVvH:IeKDiKLRvaFjpTuXinakEmEVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217778, "uuid": "522c88eb-f37d-4ce6-b7d9-b4b9277769e6", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217778, "uuid": "c47bb074-2c1f-4f11-84c9-bc35dbe6aae0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217778, "uuid": "40e31f17-9b9d-4c9b-8d92-34d45db88b01", "value": "catalog-1160115142.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f1c8a1-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222057, "uuid": "ef1b34eb-a5cf-4c09-b098-3422aa58e248", "comment": "Malware payload", "value": "9f0f515ea7b9d2447d9e75935980bde5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222057, "uuid": "fcd52487-9d14-40ea-8819-bc78849971e3", "comment": "Malware payload", "value": "09bef45d69c7b8496be8695ac92f7ab0cf539ee153e40f107a0feb1dca6c5323", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222057, "uuid": "dbf69810-5405-46f8-bdc1-52252e2e5b6f", "comment": "Malware payload", "value": "c8d9d8c28d8a8af227bac9e6073fff39756fb30f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222057, "uuid": "2fd6c116-3ba4-4eeb-b926-f5fa5c0922df", "comment": "Malware payload", "value": "f217ed011fdcac4fb9189187105f3d14e930e523fac1b468323328f85b275c80328505518d05d08ebc98c1ba8159febd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222057, "uuid": "f2bfc089-4e4b-468c-92ac-0cff368a8e87", "value": "138302079961A8FDE16ABF02273DD4CFAA4ECBE1E93505C1F20E6F65D2A3359325440B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222057, "uuid": "d7c8ef64-4715-43ce-9842-c72375b6f815", "value": "1536:6kHZbN5m6RtLlLHfAkZ8kISNq7xWgwMQZ2197v7UZoctQ2kPo+4mpRlDi1nUSUqA:6wBm6XLFHfA210wI19T7YptKRNpoUSUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222057, "uuid": "af4120f7-9ded-46a6-aff4-eea68000bb06", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222057, "uuid": "f8b88cf5-9d96-40a5-88ce-632ed4759018", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222057, "uuid": "49d94298-740a-47d1-adb1-d9318413df72", "value": "info-209301730.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2571ab-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221822, "uuid": "d5143eba-f2a2-4c14-ac7b-b38826948887", "comment": "Malware payload", "value": "2ebdd6603ea4dcece283624f08fcef72", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221822, "uuid": "4f32776c-9456-48e8-be15-927f34ade8e0", "comment": "Malware payload", "value": "09efd1712b4e3b0ed6a7fac5e5286ef086d18fbbaf30124e8ce25848bc70d41c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221822, "uuid": "521fa8e8-e6b2-45e5-8be6-1aa0b610614f", "comment": "Malware payload", "value": "70126bc7002b8c371e8ff8c13a44b4f45417c488", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221822, "uuid": "03380f14-aff7-43f8-9dd7-95cdf91534e1", "comment": "Malware payload", "value": "b4f5ed0f7cb57748dd3acc2997b38f9f527117e40e5cc8d8df4ea180ae5fbe9a87cdf31bcd13569009ef483fb66ba8e8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221822, "uuid": "3bf44475-9170-45cc-8bd8-7d8520f0e721", "value": "74831237380E8BEDC14BF5BE50DBFCA9F261664A8C1BEB54B730199175234265C22B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221822, "uuid": "3ddb003e-58ab-4fe5-93e2-0f3e62815955", "value": "1536:gNHeZNRPrGXrjk+xnHJ5GbkC6hhcBrasoi8vQMwdjV46CTo:WUxL+9HJ5C6DmrajvIM6CTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221822, "uuid": "d1f48946-ea18-46ec-86ad-998dab56f1c1", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221822, "uuid": "6c7e9419-910d-43dd-8d6a-cad7c7574499", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221822, "uuid": "f7783c9b-bdf9-41e9-8f46-ab94af010111", "value": "info-1907303432.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03cfa6de-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218106, "uuid": "890553f0-144b-4eba-b6db-8ba479fdee28", "comment": "Malware payload", "value": "75dc62c9c1ff9db29e0b179d11e35672", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218106, "uuid": "8bbb990a-edce-4c15-a472-6d93ba626281", "comment": "Malware payload", "value": "09fba87ed9daff769c8ca4557bc8f1a058b7460472cffd437b92479b5583d9db", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218106, "uuid": "ee5c6e9c-35dc-40cd-b4b8-c6f59108e4b2", "comment": "Malware payload", "value": "f9a01a05ac45776dd70e94edeadf9eabafcebf0d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218106, "uuid": "495cb1f7-cfb2-4f03-bb38-a89174c43a95", "comment": "Malware payload", "value": "5925f1fcdb4f786b97384dc688b21ad22b3055190be698fcbed5f2888571571cfa33c0cfba518d941de77b2547c7873c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218106, "uuid": "6b8fd359-947a-4c5c-924e-34228751600b", "value": "FB831276DE8F8289C016B23103787EAA1F286B7146A1141E5BB0747B2F5B9BD4C85FD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218106, "uuid": "7f7aac8c-52a9-415d-85c9-f12c3b4b91b8", "value": "1536:bElHCzlWAXdZ2rQD2aCvdyWxaqQ6Rxt5AB/aqPwL3VbCbN:beCzh2QKmm/Qwt+awaxCbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218106, "uuid": "c46303cb-f4fc-4e93-8880-820157ffb4d7", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218106, "uuid": "ad7e41c7-3cf4-4b39-92e3-f6994bff5f93", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218106, "uuid": "9820a37a-5ead-4674-b062-c5956a1df87e", "value": "catalog-1332099196.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d33e0ad8-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218024, "uuid": "39be6e36-770b-4b22-a498-4d2341b26b5e", "comment": "Malware payload", "value": "0dc8b8b9e078372552be3eceb9889857", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218024, "uuid": "5d1d198f-9fc5-43d1-9aad-dd64c8f162ef", "comment": "Malware payload", "value": "0a150699b086f22384af93c37e54355e3e950db4893aad9f2a9a7b9ea5b1d37d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218024, "uuid": "fd4af8c3-8cc5-4350-a60b-bdd2d32be8dc", "comment": "Malware payload", "value": "3ffa5d61273c6e89b15ed5d482de0d0981df8d2f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218024, "uuid": "1165fe56-a959-4a62-b919-b11f14f30709", "comment": "Malware payload", "value": "5c6d0bc1ebb64e36ca50a8ccfb27cde4de489b702e17daba54b94fc19a3a55c465371cd38c4f5ab0d542b4a76b60dbac", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218024, "uuid": "74b6f9a6-273b-4d5a-8472-73ce1a741fd0", "value": "FE830276DE8F8289C016B23103787EAA1F286B7146A1141E5BB0747B2F5B9BD0C85FD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218024, "uuid": "0fe2a741-9dee-462e-b85b-4e8d9aacd743", "value": "1536:6IEXHCzlWAXdZ2rQD2aCvdyWxaqQ6Rxt5AB/aqPwL3VbCbtR:DACzh2QKmm/Qwt+awaxCbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218024, "uuid": "c26c2ce7-e4be-431f-87ba-74365618f519", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218024, "uuid": "a4c72f8b-c749-45b9-962a-19939e0d49a3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218024, "uuid": "832b4271-02dd-4a8d-82df-ba1526acaba3", "value": "catalog-1301858047.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de63fc28-a484-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217613, "uuid": "b9355159-1600-47f6-a7ee-3438460be026", "comment": "Malware payload", "value": "87a9871f46635f63e4bcfeee5803ded6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217613, "uuid": "cd58ae9a-ec3e-4630-a6f2-2095f99dde37", "comment": "Malware payload", "value": "0a18ffb959342e889ff686083f7e811439014e1765b0b83683f891b0f559f288", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217613, "uuid": "3b20783e-72c2-4bac-aa8e-302224301604", "comment": "Malware payload", "value": "9ba53bc2c263bb76f02efd7273978ef5955291af", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217613, "uuid": "0468d3cb-7064-462f-b840-9faba4ca8367", "comment": "Malware payload", "value": "965cab21e11342ec61e7bba8cffa77c27cebc92562d447ab04397e9725fbf1433d1f32e34ff9a91fa9e9b5847f754cb4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217613, "uuid": "9f4f07bc-25da-4249-9b60-68ab96faa129", "value": "678312E4C78E0CD5C1558E0D7B22F8A8B901311C3128B5E7FAAD58B56B534E8A2B3DF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217613, "uuid": "b2f8edc8-3ebb-4e5b-9e90-e8f1604b3fc7", "value": "1536:nEPf1lwz7up/vqBuKXxP8JXvKDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrn7:nicvuBvaXxP8JXoM25NfuQjMCYNBwltH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217613, "uuid": "1545e8f6-e96c-4510-b1b2-d4798b21f368", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217613, "uuid": "a6f14222-7c82-42bd-ab8e-01ca82cb47cd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217613, "uuid": "a2626d63-8233-475b-b3c7-f410e39e87fb", "value": "catalog-1063941474.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24930f0c-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220738, "uuid": "d07a1dc3-dcb7-4f8c-b270-96e680ab8e98", "comment": "Malware payload", "value": "ea58e819c93366a900835ddb3d72848f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220738, "uuid": "c99d2ff5-07a2-4159-a82d-e0bbadc86138", "comment": "Malware payload", "value": "0a3707b4b9eab558a771145aaa068533334cd170c3cc46953802f9bd5403721e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220738, "uuid": "98247145-37ae-4011-81e6-98d36e4642c1", "comment": "Malware payload", "value": "fc036eadb471dbc9e84323f542e0ddaa5ef79a74", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220738, "uuid": "aa4a40a3-8db6-4411-9ea2-369d1c211f59", "comment": "Malware payload", "value": "b55b18ee38c8066052e1f6d65d6c62c22fc441a98d523ec4b6e1c9c69711b7df45857b0c552753b154073032b9586554", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220738, "uuid": "edb14001-5453-4a0f-abd7-a00e2611ddf7", "value": "3983121A99BD1CD9C0BB13F00D73094D4860EFBD411C8449F14AA68F749EE85DEB7AE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220738, "uuid": "71e1c843-6780-427f-907d-d62cbce7d9ba", "value": "1536:nt1QVGeGAg5dwSp6yMvBjqqxPGLuhCWdHsh1oSFWsfEFhHqLWW:DAG7A8l3MvBjqq5OsZdHAO5hKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220738, "uuid": "7846141a-7902-4548-a832-cd3b748f573e", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220738, "uuid": "146d8677-809f-4b07-88b3-1f1cf077e8bf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220738, "uuid": "b09c6977-388c-4024-9632-28b2c5ee3bed", "value": "info-1349078212.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "557fb733-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221679, "uuid": "fdb29277-19b0-4822-9e31-64129df54c70", "comment": "Malware payload", "value": "aaa9f2721b2b18c752f84580312a0538", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221679, "uuid": "cf7b7a75-8439-4676-9139-7e2562f03c8c", "comment": "Malware payload", "value": "0a7fbd32ee5506fcd847d40ca5ee910999c23ba535fee2bbe02a8d40c670db39", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221679, "uuid": "a5ddaf3d-0de7-4b99-9824-b2a7c2fdaa5a", "comment": "Malware payload", "value": "9434e27b5a6f364bb54a3757b058194481ea3228", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221679, "uuid": "c8872de7-6a50-49ce-89be-400b709a086d", "comment": "Malware payload", "value": "cd3a0077e65d93584d8fc7ca585239a07af0d06154082b9caef7ae076909067d0e73f3e68def767fbfdd1d0e585492cf", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221679, "uuid": "d5181b4d-4468-472a-bf11-81b72fd5799e", "value": "8183124D35EDC040E17F7D6053AAAD5901B86F4BEFFF9264CA6961329901863FA0368F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221679, "uuid": "923a52ca-ae45-4da5-85d1-301cb7bfd430", "value": "1536:lDwJNfD6jITxi7UnLkb/Yw3LCq1GeOuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzj:dwzOEliUne/L3LCq4kO6xoKDShicdBM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221679, "uuid": "d44ff472-dd18-4409-abee-be581d3adbfd", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221679, "uuid": "87c65b74-de74-4cb2-96bd-f406dcfc0f50", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221679, "uuid": "66a1b324-816f-4d10-a43a-87e41d0ae97d", "value": "info-1812022047.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "362e055a-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219479, "uuid": "a2218fbc-f0ef-4267-a5ff-80fe2f2ac8b4", "comment": "Malware payload", "value": "50ca1d1e54f3847c92123bfa2c45cf21", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219479, "uuid": "dc75db4b-f52e-47f7-981f-9a0a037f56e0", "comment": "Malware payload", "value": "0accebbbef06908397267f2a3d42e7d719170b45403e31306adaae674d24b222", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219479, "uuid": "a6a5891e-a54e-4592-809e-c3c3707d1c86", "comment": "Malware payload", "value": "86de661a8c0eeb61a77f73556dd6aee4b8377575", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219479, "uuid": "9125796f-158e-435b-8d0f-e005086cc274", "comment": "Malware payload", "value": "3a491760f87230334e6e493eb39cfa5efc08132f118916054daa63da267df529534b89d2d01170abb57235fe15436fac", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219479, "uuid": "a9e98bb4-be8d-4a89-99f9-3a7f7b1c0f99", "value": "FF8312B347D9689D7067BC2882647FCF99D95B23AF040C4F8AFE0B6B11974AD3690790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219479, "uuid": "424f9302-e87d-457d-9d58-8d53c8e4da97", "value": "1536:3A2fnBKj0MlbCIZi+nTnfZA6l3SNZzTJAsB0Ic6DMADMt5zC/IDIz102:TBIZiifrCNBJAIlcAGIz1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219479, "uuid": "edf16aa7-ca80-436a-ad44-72d8163f8d45", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219479, "uuid": "8e6cda0c-122c-4e70-8254-08893949ecc4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219479, "uuid": "1939520a-5029-4f8b-bdeb-f3a0f5a0e420", "value": "catalog-2113328518.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87dc5805-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222193, "uuid": "935b36ab-c520-4cbe-9ef7-b524d16d3259", "comment": "Malware payload", "value": "572ca2487fab444012acff2ba778001d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222193, "uuid": "5dbff72c-25cb-4d14-b9f7-a5a9bacd5031", "comment": "Malware payload", "value": "0ae76235d47ccdeeda82cfbcb89a368e38d20f715cffc27ba52927279c525017", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222193, "uuid": "c58356c2-c8c4-4295-88c8-064059fb461e", "comment": "Malware payload", "value": "5fc4b2d5163b99037ac9a6bc8622a55cf605b4c4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222193, "uuid": "af5700c4-83a2-4fb5-ad9a-3a7942eb1f3a", "comment": "Malware payload", "value": "6db1be013ba27afdb43dceafa97fa0dc73f83fb9cc9ae147b60a71ef7105d6d821d60d4b8ab1365cbf9293ad7e0eb255", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222193, "uuid": "2ba4bbc4-cf78-4cc7-ab3a-229798e8754a", "value": "1083120E5C8825FEB055E7111E3DF8898A0EEFE2C975A604F28DB62CE172B1D35B445B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222193, "uuid": "f7beb6b2-f79a-4b3c-b857-bae711f929d0", "value": "1536:PsNZdYvym4HQWVy+sb/5197v7UZoctQ2kPo+4mpRlDi1nUSUqxuuD:PKUT+3Vy+U19T7YptKRNpoUSUqci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222193, "uuid": "36f189df-ddd1-47cc-b733-47f51c623189", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222193, "uuid": "aa3615ad-a34c-4d20-9896-19ae248f7f03", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222193, "uuid": "af5a3050-999c-4a39-af33-b85408b51fac", "value": "info-240307696.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "579f9c0a-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222112, "uuid": "b7f6ec6f-64e6-4315-9787-9833f501ba17", "comment": "Malware payload", "value": "bac06ef9c93290f359af94c172fcfbf9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222112, "uuid": "33ede777-c943-4cf6-96c0-a28813fcd99e", "comment": "Malware payload", "value": "0aeb76575f497d330d9b02696e55fc54fd71b6923e6f4ca57b9732de0c8c7c63", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222112, "uuid": "a8319454-646d-49a3-ae85-1ab68046346c", "comment": "Malware payload", "value": "ec0cb6016a6b3e670aa6abe90d7e40fcce7e5cdd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222112, "uuid": "0d6637c1-59c8-43e9-98b1-fb9644192ae8", "comment": "Malware payload", "value": "da632c210fb393adca54d357685ff447cbc9fa603df9dd6dcf6d41751d80d9a432a6ccafc72e88b124421be6d8fdfb1c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222112, "uuid": "8cef6fd5-8488-4cd3-9932-64e818638d97", "value": "3983124D35EDC041E17F7D6093AAAD5901B86F4BEFFF9164CA6961329801863EA0368F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222112, "uuid": "1db095ba-9bc3-4f2c-843e-accdf95c887f", "value": "1536:BwJNfD6jITxi7UnLkb/Yw3LCq1GeOuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbQ:BwzOEliUne/L3LCq4kO6xoKDShicdBMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222112, "uuid": "8b12e912-280d-43ab-80cf-df5237f4711f", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222112, "uuid": "3b23b59e-9371-4ad0-a651-d694cadbca0d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222112, "uuid": "404eb2ee-8012-413d-9082-a17cc35b977d", "value": "info-2122589118.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05b2e4e-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218395, "uuid": "725a52f4-00ed-427a-9aa4-5ba4d99f8eb0", "comment": "Malware payload", "value": "f498d108395fc4fdbb4ee56a09e2e699", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218395, "uuid": "aa8aa6e3-869e-431f-9d9f-63e38f3b5bbd", "comment": "Malware payload", "value": "0af973eb8c470dcfd4f49a8e411bfc010bb414897ffdbcd72a7d85b52f8a0ef3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218395, "uuid": "a87c2201-ee4e-446c-a86e-0d25c34e2cf9", "comment": "Malware payload", "value": "4efe8014fec030aae797cbd19184bfc909b7e216", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218395, "uuid": "7eaa2e79-e53a-4ca6-a6d4-57d700212f4d", "comment": "Malware payload", "value": "e339ed442e8e3f1005c6e7c271d33ff10e4a64f8eaf694bb19141ca6bc87c6e91fdff78137a8c1d63c2e93fab9d8d139", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218395, "uuid": "7ec43331-aedc-4bf3-b1a6-dd5598e1e625", "value": "BF8312EBCFEA49984202BF0673065CBBB45428086118BA7A7EDD11502F524F0F8B7DED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218395, "uuid": "f93a86c7-7657-4592-9db3-7e9c86bf44eb", "value": "1536:a9KLWkP7EBmnbRARpNdZ2rQD2FPdo1f+5ff9fuQjMCYNst+IHClPLqkwD0DCuADC:CKLWSFbkpwQKW25NfuQjMCYNBwltD0Dt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218395, "uuid": "494050c6-3ed4-47f6-bc30-240244b676e8", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218395, "uuid": "939835ae-cab9-4179-a4d7-a105e362780b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218395, "uuid": "de0ca780-3638-4992-9ad5-5fdda7e47c69", "value": "catalog-1481739336.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e836d4d4-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221495, "uuid": "9f5cd283-a53a-4503-a92c-c07edf069e0f", "comment": "Malware payload", "value": "73266e55b421c32613e76ba242e4d27a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221495, "uuid": "6ebc6b40-62c3-4e17-84ea-f0920cb984aa", "comment": "Malware payload", "value": "0b059acfca729242e19fe845b32ed027e51970699397a83e2bbc87e70945ddd4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221495, "uuid": "4e8a5ff5-0a81-477a-ade6-527cba9c3cbd", "comment": "Malware payload", "value": "195f75442dba3be4dab474460d975b4b9ee4b45a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221495, "uuid": "24c867a2-c33c-4336-87f1-505d8b523382", "comment": "Malware payload", "value": "28f830b30523618f4a02df558b796d3cd1dccb8ced5fefcc521131d2fbc47a3d360be706247c3083d680cd4bc74d3839", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221495, "uuid": "10139d3e-2660-47e1-aeee-102676533716", "value": "41831207987F24ECD07A7BE01D724C4D58B0EF68801C8588F259769FB1D85E64B9BDC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221495, "uuid": "cae0eeeb-c7c9-44f1-b842-27b911589d5d", "value": "1536:wjHZbN5m6RtwWdwSp6yMvBjqq1PGLuhCWdHsh1oSFWsfEFhHqLWS:wrBm6XwWl3MvBjqqdOsZdHAO5hKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221495, "uuid": "5f686376-babf-4b71-aa57-12e836324624", "value": 86799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221495, "uuid": "a852e305-bfa3-456a-894b-207cc34c52bb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221495, "uuid": "a0a325fa-04ed-4378-8a6b-6672bddcdc9d", "value": "info-1717098608.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e570e547-a41f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619174246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619174246, "uuid": "c5b88d7f-f5e4-4927-ac91-8d3d7080a180", "comment": "Malware payload", "value": "7a14537328f55eed01a463f94929ad18", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619174246, "uuid": "241bbb37-052f-41c8-b62f-d5bc2134c904", "comment": "Malware payload", "value": "0b0675d2a35e9e8a6450dfb91a13c5336f328f39e24d1931609e126d1f1e3ffe", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619174246, "uuid": "e12825ca-ae11-4807-83fc-ac38649230ac", "comment": "Malware payload", "value": "cf9ba24e4a133294983e32bd1449186450a2faf8", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619174246, "uuid": "ad0096ad-f297-41d3-a1ee-1c76e66ef726", "comment": "Malware payload", "value": "eb07651377bbee4d99a7ea8f9de21b26c35ecade94d54b9d961b1369933401280068ed0df35377bb9c9972abeabe6e35", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619174246, "uuid": "4c1f56f3-3f48-49e4-b776-28f3c4f65803", "value": "57F5232797AEF43AE023F235E27824A7193D009C4A14FD596A25E59C4FFBD80DE49B4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619174246, "uuid": "71d94401-aea7-4a9b-bea1-e560201442ec", "value": "98304:xKiZS5diYvqjZRFJaAC7MT7KA9rNQI7mf1pdps:ZS5dQj7FJGg7l9vkXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619174246, "uuid": "7c62c755-041b-407a-a326-ab046e40dd5f", "value": 3504087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619174246, "uuid": "f6030d88-b79a-4037-be4d-b72ecc59a8d4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619174246, "uuid": "10060174-5297-4ff8-81fb-91eb28eb3ba2", "value": "dhl.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5fb1ffa-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222324, "uuid": "45f5dfef-9c52-4a07-b687-c755bccb946e", "comment": "Malware payload", "value": "4af5ef067082596c25441543f2d507d0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222324, "uuid": "5e2bb345-8997-4dd6-b369-9b3804ed2ab6", "comment": "Malware payload", "value": "0b4b6654ffb3f328ae4d959691be988ce4daf32096f14597cd654f8320cb1b65", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222324, "uuid": "ce5a3911-b516-4265-a780-15ed96115463", "comment": "Malware payload", "value": "e00b2a3d31bf530cb3529784076fb16b585c04f0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222324, "uuid": "ce438f69-132d-4bb1-b031-9591373eed16", "comment": "Malware payload", "value": "f9b72fef56b97acba00d0418b05ba46c0c3eabcf72a59902859f13f713e0404ed7f4f6746de701958bf276360f315a1b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222324, "uuid": "e163c1ea-9343-4460-abbb-6bdd7f41d7c9", "value": "C9830277E0A6A95E829CD0B1901E3A1839F875C3E435978EFD1D3A17C426DCDA91082E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222324, "uuid": "69a23f88-136a-49a1-8d56-007100bac2b8", "value": "1536:DJJs4DkjRjDC+ramyNIPjLxx7mgV3e27JWgtrQZcUT7oqlaHvvbFq9GHocnoe1RQ:DbLoNfPrG+vxxSCxIGUT7o/v096oiBkR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222324, "uuid": "6b355136-d684-4ef6-b5ea-6ccfed3228d0", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222324, "uuid": "b298356e-11ac-48e6-9061-f9ab27d98e2a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222324, "uuid": "1ccb3b5d-56c5-499f-96ca-6e9acccd51fe", "value": "info-323716527.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f42d58e-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219843, "uuid": "acd396e3-d884-4da7-9325-a662de0b4d29", "comment": "Malware payload", "value": "c9bebf96b9759be323e220f3f3428f13", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219843, "uuid": "a6bb6f78-cea7-4355-aea9-b9240b7c81ae", "comment": "Malware payload", "value": "0b5cd0503d8ca8aecdfe597da801f62fa769b6c3bbd511a9ccbd64cae773d8db", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219843, "uuid": "9d695699-f339-4b31-bb7d-d1d5f4ec6bc1", "comment": "Malware payload", "value": "b1ad1e35773d286fb96aefd2bed8e111cb196917", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219843, "uuid": "702f77c5-7604-486a-9dc1-58d863e245fe", "comment": "Malware payload", "value": "3e76ee11c802e6548779406c4f8b6f39ac515a13f245b9e9d8a634ebdd9b7125c6b03f87b0d12126c34a843d93e84e57", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219843, "uuid": "89109dab-5081-40a7-9bd1-10777fe9cf5b", "value": "008312A306CD584D711BF838C1647F8F99ED8F67AF041A0FCABD472B11969BD3950289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219843, "uuid": "10b3d4e9-bd03-4e34-828a-e9b835f69372", "value": "1536:82fnBKjQUgFsqi+nTnfZA6l3SNZzTJAsB0Ic6DMADMt5zC/IDIz103:HJiifrCNBJAIlcAGIz1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219843, "uuid": "2a16cb28-386b-4f6a-8d20-e7c9edca37da", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219843, "uuid": "128e7daa-2d71-428e-b3dc-71c65203050f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219843, "uuid": "009070c7-c0b4-4166-b21a-d4c1b05fff87", "value": "catalog-374973638.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb53595f-a42b-11eb-abe1-42010a9c0039", "comment": "Malware payload (DiamondFox)", "timestamp": 1619179356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619179356, "uuid": "0fe774e9-38a8-4961-92bf-597c7b7c2f7b", "comment": "Malware payload (DiamondFox)", "value": "eed3ba57811a34c9c0f95ff4c3dec279", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619179356, "uuid": "907719d5-3d8a-43e0-8166-b1a791b63184", "comment": "Malware payload (DiamondFox)", "value": "0b88e7d5c78fcc10a17d5e3a64ae52e48ae0a4e04001d3eb918ef628c0248949", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619179356, "uuid": "50b74cd2-a2f9-4444-ad1e-e771f4c31319", "comment": "Malware payload (DiamondFox)", "value": "00da3f9991ac25666b0deb3ecfcb2e22906ec64d", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619179356, "uuid": "db96445a-5807-4608-9ba0-b854eb706eaa", "comment": "Malware payload (DiamondFox)", "value": "944f39a801d075937088c325584baa4f3e530f122e9b27b0db249caa6f9e460585eba59c2daaa21a64858f5e2f058fa3", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619179356, "uuid": "f111a61e-d95d-414f-ae2e-1ff10823460c", "value": "54A5E1E413848FC6D7A76D865A69B8842F37F532A6C11448F4CFEF7A33BB1808D19985", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619179356, "uuid": "035668d1-ad5e-4797-972e-b182191e03a5", "value": "49152:lJdJdJdJdJdJdJdJdJdJdJdJdJdJdJdJdJdJdJdJdJdJdJdJdJDBP:lJdJdJdJdJdJdJdJdJdJdJdJdJdJdJd3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619179356, "uuid": "8bd50e31-d8c5-4449-8d7d-8fdfdb562d93", "value": 2065297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619179356, "uuid": "ab49fc03-ca12-4ef2-be22-1840f0653e80", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619179356, "uuid": "8834acba-663d-4464-aee1-c74ff9466945", "value": "reawz09cwj_DOC0107210_AGOSTO.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66877248-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218271, "uuid": "5da827be-891f-4017-82a4-f4ade61dc795", "comment": "Malware payload", "value": "60a255e25915be2b1b1fc639b661af53", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218271, "uuid": "9796f487-d94f-4bf5-a1f1-ec932f6d66eb", "comment": "Malware payload", "value": "0b8d06f5f2888ee4255f445b8093ca5f0d4f1f2acc85d60f9494ce255fa85dff", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218271, "uuid": "750bfa2a-c2ca-4b18-874f-fb2719f29d21", "comment": "Malware payload", "value": "7c6a6013b0357ad3f2b25ec8399c349b11c9cd48", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218271, "uuid": "064ba1cb-45b8-450f-ba3a-4ad826cfbae2", "comment": "Malware payload", "value": "275c58bb9b998d7bab511b6c7756b33fdb743000d92e637b1506529c89b695fb77d3775517175c039b84cbf72639b0fe", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218271, "uuid": "6ef9b7a2-f264-4455-8811-db1df721cfdc", "value": "278312FD7A1F94D4A67096AF85B7A4D16B918AF8D41D70F3090A3F3AD4209FBB121170", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218271, "uuid": "35e70613-5828-4924-b8a3-6deeb42ddc19", "value": "1536:eAS5fEoWthIDbflm7UjoB8+wXdpUna5ahL2dmTLUVVvj:eASyoW4w7uXinakEmEVV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218271, "uuid": "7fb5be38-b10a-4eb8-b1db-b9f18d2f6b86", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218271, "uuid": "f820625f-781f-4ded-b946-747972181f62", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218271, "uuid": "6096d1ef-8ebb-4e2e-805f-063aad352a90", "value": "catalog-1420229862.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed78c60-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221211, "uuid": "8f5f536b-8268-4d8d-a5e9-959a76ac94d3", "comment": "Malware payload", "value": "2ce6bde92324f09ea1b9c2d43c8280fa", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221211, "uuid": "92284e28-ea33-4920-8a2a-79603d1d5c02", "comment": "Malware payload", "value": "0b9eeda25631753a28e056c395b4af2af5df6ce8afecbc2cab27d85a30cc810f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221211, "uuid": "bb5f0de4-ae0b-4a04-8ff2-6faa60ba6a02", "comment": "Malware payload", "value": "027b6cc0398280a1dcea198a2a1edcc8b4cf5433", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221211, "uuid": "48e0b20a-2a6c-46a7-a655-8210b6b4c3a2", "comment": "Malware payload", "value": "4303912138d7712603891f8486102faf601b61b5bf620bceb51b969eb20014179193695f301c68359aeca045a93bc226", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221211, "uuid": "5624b8bb-6765-4d2c-bad7-39ae8f39fa3f", "value": "4A830207956158FDF16ABF01273ED8CFA64ECBE1E92519C0F20E6B65D2A3399225440B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221211, "uuid": "d54ab5af-14e5-4b4f-8185-3df2383e8368", "value": "1536:ZHZbN5m6RtLlLHfAkZ8kISNq7xWgwMQZL197v7UZoctQ2kPo+4mpRlDi1nUSUqx/:xBm6XLFHfA210wN19T7YptKRNpoUSUqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221211, "uuid": "80de99c5-fba9-4a3c-9df7-e92ab32b2e18", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221211, "uuid": "d21dd5f2-c44b-4c50-a135-a4d38d0893a4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221211, "uuid": "421ae842-62eb-4a2b-9f6f-ae39fc133cbb", "value": "info-1558030644.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2eb4c6-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220078, "uuid": "d00bb2c0-fb3f-4b18-85f9-d3eab6363407", "comment": "Malware payload", "value": "0c0680f8b1e8ffe5d46d5b5ab17abcc7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220078, "uuid": "a8f16331-f1ea-4766-85e7-8c06f18919b4", "comment": "Malware payload", "value": "0baca76c1115ad39dea3c200ac1f1ec3aa04e8cdb026a4ab8b5a3c9cc5750d0a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220078, "uuid": "07827bf2-bb51-44db-8f14-8225acb02dbd", "comment": "Malware payload", "value": "8c704ea5745c60b51bbccdbb75ae736222d01647", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220078, "uuid": "53ed6700-40ae-4804-82ef-2a167f3d8248", "comment": "Malware payload", "value": "3b98285e70bdfe7817cc9ae42572bdd61b587ca97baa12236b4e27a9fb45e83d53f692ccded681fe6a1cfc4d21413a43", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220078, "uuid": "05435a2f-690e-4570-b203-fb669a6d4b70", "value": "3D8312D75DCB22AC706DECB9C47B2C840A19CDB3D246222A265636771855F7F67008FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220078, "uuid": "22babcd1-e216-439c-8c36-625488bfc510", "value": "1536:KAS5f5E/5fEnaj1ZQUcDpTe87VqINbtezgVRxr9AiUrQTKXs8FI+bSmmY:KASvE/Ztj1ZQUcDJe8JqmdIrLjFRbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220078, "uuid": "18117fec-8883-4efc-98b0-503a5f0e9efd", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220078, "uuid": "a4faeeca-9b14-47d6-be0b-918480bfe6ac", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220078, "uuid": "2a2fd40b-d255-4662-bbbd-7cdd0a799764", "value": "catalog-505487252.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46625b9b-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222083, "uuid": "05be1750-a6ed-4fdf-9c73-fd6569bef9f5", "comment": "Malware payload", "value": "fc6eb2c9d64e96d843e4f3372e5718e8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222083, "uuid": "ff3537db-41b8-4d8f-901b-3e9609d7869c", "comment": "Malware payload", "value": "0bade77f13681b06e4bc9aac4ad0b1eeff62da90c9b191ae534bacb211fe4f8c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222083, "uuid": "7e60297e-42c5-40cf-8432-dcd188ad8965", "comment": "Malware payload", "value": "a7a0d4d2848f8c0182a226c2b6f6fef2f597206a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222083, "uuid": "9e1f6986-3e81-4299-8cac-b766e9753776", "comment": "Malware payload", "value": "d540fe17be4cb0b92417b73aa922bd45fd4c290095876e9f2babbec003477e539bc990c3ef797b451418f45c13e9f07e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222083, "uuid": "f81ee32f-8c69-4482-a0c7-158f9bda70f0", "value": "928302B7322D4BFF804AA49B809FF5F9F156A93E5D1EE510B3642D20353243EA411EAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222083, "uuid": "d4ebb1af-3d1f-4e14-a65b-aca8476332b1", "value": "1536:CQBAV8QI/AATZvjL3+xnxv5ZUSzhhcBrasoi8vQMwdjV46CTo:i8QI4AZP3+9xv/UGDmrajvIM6CTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222083, "uuid": "15cfece8-edcb-40a6-8afe-bd3fcc132f49", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222083, "uuid": "9468ae3d-1295-4fe5-a9ff-34bf32455067", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222083, "uuid": "68384123-c7f8-420e-a0e5-023236dcda5b", "value": "info-2109625892.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "799ba641-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222169, "uuid": "f33cee3d-f3d6-4a24-bf4c-0c79e5d7901a", "comment": "Malware payload", "value": "cca93926fbe9187bcd0a8debd0731a00", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222169, "uuid": "4a726d12-1135-4eec-8e6b-5b5e097cb81d", "comment": "Malware payload", "value": "0bb827dfbf2b52f2b03bcfa334a5283f8c76fb8050ebb43859b0ed5f35c20ded", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222169, "uuid": "c04ee14f-4a2b-48e2-b1c8-dbb543f9a16b", "comment": "Malware payload", "value": "c603fbd53abadd17da1e233c0ee72d9b8a0668a2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222169, "uuid": "056774d2-44df-417d-b59a-a1e2285aef4c", "comment": "Malware payload", "value": "4e8cfdb5e56249773a1322517883fc6ba1e495ccb3b029f5fefc227cbcfaf1bbd0cebffeff4e7dc510f49f1a599e12ad", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222169, "uuid": "2cb04cb0-64fc-4231-84ca-177c03c1799d", "value": "DA8302E6AC779C1D818ED2B4503F5E185BF464C1B4B8E38AE91A7E49DC27DC90D0882F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222169, "uuid": "84d3fbac-58a2-47a0-a34d-8d5a18e611e0", "value": "1536:TCqAxKzlSo7mgV3eG17lbkCOUT7oqlaHvvbFq9GHocnoe1RqfwSOJrpMEIpz2PT:TCqAxKzlSoSCn12COUT7o/v096oiBkwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222169, "uuid": "230385c4-181d-4273-b865-fc788b3984fb", "value": 86795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222169, "uuid": "3528253b-6d71-450a-8fae-e3bdb5546011", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222169, "uuid": "08eb1d5d-9dbc-4a5d-a088-e162989d070e", "value": "info-231595683.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59dab444-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221686, "uuid": "f9342d21-dfcc-4011-a6ca-bf25e57d884d", "comment": "Malware payload", "value": "cf5051bece5d93354e7a5677b0c0de28", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221686, "uuid": "b3be4d9f-5028-43c8-93c1-3b760c1dd723", "comment": "Malware payload", "value": "0bdba61c0356d6a4f65af41597c8f84a72d1859530d2fa0ffa6d2c21115bfd15", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221686, "uuid": "13b16a55-9131-41ca-975f-611ed6f84226", "comment": "Malware payload", "value": "0fe6649f773f391187056be706ed03ed8fe9bed8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221686, "uuid": "965dfd9d-18fd-424c-b924-800f0a5b091e", "comment": "Malware payload", "value": "8f7d1bfc93634d9687d78f433785d70313cdeb5ffb75ad8009cc6a32e25589a9c497356a595824c64b1e224925dbdcde", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221686, "uuid": "56b25f53-49a4-43c5-b0b7-f01d3f1fa953", "value": "4F83120798BF24ECD07A6BE01D73584D58B0EF68801C8588B259769FB1D89E64BDBDC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221686, "uuid": "2f3471ca-70ee-42a3-bd3a-e8357adf797b", "value": "1536:3LjHZbN5m6RtwWdwSp6yMvBjqq1PGLuhCWdHsh1oSFWsfEFhHqLWr:3LrBm6XwWl3MvBjqqdOsZdHAO5hK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221686, "uuid": "0e1ab489-a952-4117-b1f5-3969a8af09f3", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221686, "uuid": "dddca27d-eb10-4a33-bdce-d0bf5a2ad6df", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221686, "uuid": "64eb0865-af8e-40f1-807e-2b138aaf9320", "value": "info-181630575.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a64c43bc-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220096, "uuid": "72aea6b2-45db-49e3-865f-c31c75d6b534", "comment": "Malware payload", "value": "4b273f6e759391dc6c65e87a5959d88f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220096, "uuid": "e305c99e-a96b-4dbb-8018-3cedc5fe75b3", "comment": "Malware payload", "value": "0bdba994697221c68f20eecf02860af6fb8dc23d2f874a216fbcac88459f1df6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220096, "uuid": "13fbcb90-da0e-4d0b-a214-5f63feb28a9a", "comment": "Malware payload", "value": "219bb13b6c9f7b5232943cc3d85ce1d6ec378150", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220096, "uuid": "abfff46c-a1dd-4f5d-a434-b4075ae9631c", "comment": "Malware payload", "value": "c2e0fa5ddbb4235df7c069bd8e809b22270488c4a0a81f6363c0a4f6e06ce5a3c8e26a4f4f85dc8d590ad596677e3519", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220096, "uuid": "bedcd31e-a931-4e01-adf1-02d74f477b8e", "value": "CA83028BB4D8433ACB3523F658AE5E4426B1A47F140CCBDC75973B786B53672A472388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220096, "uuid": "9a936ecd-2ba0-4a36-8d93-6e3b90e2b4a2", "value": "1536:oEwAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvh:oHijtuPmU9j7+XFWtYe14hbOj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220096, "uuid": "20b5cf41-06c4-4ab8-9cd2-825b7e3b1d6d", "value": 86930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220096, "uuid": "59da0c80-abde-461c-8d1b-41594a968f00", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220096, "uuid": "1c947577-d5b3-462f-b782-c21a39cb56c7", "value": "catalog-514983009.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e515a8e9-a435-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1619183694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619183694, "uuid": "fc2a037b-c86d-4695-a616-92d5d4e20c2a", "comment": "Malware payload (Loki)", "value": "57669970ad793b5f21c965203b2bdedf", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619183694, "uuid": "bdbb08d8-c7bb-40f4-a4e4-a790f1083f52", "comment": "Malware payload (Loki)", "value": "0be9af920272d3fd90c7aa7a847e05b96bccf8fe1dc2d3fd1ef6ac43af5fbd19", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619183694, "uuid": "e7121d2a-8065-43fb-8a74-89fcfdf573b2", "comment": "Malware payload (Loki)", "value": "1abf88a635afdd3cbd0c885cdd5b81e721757ab3", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619183694, "uuid": "6a04e531-5ce4-4ae9-8fc7-490dbb663632", "comment": "Malware payload (Loki)", "value": "48cae5c67a94a09599ef3e71ac9c787286f99401984b7cb9bf6b1fef200cd40cf5345820f63cc22305b0e76e7637c8af", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619183694, "uuid": "e03c9b29-bb8f-4898-9932-39979c370ed1", "value": "DCF4234638DB8AA270B5F6137D1720BB1C5A870F19ED6A0933D72293BCB385476153ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619183694, "uuid": "934110ee-4f71-497a-a111-82c10bf8d319", "value": "12288:rVCirOrcEf/W3Aa8gpdQlhW/LCOb/ZUD3Qi/WMtdQ7S/U/J9ez:pCizEf/WQa8lW/rMZWrRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619183694, "uuid": "5e4ce91d-ccb9-4af0-ba04-f3d2499cde92", "value": 735172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619183694, "uuid": "275f31d5-7daa-4bbd-a4ce-f277ad075016", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619183694, "uuid": "a01c384f-74cc-48d2-a9b3-5994b719151c", "value": "_payment slip_pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69617b16-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219994, "uuid": "e9e38f45-9fdd-41c4-8dd9-7224cb6fb7cd", "comment": "Malware payload", "value": "0ad5bcecaffd779b8b64f5bb7146f3cc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219994, "uuid": "f7eae8d8-f813-41d2-94fe-1dd834dca522", "comment": "Malware payload", "value": "0c52b32488231eafb6cdb6ceb82844e26df1900c87129f6cac4940f2ee25ac9a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219994, "uuid": "1cf1b4dd-a2f9-41e0-9c21-1ea73e87c999", "comment": "Malware payload", "value": "3b506ff43c940ca08f440196f58833e55d531b8f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219994, "uuid": "0aa40690-00a0-4ca6-87c5-3edf474c12c1", "comment": "Malware payload", "value": "47918e2a9f93527325966cf9a497905f3de83d4bc2eeef2ce31b1d3c69599204fb09e66452b4d67aec3d8fed5cec2695", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219994, "uuid": "9ec04599-cae0-4660-81d1-9a4298fbe245", "value": "0683028BB4D8433ACB3523F658AE5E4426B1A47F040CC6DC65D73B78AB53672A572388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219994, "uuid": "714a055e-d3b1-4b3d-b39c-17e0d82d54fc", "value": "1536:mEwAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvj:mHijtuPmU9j7+XFWtYe14hbOjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219994, "uuid": "4d00b77c-753b-4234-a912-65dde6419100", "value": 86930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219994, "uuid": "3ab13459-ccbb-44b4-ab42-9fdcd1f13257", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219994, "uuid": "0a94f659-ce62-48a5-8a80-640c08e6d05b", "value": "catalog-458106553.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e56f9eb0-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220202, "uuid": "315a3b2e-e171-40b0-8b1c-f647bf177028", "comment": "Malware payload", "value": "4607f7c8e8a952d53f1b1110ea8eaec1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220202, "uuid": "91ac83df-2365-4778-bf21-165a14875ade", "comment": "Malware payload", "value": "0c5c0acdec0e3d605595358f98ad60cf323d2c4bd12750a45f65f27bb199185f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220202, "uuid": "35aac485-64e6-45f6-93be-6908369faec3", "comment": "Malware payload", "value": "29108914f821b1c72d08b854507fef6e70f42586", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220202, "uuid": "209bd991-1790-41af-acaa-b0cdad3ec256", "comment": "Malware payload", "value": "6aa8f52630d3fbaf4be37536e98d26e7631a6261aded56f70c9cc6b59d5314555633874a4301272565305357984e429b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220202, "uuid": "5bf9ac69-6e1e-42cc-a3d9-fbed8c33efac", "value": "1A8312B7F9776DB6C15CE1E3E53E162834EC81C07475968BFA0A5E0AC91AEDD9204C0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220202, "uuid": "6a7688bf-81f1-45e0-bf54-ab59a7cc2d10", "value": "1536:p6r7l+KI0FlLHfAkZ8kISNq7xWgwMQZcUT7oqlaHvvbFq9GHocnoe1RqfwSOJrpV:pY7l+6FHfA210waUT7o/v096oiBkwPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220202, "uuid": "b2f8ea14-4414-4e93-87d6-5718f2143db0", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220202, "uuid": "ed59ee34-e7e3-4d57-8381-28d130f940e2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220202, "uuid": "78f40d9d-11d3-4760-9369-114db9f21882", "value": "info-100684658.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "258c15fd-a42d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619179937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619179937, "uuid": "ab296d83-dc75-45fb-aeaf-a3663fd0143f", "comment": "Malware payload (AgentTesla)", "value": "ab8c1b472c2cdb8cdac484a287bf9591", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619179937, "uuid": "0f63f45d-9a7a-467d-aab9-00a3bff82118", "comment": "Malware payload (AgentTesla)", "value": "0c66829329da21685af020a831d5249cd32dbeb50c4e539fe70fa2e799db9642", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619179937, "uuid": "fa311e25-6cc6-4eb8-88b0-93dae71ca881", "comment": "Malware payload (AgentTesla)", "value": "48237f06a7a837d06020d10e818657a8ecf02fec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619179937, "uuid": "6d8a0889-3d69-413a-912d-b8642732d6df", "comment": "Malware payload (AgentTesla)", "value": "9e579edab0d1cd8ea5d141fee77028e34c3531bb205480755d2a7ac9053649367c079c4c2b7239c252f0e076812e9c7a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619179937, "uuid": "6d036f68-f172-4a29-8380-4d55aab61afd", "value": "7E259DAC7610B5DFC857CE7689641C60A660BC6B430BD307A09736ADE97E29BCF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619179937, "uuid": "5465628c-326b-4396-a8ae-c01bfe62bcea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619179937, "uuid": "04668366-fea7-4c19-a27a-0c4ba04f942c", "value": "12288:R0B4iwgR7ed8aUYK3w2p5l+Thujer9+VWhDQZNo6yBi5sFziST+p1srkOv5378VA:R0B4Z2708aaAITG+ODWz55sFmMG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619179937, "uuid": "eda4e261-ac59-48ad-8921-7a9870d0da71", "value": 970752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619179937, "uuid": "9f4498ec-a823-44fa-b3de-06cfa4162db7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619179937, "uuid": "346b936a-2184-47be-8bd0-b8c1eaab78d3", "value": "ab8c1b472c2cdb8cdac484a287bf9591.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8143caf-a42a-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1619178948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619178948, "uuid": "e6da6987-3c01-4478-a59f-e1e0a2d65241", "comment": "Malware payload (ArkeiStealer)", "value": "bc0aaf892ff90f0c0ced0e375adca2f1", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619178948, "uuid": "36056107-2575-46d4-9b74-e30d74481171", "comment": "Malware payload (ArkeiStealer)", "value": "0cda6c7a003ac1c8c7a84a6776bac14cbc4cf55e18b54a9bae9b403b92085fd6", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619178948, "uuid": "21425321-3154-4582-8e97-70e589f380fd", "comment": "Malware payload (ArkeiStealer)", "value": "3f38ff42f644cd4f808452d9b6dfb125c24248d9", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619178948, "uuid": "f24a8fc1-0532-4f87-ae1d-66dc9df4fef3", "comment": "Malware payload (ArkeiStealer)", "value": "3a623fa18820111157e04095cc4d13802c05767a2b073f4b46a491e2d24b32a757232def0e90f47afbbd8eda8c76c6c5", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619178948, "uuid": "86b0137a-25ba-4a2a-a513-242b49708a7c", "value": "1CD4E10172E1C3F2C0AA2475B529C7B15FBB787D1565496FBBC41AB81F2CBA0EA1134E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619178948, "uuid": "d156a8ad-5cd0-4fec-90e6-d3c26e039f07", "value": "23f1e68344716b56a4d1f4cc32903797", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619178948, "uuid": "0ede7f4c-1194-4ecf-8b5f-d8fff144f2b8", "value": "12288:doXEuZj+fTr8d0xKDEccXZmVhAJdaxEDuHYoSBnFPhknbS:dgE2qfTr8d+J1XZecaD4oaPhkb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619178948, "uuid": "d8964c98-f5df-44e9-8ae3-f6ac2f034b14", "value": 651776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619178948, "uuid": "c6d0246d-63b2-447f-a1d1-ec33f2a35cee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619178948, "uuid": "81263d31-381a-42dd-89ed-7edb9ce37ab5", "value": "bc0aaf892ff90f0c0ced0e375adca2f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a6d0b6-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222186, "uuid": "b198536b-d802-4c28-bfcd-0a9d7d1f6f4f", "comment": "Malware payload", "value": "0269bff105610e9297b7c099766903c0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222186, "uuid": "82a3c28e-4b08-4f27-8a83-17fc10494215", "comment": "Malware payload", "value": "0ce0a2b77055408a0f713589cdcb56f5ac72aed18c571ed983a5ee26b7687d3b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222186, "uuid": "7c25e72c-2236-4f28-8f4b-5cf9360bb908", "comment": "Malware payload", "value": "d60cecd67955554a36fc7f2e4351980309388d69", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222186, "uuid": "2264c778-2413-4bfd-b50b-92f41e0c0d0d", "comment": "Malware payload", "value": "48f1d832fe966cec592e92d4d702db07b44a0a2cfb3ba3084efe144955b627249da5c401d538c3e0c9acd477198f22d3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222186, "uuid": "ba663ccd-b891-49ce-a308-ac2bacf25a3a", "value": "4383027F6D2F38ECC615D1A99E3727691B305EA5855C806C12DB389E21ACCC24DB38E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222186, "uuid": "5e5b6df8-d2a5-4a13-82ee-c0c87e3ca6ad", "value": "1536:0GNZdYvANUL+q1zmW7iPGLuhCWdHsh1oSFWsfEFhHqLWt:00UJ+xW7WOsZdHAO5hKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222186, "uuid": "7eb93948-d255-45e0-a5db-4d3491d55c6e", "value": 86795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222186, "uuid": "1ae31b80-bdec-41ca-957a-a194cc7614cb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222186, "uuid": "aa8dc8f0-d8da-458d-b895-a9e33bcca659", "value": "info-237646612.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a8366bf-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219459, "uuid": "76516d7d-f8f5-4e42-8ab5-c735960f9a73", "comment": "Malware payload", "value": "d6de3a95cc7cc2452eb536b47a501ebd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219459, "uuid": "d1341abc-26f2-4822-91a1-c4fa4fc50970", "comment": "Malware payload", "value": "0cf7ea8b4773874ecfd0b78a917fe32c988e60aba5c72a646f7e9d0b5c0c3c96", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219459, "uuid": "a7b2393e-0be0-4590-89b5-c1f4f54b52dc", "comment": "Malware payload", "value": "e7400c7402ce2187782b815ed384052f32a2ff29", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219459, "uuid": "3e4d60e8-badb-45cd-86e7-d7e75a7203ed", "comment": "Malware payload", "value": "598e40bed3c067eb552e42793b1a90193eb034162e014628c3354e896ae0e5aaa6d1dd8b73eb2ab819b7794b6ee17b90", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219459, "uuid": "6788b834-c005-45b5-8558-23470f46f308", "value": "478302A58BDD4C14C1019E0C7E3ABCA57550692C701EF3E6BECB0761BB53489E1F1AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219459, "uuid": "fc381d4f-edcb-4ede-89ac-8a42bd6bc619", "value": "1536:B4vLYnBKjsMlbCkv4DhQ72ZTaNqhJXvoDqf+5ff9fuQjMCYNst+IHClPLqkwD0Dg:qvLYZkvU7JXaq25NfuQjMCYNBwltD0Dg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219459, "uuid": "af70fb69-8964-4997-b8eb-7cb5899d8104", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219459, "uuid": "b0da1bfc-6b20-49ea-b82d-a6667d8b4761", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219459, "uuid": "83e6a8a9-f260-45ec-b48d-75a7bba5f828", "value": "catalog-2102259460.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a02d56-a3fd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619159318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619159318, "uuid": "142bb689-6e2f-402f-ad95-52c3bfde2f83", "comment": "Malware payload (AgentTesla)", "value": "b9879fa5110e66798c42656b588e76cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619159318, "uuid": "75537bae-2fdd-48ec-8070-bab6e0445dc0", "comment": "Malware payload (AgentTesla)", "value": "0d0bf170253eb2be553d5c0cbea413b712d2205ed5d2c4014a716ba51171d65c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619159318, "uuid": "4e0f185b-0efb-4cde-b9ab-0f488af7865f", "comment": "Malware payload (AgentTesla)", "value": "ce64104b05f7e7d87a1bdd6bb3edf9dfb0ced261", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619159318, "uuid": "9f36b55e-abe0-44d0-bd42-1e1228457e70", "comment": "Malware payload (AgentTesla)", "value": "24549f9f0539684b7127e289728f3b652f65f1bf545ffe127544bc199f900f9d49ab6699b883d9d9dfecfc7e90f4ea95", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619159318, "uuid": "6f77f3c8-8205-4ae9-8b7a-62610c456719", "value": "EAA2F81DB7C2851BD53C3976C0F23DA813B798C33E13EA2EAFCC65D1842259D890876A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619159318, "uuid": "243f0f8b-7907-4886-be5f-6fe015511e85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619159318, "uuid": "c1387135-f441-4b33-919e-2d3a20c5c2c3", "value": "384:CWFwG62cvgEnC3AYYlgxbGE6GJu0ZkGoIseT3vWZCqCC5MlHv:Cuy/sA8bGfGJ16IvlqHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619159318, "uuid": "d024d1fc-80e5-4c37-8ad2-6e3fca8ae427", "value": 21504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619159318, "uuid": "3827bce1-1879-4249-9add-d6e8501e291c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619159318, "uuid": "bef205d6-28bb-4597-86da-2b927d0575e5", "value": "b9879fa5110e66798c42656b588e76cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867b65f5-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222190, "uuid": "325a139b-cf3b-43dd-8bfb-7367b9ffeb60", "comment": "Malware payload", "value": "973a166bb31d591dc183390ef75cd09b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222190, "uuid": "212e769b-0395-4c58-b808-813f18c15e05", "comment": "Malware payload", "value": "0d337ac3fc853e32ca2a5430044c5254b65098bb0d641f5a314e36989500544a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222190, "uuid": "ed17b3f5-7ae4-4c26-8a87-debd1a74c047", "comment": "Malware payload", "value": "b643e7a2047d12ae8d3f22ad25e3ad3916b17e78", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222190, "uuid": "9a5ce94e-036d-40e4-9297-30ba60c48ad3", "comment": "Malware payload", "value": "393d5380670e335cd16829c96cfa1dee0b470e21dced4f2d6903af926f17b6cb65bac77df343b6c1fe77cc54437d0642", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222190, "uuid": "1f74d034-1c07-4f41-b07c-fb5cf26125de", "value": "E18302A6AC779C1D818E92F1403F6E146BF464C5A0B8E39AE9167E09DC67DC91D0882F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222190, "uuid": "e2beb38c-ed00-414a-b830-9268b2d7b7d4", "value": "1536:tExKzlSo7mgV3eG17lbkCOUT7oqlaHvvbFq9GHocnoe1RqfwSOJrpMEIpz2Pg:tExKzlSoSCn12COUT7o/v096oiBkwPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222190, "uuid": "5294f3ff-19b8-43f4-8656-bd6cfc4cdb0e", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222190, "uuid": "cc1601b7-82a8-4892-b295-eab2bc5a2640", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222190, "uuid": "ac460a22-3290-4d98-8534-4707aedf5da6", "value": "info-239591628.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962986dc-a484-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217492, "uuid": "f10fbe24-fa37-4393-87d0-ae09e3d6e4f0", "comment": "Malware payload", "value": "af5160cdfe818d4ad7099b76bc160f62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217492, "uuid": "0cadebf5-6329-4eeb-bd56-76ab4b1d2b18", "comment": "Malware payload", "value": "0dc892916014f655827ec660c515cb692780af568b37243b90fd91ac222c9434", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217492, "uuid": "b2d0cbf0-d6c7-463d-b551-49a0933b3a03", "comment": "Malware payload", "value": "5f1561c2a862a250998676f6c691566961328b6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217492, "uuid": "d0f9fe31-3027-46c3-9781-45764264d58c", "comment": "Malware payload", "value": "2747c76ab0d46b55cab8700f9764b619487f27fd19f1daedd75811e664a37d3d2856ecaee0dead4c2f8a2df9f461d0f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217492, "uuid": "a8560fca-b432-4dec-b854-331de8eb513f", "value": "63830276DE8F8289C016B23103787FAA1F286B7146A1141E5AB0747B2F5B9BD4C85FD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217492, "uuid": "21ef8c60-3b09-4987-9804-2a07be44650f", "value": "1536:uEZHCzlWAXdZ2rQD2aCvdyWxaqQ6Rxt5AB/aqPwL3VbCbO:u6Czh2QKmm/Qwt+awaxCbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217492, "uuid": "6f94a386-94da-471d-b134-7add6ad38629", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217492, "uuid": "347b3226-ffff-4148-8b84-79137c097939", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217492, "uuid": "3718e87f-1cf0-4472-bd48-84710dce549e", "value": "catalog-1037731705.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e019c604-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218046, "uuid": "cf692902-6cde-4aa3-9274-652d6c9a652f", "comment": "Malware payload", "value": "a830c248ffba97d6c7c595105f630263", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218046, "uuid": "60d23f37-7169-4650-b95c-a75392dc107d", "comment": "Malware payload", "value": "0dd44cf2660a73de3986c3a422c3f31dec234985967821173f25969ae30c5753", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218046, "uuid": "9ed31099-a859-4c5d-b207-9bbe7ff16295", "comment": "Malware payload", "value": "a314e0a06c957663cf0689ab2c86fcb525d54cbb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218046, "uuid": "3616e2a3-0958-4bb6-a10e-7f30561e907c", "comment": "Malware payload", "value": "3cdea0e32032eee4029a62ff927dcbbbdad1adaffaa8a130393f956cc8bcf6a68b40b7cbed4424f125830d2ee13e805e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218046, "uuid": "c502062c-721e-4f42-9526-efc12bd848f8", "value": "A98312D74D8B22A87429DDB9C43B2C940A19CDB7D246222A265636771845F7FA7008FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218046, "uuid": "71f9a2b1-c83e-40ff-973c-2c30135aa0a4", "value": "1536:RAS5f5E/5fEnaj1ZQUcDpTe87VqINbtezgVRxr9AiUrQTKXs8FI+bQ:RASvE/Ztj1ZQUcDJe8JqmdIrLjFRbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218046, "uuid": "cfde263e-6fd6-4f97-b236-5088ea8ecd91", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218046, "uuid": "bb18000c-374c-4425-ab3d-7a2c8560294a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218046, "uuid": "8aa8ebe2-e0d5-4589-b76e-878f1194bcfa", "value": "catalog-1310456403.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d03678c1-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218878, "uuid": "b0b022e6-45c2-4204-84dc-70c9a6257542", "comment": "Malware payload", "value": "3c990c5183247b214d0cbdbd0f5d11b0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218878, "uuid": "d1f07f52-1d63-4f27-9a11-b3d8ca986a87", "comment": "Malware payload", "value": "0dd92a1722888fa70abc2218ef7728146c4286de2cff6fd417d5b3d58b85aaa7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218878, "uuid": "d4e3e5dc-f09b-43c0-aabe-a41eb20369a8", "comment": "Malware payload", "value": "9c7ab5b93879970fb1e463886828adb3bf2d6ce0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218878, "uuid": "df09b19f-50bf-485c-956e-58c05a943d27", "comment": "Malware payload", "value": "57b3f5cdb0fbf0d063c432bff8ed98e93324c19b0b93fb81566c3006d63a5e0520ad03bb44413e7c3516f60a46099948", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218878, "uuid": "43f8cea7-f9d1-40bb-9521-b98ae9bc02b7", "value": "3083128BF4E8471C4D3556E35C9E2E8446C0903E090457ADA5BB3E34EB56933D1A7788", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218878, "uuid": "7fafa908-51d1-4c91-b728-843b17f10781", "value": "1536:ILnoDc3g4MFD7flMonVadrj7ZIXFWgKilkAq14HE6M5XLTl92VyqJvk:ILkpBU9j7+XFWtYe14h2OjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218878, "uuid": "801d00cd-7a4d-467d-b55c-904d14480224", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218878, "uuid": "99f9f230-627d-4515-a351-8bcdf5592373", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218878, "uuid": "61a7cc2b-3bdd-4515-8228-7c0b4e6524db", "value": "catalog-1764527201.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "196fe2fc-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222007, "uuid": "ca01ff14-857e-4684-8782-0fe5ba03d6be", "comment": "Malware payload", "value": "305973c56515408ea583118a5e3278e6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222007, "uuid": "e3748d4e-cd75-4f3f-8a38-fcc6a38d748c", "comment": "Malware payload", "value": "0de52d85ab4ce371dd8f75d4e91e8378f702a1ef7a5cf872c691a6fdeb97b733", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222007, "uuid": "d0b66160-2910-4499-a67f-5d0e8f683536", "comment": "Malware payload", "value": "7859abd18e27759205c2c7369bbe3847a7813ff8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222007, "uuid": "79011114-97f4-4f3a-9783-adc23c38c8be", "comment": "Malware payload", "value": "66ccb8cc5880f6cc1df709cd3d9c3ff2243e5c8f7ad4faa499424a1c1f617fa5c376779b60a6be0a94953ba454fc5aaf", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222007, "uuid": "37ccac34-80ed-4afc-a3c0-b2a72831c867", "value": "B6830297F05B6E7EC28DD065901E263C25FC64C2F8759B9BED4A7D268836ACD6C00C1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222007, "uuid": "bebc1f58-8956-4635-9a35-b97132e33d98", "value": "1536:ODzeCSrujL5x7mgV3e27JWgtrQZcUT7oqlaHvvbFq9GHocnoe1RqfwSOJrpMEIpg:OfYrS5xSCxIGUT7o/v096oiBkwPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222007, "uuid": "50ccf799-939d-4f51-8773-5ef19cad8881", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222007, "uuid": "58909f6f-cb63-4929-bd9c-30668ffb78b5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222007, "uuid": "783a17c5-b82d-4f0d-9b15-05634ed7afd6", "value": "info-2058137043.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04bc308c-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220255, "uuid": "c4305342-353a-4a8f-9133-c072bbbe113a", "comment": "Malware payload", "value": "565684d5215ba8a80521e2193babb5d2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220255, "uuid": "1c1a86fc-f6a6-4604-8567-079ac0a60d28", "comment": "Malware payload", "value": "0de72fd8e75f774dc1e81657911150ca0f654448b094a3db87f4497ed7f267d0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220255, "uuid": "6a326978-b7d1-4d57-bda1-28137b1da8b3", "comment": "Malware payload", "value": "c4106e13cadf2d4238977e39f7c847dd3eedb8c0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220255, "uuid": "df5d4dc7-26f0-4620-8284-10626c901116", "comment": "Malware payload", "value": "b3ceb2800ed23fee5803e9ebfbdbdfa1b4cf834d8721d603a5bab596d3482ab5d030f0d3096a0d5c8f2df526d0cce56f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220255, "uuid": "2a2b4f1e-411a-4724-b968-619f5d050957", "value": "ED83124D35EDC040E27F7D60536AAD5901B86F4BEFFF9164CA6961329801863FA0368E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220255, "uuid": "9dca9043-4c02-4dcb-9f86-90ce934e63b6", "value": "1536:gUwJNfD6jITxi7UnLkb/Yw3LCq1GeOuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzD:BwzOEliUne/L3LCq4kO6xoKDShicdBMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220255, "uuid": "a52efd68-b0ab-4a50-b8fe-033a3b019948", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220255, "uuid": "4e843dc0-61db-424e-8d12-8ec9a396ff12", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220255, "uuid": "c07bbb43-6c3e-46d2-8ea5-adb7750980eb", "value": "info-1035533643.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7c5962-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222202, "uuid": "c7fb1768-5c0d-410b-8b07-7bd3fcb9fa96", "comment": "Malware payload", "value": "2439a1381b1c0154b342d95b8ba04b36", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222202, "uuid": "3d7dbc75-38fb-4262-a219-e8be8f0bf3b5", "comment": "Malware payload", "value": "0e0f634147ada1a670e65696ce53910eb769e901a3ff9a0134d9da74f2f378b1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222202, "uuid": "a8f33ca4-9cf3-49db-b099-93686d774762", "comment": "Malware payload", "value": "246889f36b4e2ca08a6dafd895b4298e94eb07f3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222202, "uuid": "c9c5f3d6-97c2-47ae-8a4a-cae539bb5513", "comment": "Malware payload", "value": "9bee5edd3a31295445b83a62ea9a830dc5c12a5ac7060639281cb94d04b19793146a1700b9d9182dd6a9407461398f1f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222202, "uuid": "218c380c-6edd-4b8c-82b2-e971836ecad6", "value": "F083029C30FF0144967A68B8613FE80750FCAFDB2D37B74947308574AA114DAB6279AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222202, "uuid": "873f25c4-305e-4d06-96f7-86954cb81f12", "value": "1536:/Kr7l+KI0ejUgUlrZKFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbXYZTa4hpg:/I7l+NUhlrZ6O6xoKDShicdBMM1/XPQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222202, "uuid": "098b349e-931d-438d-8262-a92732e2debf", "value": 86795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222202, "uuid": "bc7aafc1-1cd3-4197-8b74-029fba25bd90", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222202, "uuid": "1d85fb5d-622f-42e2-a350-5ed985f86576", "value": "info-250791794.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "682f5adb-a3f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1619155568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619155568, "uuid": "712f37eb-2d9e-47ca-85b8-b6e7a24cd666", "comment": "Malware payload (RedLineStealer)", "value": "4ae517f220e576085e48922efc59c71d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619155568, "uuid": "aefbc6ad-fe10-4985-bca4-283ccd385bb2", "comment": "Malware payload (RedLineStealer)", "value": "0e23f525007e9be46b85d1c6dacb16579c8555221867eee619f3f5f0f5ae660e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619155568, "uuid": "cc41fba2-3327-4065-8ad5-c84846a79b1f", "comment": "Malware payload (RedLineStealer)", "value": "19b5a74c69bb69134ce8c74cbd1b215d80d17212", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619155568, "uuid": "d7a044ad-1afe-4df4-9cf8-444847a8ab74", "comment": "Malware payload (RedLineStealer)", "value": "af51762cfd55a818aa740c8126886dd07fa2e2a5907e159de66295e2d3b20a525d16f6c1cb85a43525c25d477f1cc11c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619155568, "uuid": "ff448445-2919-4c44-8def-1e9234128259", "value": "E7934C1473988A29EB7D0AF63471019973F1D1CA7211D75BDEC0A8EA2E6A7C13605EF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619155568, "uuid": "21b63c07-4d7f-4257-b0b8-0161e596a460", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619155568, "uuid": "e90d15ea-4817-4841-a0cb-fbc225d2d20a", "value": "1536:LHvfVtqfs4+GIUTotWLxlJxglnALdNFj0yd1tbRA1jLobcH1yMddDkFxekQEeIg:bPqzH8E7xdPcwbcVysdwqIel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619155568, "uuid": "de20a7b2-d7e5-4d97-ac0c-ae5dc62dd9e4", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619155568, "uuid": "17003a07-80bb-4d70-a6c8-bce60fd2680f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619155568, "uuid": "b12e0b60-3ded-406e-84b3-da4ad5b46ccf", "value": "0e23f525007e9be46b85d1c6dacb16579c8555221867e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f75e47-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221970, "uuid": "8b1e4092-d7f6-4dd2-aef6-337bea018566", "comment": "Malware payload", "value": "06c0e7dd975d98fa180035896adc9826", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221970, "uuid": "4db7c922-e233-41e7-b26f-d8c20a6034d4", "comment": "Malware payload", "value": "0e4e706ce6774616f5091461ced31b7b5a512cbe1257081b6e1d18cbd4c596cd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221970, "uuid": "b70aafe7-14a9-427c-8e98-85b36b02d9f6", "comment": "Malware payload", "value": "277b3e4b97980759efc7176be465f00c538ebf39", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221970, "uuid": "0c9e4aa0-f445-428d-bdd0-58e7891a2a96", "comment": "Malware payload", "value": "484c13a4ee019bb333f259904545f3d0cad241200583bee793722caa103a263e1fd557c33cd6cc9755ae17514ed1d342", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221970, "uuid": "61731a65-9ae2-486d-aae4-04845088e8e4", "value": "67830215A0FC86A7C0F3159229307BC78AD0EB9B584DC043F2349A27A4E6B76857BF5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221970, "uuid": "d1d8f2a7-dac0-48bb-a45a-d366be2e0979", "value": "1536:3ht1QVGeGug5dwSp6yMvBjqqxM5Y2VXw1QFsrGq9ZMlmZQTQdh:3pAG7u8l3MvBjqqqXw6Af5dh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221970, "uuid": "12b17ff9-9097-4463-9c9d-636c7f98296e", "value": 86794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221970, "uuid": "3a12d566-1e79-4e22-8828-6b7a51ca6c29", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221970, "uuid": "aa6b048d-d0e8-43e6-97e0-24f80e297570", "value": "info-202095835.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4383ab15-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221648, "uuid": "4181926c-0c6f-4205-9254-59fb4d1786ad", "comment": "Malware payload", "value": "abdf860be04f44d6b7156e3e37565190", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221648, "uuid": "cf7cf8b7-ea94-41f0-b2b3-e9f49b3f8031", "comment": "Malware payload", "value": "0e537f907a7e70e080b0c7f01b8fbb3be922e47e0dcee769bf302c1d3a35044d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221648, "uuid": "edbf03bf-eb0f-4948-b2b8-29d94b4df858", "comment": "Malware payload", "value": "9f5306c02c5036f2b3fc54749bdbb54600d7ac91", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221648, "uuid": "055b29d8-8f33-4138-8f52-f3f2c3f0d0f7", "comment": "Malware payload", "value": "ac53ec562ab9a6b575fdb7b5b5312a2479b23b120d341c6fc40afe9ceec804c4976d281aac65edfd915ba53ef45c0e3e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221648, "uuid": "5e2e3563-3f57-49d6-936d-02dcfab6ff29", "value": "5C83124D35EDC041E17F7D5053AAAD5901B86F47EFFF9164CB6961329801863EA0364F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221648, "uuid": "8a9e15f7-38de-4b75-a3d6-78a3b65755a7", "value": "1536:ywJNfD6jITxi7UnLkb/Yw3LCq1GeOuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbU:ywzOEliUne/L3LCq4kO6xoKDShicdBM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221648, "uuid": "fdfa75d6-08e3-49a2-b24c-7142d6dac808", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221648, "uuid": "48f4d34a-cdf7-48bd-a734-6810deab6036", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221648, "uuid": "f6f64942-3104-464b-946e-a3d6948761c8", "value": "info-1796550428.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0880253-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220113, "uuid": "ce8a3e74-dd59-420a-bf08-3a05eba6f9e7", "comment": "Malware payload", "value": "72cf2cbe1a03f222ed374037713b957b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220113, "uuid": "f91ab067-2bc7-4b04-86eb-662f77a7b45d", "comment": "Malware payload", "value": "0e5b96ba21987e93f0b38abc271a6e9e0596ce3550638315ce619f2e0fc1e360", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220113, "uuid": "42b6d614-17ff-4d28-ab52-18b452bf45b8", "comment": "Malware payload", "value": "e88639d1cd099bf6f76ed75ebc2822613f3a4ce1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220113, "uuid": "e0adc6c5-0aff-4df6-b619-7d53b4f01ebd", "comment": "Malware payload", "value": "f0e1608d5550b8d05f4050007d668fc4fbb40a9e44e3c76e56b3a0f73a42f69ebe9ba4bb3a473e4cbdc3b19b2676f517", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220113, "uuid": "25697a34-8dd9-438a-80f4-41b8ab97a472", "value": "148302FCB92BE3DDA97084DDD86DB1E706AE49599049B0925C0B3F222060BFEE815539", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220113, "uuid": "85e724cf-6ed5-405c-b232-8765b488fa0d", "value": "1536:Auams3cgHHyQZiwotTC3pjHjoB8+wXdpUna5aha2dmTLUVVvE:F+3pwvtTC3pjDXinakpmEVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220113, "uuid": "458b236e-8900-48a8-8151-c479151af98f", "value": 86930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220113, "uuid": "9a685772-c0bb-4177-abbf-8b84408a9796", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220113, "uuid": "d26f546d-f48a-48eb-81d1-cec7f7ad715d", "value": "catalog-525890610.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa55757-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219978, "uuid": "e4608068-041d-492d-9a1a-fcf56bad2953", "comment": "Malware payload", "value": "ac1273b243664779fe7ee2f39eac15a2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219978, "uuid": "0277727f-534d-4e1c-8715-90ebc9dc8b6c", "comment": "Malware payload", "value": "0e5fb892149a09b9b2c62e7a4265c136286107a9ce23c98bea8bf930d7f020ab", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219978, "uuid": "ee718b1e-36f6-4f45-8ad3-4598d4a33658", "comment": "Malware payload", "value": "884efb64dbeb122440d1019cd61748194147f264", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219978, "uuid": "934acf8a-65da-4519-8d07-695cee7a3b72", "comment": "Malware payload", "value": "32b0ec7dc4ca8e1227f9a1a4abf3adce764fbdf73e55c58a14b14330e06b2d2018a5debc9acc543f5124a9209a7c91b9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219978, "uuid": "6ce5312e-a1a8-4bfc-9dbf-cdb2ca302037", "value": "BA8312B347D9689D7067BC2882687F8F98D95B23AF040C4F8EFE0B6B11974AD3650791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219978, "uuid": "7bb07878-d44f-4836-9b88-17197a25b625", "value": "1536:2A2fnBKj0MlbCIZi+nTnfZA6l3SNZzTJAsB0Ic6DMADMt5zC/IDIz104:wBIZiifrCNBJAIlcAGIz1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219978, "uuid": "b5b242da-d4f9-4ac8-811a-e9a5d9757ccf", "value": 86927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219978, "uuid": "cd36a136-8836-42b2-a8cd-3143993b47bc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219978, "uuid": "744bca66-d164-4bdc-ae61-a4e996fa2e04", "value": "catalog-4446824.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d0a58b-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221733, "uuid": "343f40f1-9d73-4e42-b5c0-b9e6c900276d", "comment": "Malware payload", "value": "87f8a720e192920a7a2e01dcae49643f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221733, "uuid": "57ae67ee-13cb-47ee-b3e7-5bdd9641fca4", "comment": "Malware payload", "value": "0e7dc4800cf8441e0f559f4639961f29bb23c4e1d576040eeed8bea8755bd6b1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221733, "uuid": "72aa72b1-8ce5-40a8-a321-f41058bdc956", "comment": "Malware payload", "value": "a806d0b2d7662e18c617b10851c53a7b54610580", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221733, "uuid": "59d689ed-b047-4f3f-9eec-b42bb8f7e512", "comment": "Malware payload", "value": "3909444f87ff497a3a30230c8aa4661bbc62226bad4817ab0e274364cff750eaaca9127efec8dfe2752c76864c259ee8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221733, "uuid": "67765363-3320-4e81-9093-bb54c5773e8e", "value": "14830215A0FC869780E315A22A307BC78AC0E79B585DC043F1349E27A4F6BB9857BF5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221733, "uuid": "f9c6663d-28af-465b-a5ca-7c0c749296c1", "value": "1536:Ct1QVGeGug5dwSp6yMvBjqqxM5Y2VXw1QFsrGq9ZMlmZQTQdj:eAG7u8l3MvBjqqqXw6Af5dj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221733, "uuid": "ae4bcf81-2586-440b-9777-6df98b707b0d", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221733, "uuid": "9f1b0446-db0b-429d-b66f-72b3ab0d9f00", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221733, "uuid": "f1ae7ffb-b0c5-49c5-92ef-fb638b128f7d", "value": "info-1845210959.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e56e6c5-a3ff-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1619160249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619160249, "uuid": "678b5c3f-b90a-45b1-a42f-1e749cff87a1", "comment": "Malware payload (Loki)", "value": "39be28f381881d30ef47eba7ee7cd575", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619160249, "uuid": "37990339-0c3f-4cbb-b517-34f564132f91", "comment": "Malware payload (Loki)", "value": "0ec8d87f0b8a9fd96f018d3b922fd508e1f34676fac68ba6caa76c8a7f445ffb", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619160249, "uuid": "81783fb0-19cb-4393-99de-012ba6115bf1", "comment": "Malware payload (Loki)", "value": "c3f426bfc17c39092f9909fdda3711d55543ab8f", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619160249, "uuid": "a0387dd9-3eea-4985-bba3-2320fd2eeff7", "comment": "Malware payload (Loki)", "value": "a0a1aa0f04a9870d63b2c2572ad61a0a59a05edef055ab17002ce4da1e401186b2e2a0d71b9b1df9f8e1057a4d50cb49", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619160249, "uuid": "c4e57ea3-5709-4f29-9dd2-2b83b41dc443", "value": "2CD4E06135DEA3C9D86A46B82C6437F053763D17BA4ADD6C6DE8360DAB778020335A3C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619160249, "uuid": "fa2546a4-a2ca-4a17-8bd8-071dcde0ed9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619160249, "uuid": "19ef5cab-344b-4e64-9bf0-b4fc72d3a770", "value": "12288:j+rFvRY8NWl7vzyW3/4J3DQy72izf/Ny3zjHhU:j8FZY8NWdvVAdEcvfV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619160249, "uuid": "eb41b3ac-c891-4ea3-a6f5-e1c86121cf36", "value": 653312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619160249, "uuid": "f8af619b-4b33-455f-8b4e-db2bb879c087", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619160249, "uuid": "57fa1288-5ad5-4c9b-967c-a1314137f38b", "value": "Request for Quotation_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05db21e-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220543, "uuid": "a76569cf-6a5e-4987-b5a4-299db8bc900f", "comment": "Malware payload", "value": "d65dd6ff587c40553bb1012eee6ba9b3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220543, "uuid": "5c416b44-19f4-4ac3-8d84-2454dd683646", "comment": "Malware payload", "value": "0ec9d390c99b85056a2efd447815d4f2c175cbb0155fd3099c345a6d9a8923ce", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220543, "uuid": "41309e18-dbb3-473b-a364-706b0c119fbb", "comment": "Malware payload", "value": "d1bf3d6a04c356f17065b759f1f9f0b2c3d1a0f1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220543, "uuid": "ecaef8b2-0789-43fe-a8b3-289ebd7c5855", "comment": "Malware payload", "value": "342e29253c65c1005cb15ed81de627e61ed9d9addcec26234541db558d62fd14c71724f2138d4dbf688b471a51e61e86", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220543, "uuid": "d03f6aff-c3ce-4d2a-b59e-1030f4192c95", "value": "3183121E78BDA3E960D1C6422D347A814B94EBD38C47C00572B55D2AA4F0FB609B7D9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220543, "uuid": "09110a8a-f27f-47b9-91f1-0922416b6a6a", "value": "1536:2NZdYvHm4HQWVy+sb/QM5Y2VXw1QFsrGq9ZMlmZQTQdo:EUG+3Vy+0Xw6Af5do", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220543, "uuid": "b7957d9b-ec55-4195-8097-e3b25fe55d01", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220543, "uuid": "55b9498b-dd1d-4020-af3b-a2c4d1530992", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220543, "uuid": "eb523269-082a-4d81-8ed9-d374ff1ee89b", "value": "info-1229859656.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "164d1734-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217707, "uuid": "bcebbc99-7138-4922-88af-6b07f0755c5d", "comment": "Malware payload", "value": "a22f8d2d0d0141aa70234e92633f87df", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217707, "uuid": "d7c71f59-4e0c-4a4e-8d53-e41e7ad9a4ae", "comment": "Malware payload", "value": "0ee224e29bbcfb8e80d468cf79763e682bc4c2daaf1104268dced3ea84770748", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217707, "uuid": "1d7642b8-3c6c-4f2f-9bb5-0ea7c6b88dc7", "comment": "Malware payload", "value": "b1eb84def2ab5078c1c73f32f84a8ac8785df432", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217707, "uuid": "ed368cab-84a4-4d57-893d-574edf4619c9", "comment": "Malware payload", "value": "56db7fa1fb59b38e9287b6622a9143a4f02611ef9b4664768c9ebc6799c653bbbb7bec510564b57a526948a326c7b2d0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217707, "uuid": "91b0dc38-a532-4bcb-9449-54b7509fdab3", "value": "C9830273FDAA23C85819D8A1E0AA7DF4046FCCAA845333A8553D3972104D7BE5B019AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217707, "uuid": "8840278e-9937-4a14-987a-33e45e54e1c7", "value": "1536:7g2gk7xHK1qQaiwotTqFUAAWB9Te87VqINbtezgVRxr9AiUrQTKXs8FI+bd:RcpvtTqFpe8JqmdIrLjFRbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217707, "uuid": "e0ddbf06-c4bd-4d5c-8a17-2f8225d2be58", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217707, "uuid": "d23311c1-9fdd-4472-b752-877010ed4767", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217707, "uuid": "53548296-2011-4473-85c2-8fb8665c3d78", "value": "catalog-1112552731.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e4d439f-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221989, "uuid": "98b8c3c6-ff4d-4755-bd09-590d7d1ddbac", "comment": "Malware payload", "value": "893d2dad8cfec304877e743d039b116f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221989, "uuid": "f5215d25-e8cc-47a4-9f8e-04113a8bd992", "comment": "Malware payload", "value": "0f1dce9d19c5a4af7f8ec26b0d8e9d3d64fc4f54ccc1850abd0fba958a5d8757", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221989, "uuid": "2199757a-e932-4fff-a82b-7513edd58060", "comment": "Malware payload", "value": "7741220b395962c76d0877a3b4904f21a4801591", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221989, "uuid": "dbe6637e-8480-48dd-999c-c23906831cf6", "comment": "Malware payload", "value": "5efd1566b1f4ec22b355f9f3fa35dccb7a6c0f566f84a6179381be24edbd87ded60a11aa21f7239900080c33c8639ca5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221989, "uuid": "0de399af-7d11-4cc6-bba1-06d0c81aa181", "value": "2983020E5C8826FEB055F7101E3DB8898A0EEFE1C975A604F28EB61CD072B1D75B446B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221989, "uuid": "24074597-d79b-4c9b-83f6-0b0da00721ce", "value": "1536:FNZdYvym4HQWVy+sb/5197v7UZoctQ2kPo+4mpRlDi1nUSUqxuuR:bUT+3Vy+U19T7YptKRNpoUSUqc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221989, "uuid": "2b8fd301-35f5-46bf-b2d7-548a6f650b1c", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221989, "uuid": "111b2095-8546-4646-b2b1-598f7156f636", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221989, "uuid": "ad68cf84-eff3-4647-9612-0ceda595a3f7", "value": "info-2046406247.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "878228a7-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221333, "uuid": "982a4997-8608-4053-b757-1560c9395feb", "comment": "Malware payload", "value": "d066fb9d2315d5670834ebc3f74b3552", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221333, "uuid": "7764c9fa-83dd-42ce-ac63-b816735d0329", "comment": "Malware payload", "value": "0f3affa8a19809806078acb159b288d53196c2d55ffa0ad3d5ea6a977848030c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221333, "uuid": "49f304b4-294d-4c5f-9375-f659d2f6d241", "comment": "Malware payload", "value": "8dc21c942f5a06a955060bacd66c94d13a4d81da", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221333, "uuid": "f4b61151-e940-48cf-afa2-1b9d3a9df8e1", "comment": "Malware payload", "value": "96a57616f12bccf9bd355eeebd3a23ee2c341a24835a0460643b74c02c20fa0a899baa61e7c64f90ae45800a47d881f9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221333, "uuid": "f72d85fd-eb19-46dc-8c61-880a3ffb9dae", "value": "A283124D35EDC040E17F7D60536AAD5901B86F4BEFFF9164CB69A1329901863EA0368E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221333, "uuid": "449a012a-7b73-44f5-a95b-e16c959d4201", "value": "1536:OwJNfD6jITxi7UnLkb/Yw3LCq1GeOuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbL:OwzOEliUne/L3LCq4kO6xoKDShicdBMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221333, "uuid": "a88253e8-81ce-413b-a64f-80929c2dfe7d", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221333, "uuid": "f3e04c9e-2ac3-499d-ba36-64b79ca20ed0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221333, "uuid": "2465316b-6190-4cd1-9ca1-dd634b5ec946", "value": "info-1624868875.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efbc3fe7-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219360, "uuid": "955b2f95-89c2-4266-96aa-63e9213e45e8", "comment": "Malware payload", "value": "b64926b5f802a59181c8b33562cd3691", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219360, "uuid": "b15d7bfb-319c-456c-bcbe-39f1068828ec", "comment": "Malware payload", "value": "0f6964b80eddb2da26f30dc59e5aae65db93333e340118ebbb8e19e609fb08c5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219360, "uuid": "8a67b0e9-a3db-4a45-8ff4-55137f5db5a4", "comment": "Malware payload", "value": "6657d5d27cadda2bc5e253fd1bd2e87c927726dc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219360, "uuid": "8cf64233-6f03-4baf-8dca-c67a4e8e2083", "comment": "Malware payload", "value": "7cb5f708d9c58cb11c3709ef88db6eece101ef1e677f19a8ddc250a1513e63bd84b31092bddf25ce09dd55c9c3edb214", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219360, "uuid": "3750ce4e-5f64-4957-a9df-a6dda20712be", "value": "E5830276DE8F8289C016B23003786FAA1F286B7146A1141E5BB0747B2F5B9BD4C85FD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219360, "uuid": "e078a47c-8281-43ca-a392-d9791c5365c2", "value": "1536:GEBHCzlWAXdZ2rQD2aCvdyWxaqQ6Rxt5AB/aqPwL3VbCbp:GCCzh2QKmm/Qwt+awaxCbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219360, "uuid": "28730dea-1b35-482e-9793-7827a3f853c3", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219360, "uuid": "832dd2a0-7e6c-4aa8-a736-c6ba07914eba", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219360, "uuid": "9ba0af90-a1b3-42ba-b6f0-447479c515f7", "value": "catalog-2039103235.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47725797-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219937, "uuid": "03991b26-69e7-456c-8726-1f22689548b9", "comment": "Malware payload", "value": "579eab8f60e728eb3807d251c4834479", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219937, "uuid": "9d815514-e59c-4d82-abe1-eca81d272156", "comment": "Malware payload", "value": "0f8866fca3fb89b0c109f70861d3561cefcd82d57a95d5e7771e735f4fe9bf80", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219937, "uuid": "a50343e9-1f3e-4082-8572-0a23a41c8e7a", "comment": "Malware payload", "value": "b6c8336d23743310cfcbaf93090601ee7c05fa2e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219937, "uuid": "7b20fa08-b464-4513-a34c-85496d2a4cf8", "comment": "Malware payload", "value": "58e830c3e91a32d7f8ba883385a09d5154cd7e22a2e53133c899b5d30ed3d2189acd3eda04cfbb7433ea0bed638268ff", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219937, "uuid": "32e8a8ff-ad58-476d-bb14-7bcc15c0768c", "value": "F78312D964163A7D8CFCA64D646F3E001EECB2E16A3302F7D14BC97770FAA9894D0218", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219937, "uuid": "d2635174-80e3-4f95-85bc-ac4d83a60de2", "value": "1536:SFFms3cwHk94TfvqBuKXxLG1ZQUcDwiFALqCJI3+xOtGkwdO2eDiFXM:SFl3+svaXxLG1ZQUcD1FALAOxeh4ONq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219937, "uuid": "97ee260d-cbeb-492f-a7c0-679c91c3546a", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219937, "uuid": "2ec359ce-22de-4cc0-855b-8f6e04dd59f1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219937, "uuid": "0ac68fd6-493e-4827-8aa4-7e9ddaa5151c", "value": "catalog-424881985.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5610edb-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220981, "uuid": "2c86f9d1-2680-4e9e-bcc0-184ea784d1d9", "comment": "Malware payload", "value": "3eac60c7cc4b81d9b339c02da37469d4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220981, "uuid": "0622e704-f277-4667-b2f8-014a15e640c2", "comment": "Malware payload", "value": "0f94bc4a4e714104e2215ef710a946c711c5664e72d4f9c64bf52b244133a793", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220981, "uuid": "a58692c5-0755-4834-916f-890df343d741", "comment": "Malware payload", "value": "8b150f5295b1217a4182a73390e6055b89ed14a3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220981, "uuid": "6c1565ed-51eb-4df4-8fb6-40201848e31f", "comment": "Malware payload", "value": "ef9658c706b6fe541f13f240a5f361953d62c79e7f1e0b05a7baf26a527a7c42fabd0132ece3f74fadd8c88b2f5011c4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220981, "uuid": "d0941c4e-031a-488f-bb1d-1917d5956be7", "value": "3E83124D2C95E29EDB4879A217DC31A86F942333B7F542EACC5E72227523E36F1041A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220981, "uuid": "17414f06-bc06-44ca-b79c-b8b08115e337", "value": "1536:zwJNfD6jITxi78nLkb/Yw3LCq1GeOalTJkv9c/EWd8E//nfYRq1o+VCQHeWnsUWp:zwzOEli8ne/L3LCq40VJklMdT//gRL+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220981, "uuid": "b89ff46e-94c8-4a81-927e-116fe290bfcd", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220981, "uuid": "bf2279b9-5bbd-4b1e-af40-376341d41e36", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220981, "uuid": "8d847b67-abb0-44e9-bab0-072ae6202cd0", "value": "info-1413148348.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3f33c4-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218148, "uuid": "a7a09829-c499-4182-8ce1-0e9f7675221c", "comment": "Malware payload", "value": "75e6e2b78ce06364b15e359ba6eb878f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218148, "uuid": "936addbf-12eb-43c9-b99f-5a0c36816197", "comment": "Malware payload", "value": "0fd58d8894bb8622c587024115954340037ab598de63827ce2e08dc3892774a2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218148, "uuid": "de99d143-fb92-425c-bf23-1dfdfc010442", "comment": "Malware payload", "value": "90c5bbbaa49deec910659fa8f5341f7f6381ffc4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218148, "uuid": "c8b7c43f-e7e6-487f-bdf2-6167fc1a502c", "comment": "Malware payload", "value": "551a8588e5df3120b2d20d77322f15920e60016af41b7b927af2af6878cb8665bbc25ec2efb261484710cc84b02f00b5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218148, "uuid": "8ff831a0-8253-4105-9bb8-b67e8b0f6dd8", "value": "808312E4C78E0CD5C1558E0D7B22F8A8B901711C3118B5E7FAAD58B96B534E8A2B3DF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218148, "uuid": "980dcb6f-750c-449e-93c9-5e79c8ec84d9", "value": "1536:KEGf1lwz7up/vqBuKXxP8JXvKDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrn+A:KZcvuBvaXxP8JXoM25NfuQjMCYNBwltl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218148, "uuid": "2eea72cb-9263-4afc-acad-29b967f32da3", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218148, "uuid": "7bec477f-f734-46cd-9026-b2c058644ec7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218148, "uuid": "b7da06b7-291f-4609-9fd1-cec5a8096c27", "value": "catalog-135454029.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72493afe-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220009, "uuid": "72fd6a87-4714-4175-97a3-3f3f2112fc42", "comment": "Malware payload", "value": "fe313a09bb90d76e73e4f1c2402afe8f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220009, "uuid": "549019b5-c1bb-4e1d-bbb6-f3d76e55925f", "comment": "Malware payload", "value": "101542973864f8509af12ca3d481987e3b15a0a5baa9bbfd6f040a7845201a73", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220009, "uuid": "7c684705-f1bb-4c69-8fb9-a952958c211e", "comment": "Malware payload", "value": "df80f49eeb2d3eaef5e570ee2b24b359ee35880d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220009, "uuid": "4b31c4fa-3fa4-4e63-963b-9befb0db0336", "comment": "Malware payload", "value": "72d575647960f064b9061aff140dc78290de3501f83c087e2db21631e10edf19e0f89b383264b09a5656bd61910a3764", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220009, "uuid": "92bf1623-624f-4647-ae47-701f775e3971", "value": "FC83021BAB8B65329017D7F19B363E06B753B9EE384D200AEA6F4774F6320551CB82D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220009, "uuid": "74654a15-7cb9-4ece-b0a9-bc414e2d06da", "value": "1536:h5NKMwpPGjSSTQ72ZTYzqcIxxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZiZtb:fNMFGeG6IzJ9a03fjwe1moYpof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220009, "uuid": "413c2151-95ea-41da-b3e0-246e8a3e3c06", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220009, "uuid": "2fdcf70f-2b83-4a33-aa30-81ce4f259bba", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220009, "uuid": "fe560218-4b1a-4e69-941a-3254fbb97aac", "value": "catalog-463288541.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "036325f9-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218534, "uuid": "cba87c83-43a8-4895-9d72-51fa29a83056", "comment": "Malware payload", "value": "5012258a3b03b3058bf0c1965fb0beca", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218534, "uuid": "83010e81-55ac-4afe-b945-cc5f2ed264ae", "comment": "Malware payload", "value": "10a6a1aacd38049198fc12510635a9a0034fa6b912d92965bf071a72d3bfcef9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218534, "uuid": "7daf6d3e-5817-4130-94e5-3c1d5187fbbd", "comment": "Malware payload", "value": "8aa8f4bd4a56cfc3195da1875ff24df321684f3f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218534, "uuid": "d9dab782-07be-4297-bcef-8e0024c14dfc", "comment": "Malware payload", "value": "a72736d82aed760fa6b0c98a609e730419138163003a8b0c1c3a8b76dde9e20609457cac9b76257320b7632fef62050a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218534, "uuid": "cc53aebd-31f5-41d5-899c-f688d943d033", "value": "8283028B74E9433ACB3513F65CAE5E0422B1A47F1408C6DC79973B786B53672A572388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218534, "uuid": "e74d85ae-4a4b-41e6-8705-af9d1a2a46c3", "value": "1536:cAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvp:cijtuPmU9j7+XFWtYe14hbOjB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218534, "uuid": "5306cae6-e4b1-40e2-8450-9456482b8948", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218534, "uuid": "717e8991-6c5a-4a83-86e5-0566ce631f52", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218534, "uuid": "195f7209-720c-44ea-981e-2b76b4605116", "value": "catalog-1578086116.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37917c1d-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219481, "uuid": "8bb4ad42-54ec-4122-b3b8-9c387d02727e", "comment": "Malware payload", "value": "98680c523589469538e939ab0862a604", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219481, "uuid": "ea74c7ca-d414-4ec9-a756-a5c987a850a5", "comment": "Malware payload", "value": "10ae4d37bac1534d4e740f2cfc87d419c7409871123c0d9091427909f39319a3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219481, "uuid": "a14cc6fc-9e5e-4ddd-839d-4a534a43393c", "comment": "Malware payload", "value": "780b0e1ed4c98d66e939b3cf5092ebc30fdb7d69", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219481, "uuid": "4c242cf1-677a-459b-8b57-4a4da84d083f", "comment": "Malware payload", "value": "52c673b4e7ed74188654613b69bca3f4d80d9176626b1b1d3ba75516b5590e364086b9e841ae3dd2530d800911a0e8a8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219481, "uuid": "82c30f22-d4c5-40c4-bd87-e495a67c7bc8", "value": "B68312D5CB9F4EA8C0405D0C7F21B8BAB920330CB125A6F6EEDC0965AB5206475B3CF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219481, "uuid": "48e959c2-73d2-4e71-828c-9bd72075435a", "value": "1536:jfL8FCyWvSfkyguvqBuKXxH8JXvKDqf+5ff9fuQjMCYNst+IHClPLqkwD0DCuAD1:LLMWSkyguvaXxH8JXoq25NfuQjMCYNBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219481, "uuid": "1949a4ce-87fc-4e91-85f2-61d998b4a5ff", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219481, "uuid": "e05ae233-1cb7-4a75-8014-432f5f0b6ea9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219481, "uuid": "97b1df85-b2cf-4bdd-b5b7-059b15dad956", "value": "catalog-2114729871.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea46da4a-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222358, "uuid": "e8368e83-27b5-455c-b807-71c79c100af1", "comment": "Malware payload", "value": "2c5ee385d8fe906ea3f9ff2b92384891", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222358, "uuid": "f11c0184-bd1d-402f-9e4f-7b053c25ae86", "comment": "Malware payload", "value": "10c91ea5dd1810f08dfd69702ac6829635c332c04418d2933370a54129b713ae", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222358, "uuid": "84ec091b-4061-4c0b-866c-fa21e6ad1752", "comment": "Malware payload", "value": "673875f0f2734bddfe30931abb5641d018ca671d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222358, "uuid": "eaeb388d-419e-42dd-8ecf-fbc0da69ec6e", "comment": "Malware payload", "value": "b96b05826a0e30b9e3e6cc2e6d3eba584e82f77d5e78b41f7478a324b70ba8be02427992f405c3180adccee5328735fb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222358, "uuid": "f1fcd388-f25f-45e3-9055-381b74c6dd4c", "value": "FE830277369D86FED14EF05E906FF1BDF054A91E8E2EE624A7B428103837429A410A7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222358, "uuid": "14f5500d-34d2-4b0d-a025-e7f4ccb16e35", "value": "1536:EfwJNfD6jITxi7z9ZvjL3+xnxv5ZUSzhhcBrasoi8vQMwdjV46CT8:EfwzOEliRZP3+9xv/UGDmrajvIM6CT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222358, "uuid": "8d8e997a-31a4-42b3-a95a-68944ad64001", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222358, "uuid": "b6b963c5-bfc8-49e8-a5ec-967ec233f4ee", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222358, "uuid": "28f7564d-2618-4f3c-b1eb-13eef9afeb60", "value": "info-338714335.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae387239-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220969, "uuid": "57c6f23e-a73e-4d18-b677-52d21867deca", "comment": "Malware payload", "value": "7b7d63e9b6808b3321df412dc5f47ee8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220969, "uuid": "a153f50a-3376-4f6e-9c14-cf050a5e43ab", "comment": "Malware payload", "value": "11121c73480ec69a6a96e4d02d432aa8ad3a0208caea10cf533abda3d7d2c225", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220969, "uuid": "a59a212c-94e0-4ac7-a052-504b89d6a3c9", "comment": "Malware payload", "value": "8255488680769dd5e791188170652b1cf4b640e6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220969, "uuid": "d72e08b0-9310-4a2d-aea2-5aaa089277a3", "comment": "Malware payload", "value": "9124407e273015461d54f9e8d28d56d0ae841df5d096e381ecc04d28533f8305ceffc72424b4310bd5ad32f23431cdc7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220969, "uuid": "defd3928-e8d7-4065-a264-24376846a72e", "value": "D9831317DC6E14D8C06E47E41CB2291D84709F6D811C8889B16EBBCF31E8E499EB7DE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220969, "uuid": "11f515cd-58c7-44df-8e88-fd815a2975c8", "value": "1536:cNZhdaLgblJKa6wSp6yMvBjqqxPGLuhCWdHsh1oSFWsfEFhHqLWO:aZZJt6l3MvBjqq5OsZdHAO5hKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220969, "uuid": "e905b133-8799-49a3-9295-6fa5edb0f0ff", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220969, "uuid": "fede1861-fe8d-4596-af16-aa608dfc3961", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220969, "uuid": "5242573b-5fb7-4713-88d9-7f80bbf5a25b", "value": "info-1410403704.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d73f2397-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218890, "uuid": "dc9c458e-c028-4cb7-a66c-25a6831a922c", "comment": "Malware payload", "value": "3028c0e758d604838b59e3516398decf", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218890, "uuid": "2091d735-8229-44f6-8b65-3fb1ac21bbcb", "comment": "Malware payload", "value": "113625a32cb8401a07bba4012d75ded0836518d33048fd27feb36e0cf873c99e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218890, "uuid": "44b01d1a-49a0-4e77-ba1d-88fdb3f1c409", "comment": "Malware payload", "value": "1172295db28546747c3debbe5fc85be33a32fe43", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218890, "uuid": "b633962e-2d0f-4b02-88b8-897a774eaa4c", "comment": "Malware payload", "value": "3f706ba7b0483e888745ebc54ace2503786b5f46a0e5ea474071e903adf9a1466d7fa2fe89aa105aed17d669904f054b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218890, "uuid": "e1774c28-995b-4ce4-a6d2-cfcb43ad552b", "value": "A68312A30AD9289D7067FD2881687FCF58D85B23AF041D4F8EFE4B6B21974AD3690750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218890, "uuid": "3495d3a2-e07b-4c98-8b26-e713053e980b", "value": "1536:VEq02fnBKj0MlbCkZi+nTnfZA6F3SNZzTJAsB0Ic6DMADMt5zC/IDIz105:VZfBkZiifLCNBJAIlcAGIz1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218890, "uuid": "2f9817e5-907d-4a30-bd41-8007f5998381", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218890, "uuid": "8c0b6299-13dd-41d7-83ba-fc238ec45877", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218890, "uuid": "7544a5b1-5574-4202-a28b-8f273e51de2f", "value": "catalog-1769856125.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da361bc-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220458, "uuid": "625c027d-e2fb-4da7-9ad9-8d1f33747e64", "comment": "Malware payload", "value": "5ef9b214e5c85610cfb7fdbca157bc64", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220458, "uuid": "2332a4e2-a370-4a46-ad77-7c0dbda26014", "comment": "Malware payload", "value": "11641d9d4965e6aaae0498ed7c14259c089ac108cf2039b6060638dd73bef896", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220458, "uuid": "721d77eb-42ae-4da7-be72-ca7967ab9c2d", "comment": "Malware payload", "value": "d2db7a949c920c825c5ecef73e959ca96ca2ac5a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220458, "uuid": "11d4e5cf-85c7-4f83-99c1-1ee281776533", "comment": "Malware payload", "value": "8b39f9eebed67b569e3ad12f58d174725f0afb46a26254e61de5be8cbfd5aad396bc20e0bcc8b20aacf0043d43efa5cd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220458, "uuid": "5ac40125-f3cf-4227-9049-905f9e81d707", "value": "3283124D35EEC041E17F7D60A36AED5901B86F47EFFF9164CA6961329801863EA0364F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220458, "uuid": "badfebae-e6b8-4cdb-baae-101283c6dccf", "value": "1536:owJNfD6jITxi7UnLkb/Yw3LCq1GeOuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbk:owzOEliUne/L3LCq4kO6xoKDShicdBMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220458, "uuid": "50c83efe-8c12-497d-aebd-808d9597409d", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220458, "uuid": "f13a5882-15ae-40e3-81d6-5cadf130b542", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220458, "uuid": "8d126472-9f70-4be1-b8eb-9050f0553658", "value": "info-1168379863.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d671779f-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220607, "uuid": "b9eec208-3cce-452f-b7b9-6ae17866f8b2", "comment": "Malware payload", "value": "9c791fb828ac7efca92fd92eb927435a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220607, "uuid": "2c9553d2-334e-421e-a543-1210007d36d2", "comment": "Malware payload", "value": "118ac8631efc15fb0f76beb657967efd6fe62f31e4838d74e57a0671d118e274", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220607, "uuid": "f4ab3ad6-88c7-4705-8f15-8afe26716dcc", "comment": "Malware payload", "value": "94fcd1dba8fee7591417f0f84466c3e024cb4ec6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220607, "uuid": "8ea52d25-1773-49f1-ada3-926f3b6ed4e9", "comment": "Malware payload", "value": "ebd3cfa5849dfd30c9116c392b73059279421bde0ff059fe8da0ba53849a3e29b39bc7f2527539dd648794eec48477fd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220607, "uuid": "bb54b8c3-b9f0-47a6-ad1d-430130911511", "value": "E083020B9961A8FDE16ABF01273DD4CFAA4ECBE1D53519C0F20E6F65D2A3359325440B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220607, "uuid": "d8c234ec-f99e-4f94-b509-a2dd8f4b8715", "value": "1536:qHZbN5m6RtLlLHfAkZ8kISNq7xWgwMQZ2197v7UZoctQ2kPo+4mpRlDi1nUSUqxB:uBm6XLFHfA210wI19T7YptKRNpoUSUqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220607, "uuid": "c8c8a8f7-6031-4d10-87cf-6119b6b1e8d9", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220607, "uuid": "616f4cf2-0c8f-4b34-bed9-a9eed28b3fde", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220607, "uuid": "01b10b63-412d-442b-a13c-954a34c949f1", "value": "info-1269559575.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b897bb-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220412, "uuid": "cb7b4f5f-dbdc-4aa0-8307-69112172e217", "comment": "Malware payload", "value": "26bac995269966d0ca8b959c644d8563", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220412, "uuid": "cea94ae7-f816-4ae1-8c61-bd255944572c", "comment": "Malware payload", "value": "11cdfadcd63e02b71136880660e10153c8eabc3e1e43952b766fbbf0e2ae50b4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220412, "uuid": "01d1c1b9-c57f-43a1-ba21-9df21175ee25", "comment": "Malware payload", "value": "65d7177a764f8180fd0fa88f178965ffbfdc988e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220412, "uuid": "27345288-1cd1-4833-ba6b-e519518b07f5", "comment": "Malware payload", "value": "2c50cb7c1f0b79812430c319b561e1883e728605c5ad88beec7db289c354a15dc832760975e3c25410b5a7e936132692", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220412, "uuid": "beb50cd2-f2e8-4996-a933-8f9ff7af4af4", "value": "B6831277F076A96E829CD0B1A41E3A1839F871C3E435978EFD1D3A17C426DCDA91182E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220412, "uuid": "387d47e2-e21c-44b5-ba40-2209a3171032", "value": "1536:GJs4DkjRjDC+ramyNIPjLxx7mgV3e27JWgtrQZcUT7oqlaHvvbFq9GHocnoe1Rqj:ILoNfPrG+vxxSCxIGUT7o/v096oiBkw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220412, "uuid": "394f376b-d65b-4e19-8c5c-ae30726d7d73", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220412, "uuid": "95f3fd2c-8717-40a9-b8cd-0589b245ca59", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220412, "uuid": "a06866ff-3bc3-4da1-b158-d7ee92eea869", "value": "info-1145661698.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77c96866-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217871, "uuid": "bd4f38d1-49d5-4510-8633-ecbed6f9ebb4", "comment": "Malware payload", "value": "d4eff64f306505db6eb0d73bb5df832a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217871, "uuid": "ce363698-9dea-4d89-85d0-d6a5e24606bf", "comment": "Malware payload", "value": "11e3cdc5e23e04a5b465d5fdebc7f9a675abbca1695d38a952930bc65d7700bb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217871, "uuid": "d86fb74f-ce84-4547-9adb-4bbcad67bc27", "comment": "Malware payload", "value": "727f6374e7c6386e61ca008b08b0e4358f7cf02f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217871, "uuid": "6779a91b-8cf0-4cea-a988-74c21ef891fc", "comment": "Malware payload", "value": "b8a573f39b77bbbfb435ba3d717e8da80be88bc5eac0b53b03ca91cd95946c8822668d043fb913479563b781ff123f32", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217871, "uuid": "30768111-415e-4974-a0ee-ddf02d4ba169", "value": "668302CFB4E9433ECF3527B7486E1E046661A43F400886EC75D73BB86B526B26572389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217871, "uuid": "0333948c-338c-4c84-a567-dd0502f43657", "value": "1536:gEwAfNtg2tf2vCapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJv3:gHijtt2v7mU9j7+XFWtYe14hbOjP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217871, "uuid": "8357724e-e397-48dd-8955-dc7fdacf7eb2", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217871, "uuid": "f2f091ab-db24-451e-8bf3-7511eb52fa28", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217871, "uuid": "81730b42-4c6c-4feb-92a7-38d7d0c03300", "value": "catalog-1209717044.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a37f1c0f-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217944, "uuid": "e5498d70-4897-4181-9f35-176df17376ae", "comment": "Malware payload", "value": "bcf87d2157f24448063ef3fe3f697cce", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217944, "uuid": "2a542ccf-18dd-41fd-af61-ce2bbe28b88a", "comment": "Malware payload", "value": "11e915286e8a936973f9e1ffdb2873313e785d134cfb3f337257892e4d020d64", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217944, "uuid": "a6b058ff-1c61-41de-a91b-1f85b10750aa", "comment": "Malware payload", "value": "04b21d432e805a5f3990fad66bcd71ff053586cf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217944, "uuid": "9ffaad14-a998-4565-aa97-8b7bc05a90ab", "comment": "Malware payload", "value": "54a99db7075daa7b9de7c79df69b2921c01a2ed111e742918268efc46b36c34377d704ada700e859edf21e8366d29bd7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217944, "uuid": "22858943-00e6-4768-9c41-f0f2cb031473", "value": "568302ED3A16C666E2B19329CD3D88C533A2CEB8A00EF0526C4F3F7A7D215AF9411535", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217944, "uuid": "239268c7-58d8-43c0-b337-f4822e428790", "value": "1536:MRn2h1Uf0IbwZQ72ZTYzqcIcUjoB8+wXdpUna5ahL2dmTLUVVvo:MR2hsbG6IcuXinakEmEVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217944, "uuid": "9cb4fd5b-90e1-4c1e-9358-786f8396247b", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217944, "uuid": "627cf10c-51ad-4aa6-8bb9-3e747336ed79", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217944, "uuid": "d3f7aabc-eb5e-476d-94f5-8aeed2d18964", "value": "catalog-1252107080.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39a76e32-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221632, "uuid": "082a67a0-2efe-41d1-a0d3-1267d9fb8439", "comment": "Malware payload", "value": "d2e111300b83ab7390372baf82705ad1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221632, "uuid": "3f7e322e-3db3-4ada-8536-db7f68d7a9ba", "comment": "Malware payload", "value": "12035093b5c86c30d701776dca54de176951544f0ab353409f20b36febd90997", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221632, "uuid": "002cd393-39c3-4bd6-a2b2-d14a402f2dac", "comment": "Malware payload", "value": "c0e65088005ad58c35e3b1999484a8de9f29e449", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221632, "uuid": "fc1dd9f8-262c-4ac0-a3c8-aebab1ab133b", "comment": "Malware payload", "value": "dd2eae253b201363bdd59d98a7d6641cb2cf188e398cef0d257f86c4e77388ee4c07cdac65fca6e73e9ac6df70aa8a84", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221632, "uuid": "b5e04950-9c37-4623-982a-4d4ca2361d3f", "value": "8283121A99BD1CD9C0BB12F00D73494D4860EF7D411C8449F11ABA8F78AEE85DEB7AE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221632, "uuid": "265097cb-2801-4070-ac0d-ac6c7f55a917", "value": "1536:Hgt1QVGeGAg5dwSp6yMvBjqqxPGLuhCWdHsh1oSFWsfEFhHqLW/:HYAG7A8l3MvBjqq5OsZdHAO5hKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221632, "uuid": "02768793-f574-473f-961e-d642bebe41dd", "value": 86794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221632, "uuid": "daa31be7-68bf-4a68-a485-70d67331aa96", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221632, "uuid": "7ecb830a-e6b3-4be2-8a4d-5b199e149984", "value": "info-178616123.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f21535-a42d-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1619180069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619180069, "uuid": "264dbbb4-ad28-4557-9295-c40ba8f80a22", "comment": "Malware payload (NanoCore)", "value": "cf693436bd2d31ff45a26e6488062de4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619180069, "uuid": "16ec3863-f462-442e-87c9-4094e588dd2e", "comment": "Malware payload (NanoCore)", "value": "12281e8597eecb8f7247bf9e65408d5b599202e6ba89798a4f7a392bbfe1408e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619180069, "uuid": "d5ec08af-e706-4f05-8507-929e27b7c33d", "comment": "Malware payload (NanoCore)", "value": "78c11e92d8e24b1a2b4edf3de0c764df0eba3abd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619180069, "uuid": "c11d99ad-aced-4d33-8c4c-fda80eba945b", "comment": "Malware payload (NanoCore)", "value": "79c33eb7fe618aaed2260f3d25e4cbfcbb75cf5bcf96d88083671fd74b9778ac5372963cccb5210945b4f820b79daf48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619180069, "uuid": "697101f2-b788-45d5-aa6d-a970aae425de", "value": "5A2512363318AFB2E17EEB3E1021551003FAE614FB12EA5A3EB940CC5597F869773949", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619180069, "uuid": "37e3aa47-a3bd-4139-a0a7-f55a684acdfd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619180069, "uuid": "54aaadac-6889-40f2-aabc-5e6a01d7077a", "value": "24576:PvLJ/RwJD7N8Cm1JEiLKj8s0S6Y5eGLFEfqtTV1qaA1:kFTafO85SdFLFEfqt/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619180069, "uuid": "10183aa7-2760-4c74-913f-6a1ad8ef340f", "value": 1033728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619180069, "uuid": "ca028f3a-0ba9-4c2e-a624-7daac53cfdcd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619180069, "uuid": "89757d93-7550-4cfc-8273-d8033210c1b4", "value": "cf693436bd2d31ff45a26e6488062de4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e7727d-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219899, "uuid": "146b9b62-8c47-478a-b68c-03e407101f8e", "comment": "Malware payload", "value": "e1c447bd5e515c514ade376c1138f840", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219899, "uuid": "6c72b562-2a07-4d2e-890e-80eb37374845", "comment": "Malware payload", "value": "123bae95941ec426bc4ee9228dbc0009f5656dcff02409699b3b3ea062227f0e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219899, "uuid": "a2b811dd-9626-459a-9790-5715e913c0ac", "comment": "Malware payload", "value": "6271a1b78ceed0fbe8e4b5384bfb49e41618b8be", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219899, "uuid": "6608d367-2fa2-4ce3-80eb-e2a171082295", "comment": "Malware payload", "value": "0bcfaa52c4d440b1e6a510100015b991d0f00dea8a8d9c9f272a77acac3b32cf470729c8271785c37b7deba8aa012097", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219899, "uuid": "29d49a49-6739-4dfb-9c29-4aa719448010", "value": "73831277DE87624EC102723013782FE64B2C6B729A61150A1770747F2B6B9698CC6FE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219899, "uuid": "48675978-970d-451f-adde-45fd28b53bd7", "value": "1536:EuxWAXdZ2rQD2aCvdyWxaqQ6Rxt5AB/aqPwL3VbCbP:EA2QKmm/Qwt+awaxCbP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219899, "uuid": "e7a5c198-04e3-4351-a305-b991b24db9cb", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219899, "uuid": "e3cadd93-0974-48e3-9a4e-179f7e7f5118", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219899, "uuid": "3b4558a5-779a-48f1-a4c7-2c3dad126f66", "value": "catalog-402365376.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2518d4c0-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217732, "uuid": "2a1bd58b-4a41-4fe6-871d-9fb2b9323c0c", "comment": "Malware payload", "value": "e785e5075e8256ade6519a477eb9174e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217732, "uuid": "282cdc67-2155-4d51-9807-a9aaafa3c254", "comment": "Malware payload", "value": "12407cc60c27f04f1afe5ce9257e16120d96bfd677bb47c590f8f0b9d2c9ceb2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217732, "uuid": "2c48a3b6-ace6-4d81-ab2e-d50f798a0391", "comment": "Malware payload", "value": "fa9bcf3f8475b7e1c0228b7baee22b1d0b54920b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217732, "uuid": "ec1788fe-ee13-4fad-8de3-b673b7b5ae82", "comment": "Malware payload", "value": "d179acb2029744aad69f967b755441637d7ba4b24d2a63fa48c79358c4de3431de04d22e5fc23c06026ae07585dea84b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217732, "uuid": "d891dc66-7031-429a-bdde-9858021543cf", "value": "CD831277B6612DEC2812F612E165AFAD25FF1D8776540CADCA7D142340862FE3E903E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217732, "uuid": "59e8acc1-0777-4b36-9a04-c8a506d2a9ba", "value": "1536:qxAS5f/KHErqQaiwotTqFUAAWBO3SNZzTJAsB0Ic6DMADMt5zC/IDIz10e:qASlmEXvtTqFKCNBJAIlcAGIz17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217732, "uuid": "362fb82e-597e-44e9-97ee-d68c51affb1b", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217732, "uuid": "29691fbb-9af6-46ea-af4b-b5f215a70c39", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217732, "uuid": "63e12404-f873-4884-9143-b35bf16bc41b", "value": "catalog-112803836.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc129d1-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220723, "uuid": "4ca8e44a-c16f-4e23-9b88-4bd7ccbd1738", "comment": "Malware payload", "value": "d214619db7d92a9993a19726ff820f48", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220723, "uuid": "1c9d5dd4-0ab8-44ef-af2e-9c1f288d3caa", "comment": "Malware payload", "value": "124e969e9195a78c3b15225710f8aa675a95a4f5a4f81feff9749f1c21a70a68", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220723, "uuid": "2aa61f14-a6f2-4ac8-ab57-b51e3ebb726e", "comment": "Malware payload", "value": "ee8602a483ecdb841c5d3dc489a3dcd8f34c1b47", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220723, "uuid": "f6af2ed8-f335-4d26-9f93-2fa2aae0c36e", "comment": "Malware payload", "value": "fa2c11860beddbeae36c5804b05167cefed730017a4da21881529060118c58c13ce18072644cadf40ad0bf78205e7931", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220723, "uuid": "ac973b63-b573-4cda-bdac-d1795edfbbd8", "value": "D283124D35EDC040E27F7D60936AAD5901B86F4BEFFF9164CA6961329901863FA0368F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220723, "uuid": "13ec9199-191e-457e-86d1-6599e5a1d8a7", "value": "1536:fwJNfD6jITxi7UnLkb/Yw3LCq1GeOuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbq:fwzOEliUne/L3LCq4kO6xoKDShicdBMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220723, "uuid": "34af914d-c58b-489d-bbd7-7f1b2f9c50f6", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220723, "uuid": "4756f276-e9df-4c48-a67a-2cadd48cbee6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220723, "uuid": "21ebeb7a-1289-4e70-b60e-1634e54d3a08", "value": "info-1340151669.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8edc21ff-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222204, "uuid": "cde2ea6a-742e-4f12-bb1f-9006c307aa3c", "comment": "Malware payload", "value": "b9742229359cd83cbe8ee272edc8f3cf", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222204, "uuid": "4576fd90-4826-4256-b02d-2d97072304c4", "comment": "Malware payload", "value": "124fd2aad33503dba7ab58072e4c2b2ca8ffa63cd7f53ec758a8cc68c9414012", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222204, "uuid": "31435e8a-b8a5-47c7-8c71-b123463c2412", "comment": "Malware payload", "value": "637b3726f1e2fc79e88262600f5460fea6540994", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222204, "uuid": "623da395-be54-4885-bb81-b5dcee2f2567", "comment": "Malware payload", "value": "a24364cf4648bed950dfff0bcf1fde582b2e6b653980beb4b32165077c850a5df06a09f112014d48a86ec7957b68757d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222204, "uuid": "2a9e1921-27c1-48c9-93cb-79bde1d5a3c5", "value": "038302B3322D0BEF900AB49B909FF5F9F156A93E5D1EE510B3642D20357153EA410EAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222204, "uuid": "71602960-b3e9-4db0-8b4f-3e56390cae9a", "value": "1536:m3QBAV8QI/AATZvjL3+xnxv5ZUSzhhcBrasoi8vQMwdjV46CTW:ml8QI4AZP3+9xv/UGDmrajvIM6CTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222204, "uuid": "506ed08b-be3d-424f-8d68-44d111fff024", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222204, "uuid": "848931cc-a176-44ba-ab1f-8ad3cd174b88", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222204, "uuid": "df211c14-6ac4-4ea9-8d75-42c48adb17c4", "value": "info-251051156.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb898a1c-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219810, "uuid": "d7f3af74-8ece-4fff-9188-6ae76c37fbef", "comment": "Malware payload", "value": "97c62b1d8a33e7374bcdc8f19d571a25", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219810, "uuid": "ea394baf-483d-442f-9ff3-09715f170757", "comment": "Malware payload", "value": "127615c93649bef29f24366b2a9c80c7c2235db3306b52de1d30fd28ecf6c14f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219810, "uuid": "96162dcb-17fa-4014-92be-ff030f37f1b3", "comment": "Malware payload", "value": "61fc06a71b2781f4d387379806cc4b68c7fcf7b9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219810, "uuid": "81ca4000-71f3-48a1-adce-19eed2d639e9", "comment": "Malware payload", "value": "b4d0999b8a1829b2ccbacc4b2c663ed5ea2814b63f76874482d94d6332f904ef730140a185e99aea47c5a3fde1649ab5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219810, "uuid": "a1864e38-ed88-4712-8aa2-379b457df865", "value": "ED8302CBE9E4432E473516B7986D0F455A40353F44106BAC2AB936F8AB67E73885F2CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219810, "uuid": "b4493ecb-871b-446c-a7b9-94ce4048050c", "value": "1536:ZeaAK6VMMJDrlBQNdZ2rQD2FPdoSVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJC:ZVAP71BQwQKLU9j7+XFWtYe14hbOjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219810, "uuid": "242f8a18-41c7-40c8-818f-d6566d7e016a", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219810, "uuid": "f4f68b02-c228-4173-9658-e2f10318306e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219810, "uuid": "d10fabfb-5f6f-459e-801a-96b3fa53e71f", "value": "catalog-352974618.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb028154-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220990, "uuid": "012574b5-d31b-43ac-9dd1-90e56c041322", "comment": "Malware payload", "value": "0925d5524ba21a21db5a72b34735f3ca", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220990, "uuid": "28dc2601-c625-471b-85c8-feb46f5562bf", "comment": "Malware payload", "value": "12dac7e04c68068ef26458b9dfe3e019c7071edd5e119ba123a78b2c1994733b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220990, "uuid": "c3bee59e-7c52-496c-a6ec-60e226875285", "comment": "Malware payload", "value": "446e4a4e022e02e321387b4a88adf69ef4d0340f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220990, "uuid": "e4d060fa-26eb-4af8-90fb-0019d40f87e4", "comment": "Malware payload", "value": "fe87a9f3b4f3e8072e5531b6e4074cc9a747ece585246389dc57237fd4df28264a80b99d08cb8ce79ea292c852dac09c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220990, "uuid": "a090465b-f8da-4807-86f3-f88e17e4c77b", "value": "DF83121699BD1CD9C0AB13F00D73494D4860DF7D411C8449F11AAA8F78AFE85DEB7AE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220990, "uuid": "0ec97b53-d5ce-431f-8e10-6f8f8dd1aa7a", "value": "1536:8t1QVGeGAg5dwSp6yMvBjqqxPGLuhCWdHsh1oSFWsfEFhHqLW5:8AG7A8l3MvBjqq5OsZdHAO5hKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220990, "uuid": "33d7af52-1d77-4b1a-9ca3-b9b3f7ab17c4", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220990, "uuid": "967337b5-92fd-4008-aead-6c7a148cd32a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220990, "uuid": "939b429b-4e68-4ebf-b221-bc7444ec4773", "value": "info-1415113915.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac087866-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220535, "uuid": "608f3b4c-5436-47d2-b108-755d1721a070", "comment": "Malware payload", "value": "64adb1ce219377477c26886ca5148396", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220535, "uuid": "1bbc7cfa-5def-4477-b2b8-6f3adcce9a56", "comment": "Malware payload", "value": "12f0806e2a828e87f2bedd29149f476ac94cc35a07d5cf59289790efaccde07f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220535, "uuid": "86f144ca-b914-4f61-ac4f-0593490cf051", "comment": "Malware payload", "value": "7e114701f0e7b0816c04a7af79dd1a910a7b13aa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220535, "uuid": "70cefcea-6b3c-48bb-a6a6-2e269ed92a5e", "comment": "Malware payload", "value": "b1db7f5f763b42c9e64870eaf06f5b8ed164e1146f32ba3d8404bd17c5c46c061efa033a08866f45a063a5bfb762a15b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220535, "uuid": "f4da421d-7048-4eb2-974b-9d81a5ba10f7", "value": "1B8312A1A87CA15F638FDB73D0777757E88009E5512C1E9B534222383DB8DEF8827229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220535, "uuid": "29a6110f-8813-4640-b131-a9757be17593", "value": "1536:ztaLgbb9ZvjL3+xnxv5ZUS8CWb/bLCDxxp/ERd9QnGlRTH7qrelcw:zZ1ZP3+9xv/UHnfLMZERQnGnTHMev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220535, "uuid": "9da26492-a5d7-4d8d-868d-6eeaac3da99c", "value": 86799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220535, "uuid": "9c682ef6-f9a6-4ecf-8b77-18e43ce5d543", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220535, "uuid": "bad3d56c-f435-49e3-a0b0-7e402ea68312", "value": "info-1225265762.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa6077e-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219271, "uuid": "e85b53ed-f47d-4f7a-9bce-62342dba573b", "comment": "Malware payload", "value": "5d092c8d7ab9d6eb280bb5e8a99b9b4e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219271, "uuid": "1340c2c6-ee61-4fbe-8a85-effa37586978", "comment": "Malware payload", "value": "1332211f283f1d3fe738c1c37e4cb7f68b83e873127a673d6a256d3fcdb5e60e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219271, "uuid": "67379f9d-8d68-464f-8913-0ed487808893", "comment": "Malware payload", "value": "3abfa81ece34644d0f367c5d269fa874f28b5785", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219271, "uuid": "30f91587-83e5-42c8-b208-da5b6df0e92c", "comment": "Malware payload", "value": "4b0ba28aca578363b49dd62c4958529bfbf3ee165948165440967a341320a08e5c4ec3de8dde47abe70bbeb5b93a1047", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219271, "uuid": "8a7c42a9-1a40-4b96-a566-aa5fb09b0c8f", "value": "348312FC792BE3DDA97084DDDC6DB1E705AE4958A049B1925C0B3F222060BFEE815539", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219271, "uuid": "2a09feca-61e1-422d-a4de-7b3987e49a42", "value": "1536:7uams3cgHHyQZiwotTC3pjHjoB8+wXdpUna5aha2dmTLUVVvX:S+3pwvtTC3pjDXinakpmEVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219271, "uuid": "b26065f3-d9f4-4daf-ae4e-3ceee89035b0", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219271, "uuid": "1168ae5a-46d3-4f39-9c10-841166acab84", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219271, "uuid": "2f909723-063e-40ce-92c5-462dfafa65ea", "value": "catalog-1978514925.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b5f893-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219805, "uuid": "1bfc6306-f52b-4a49-9319-6f255052ff7e", "comment": "Malware payload", "value": "782e28555f9b532ed362177682e446f8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219805, "uuid": "bb6ffa02-cc54-4f90-bf8c-3652ad3a6747", "comment": "Malware payload", "value": "133ea95b2f85ccfc85e134f1dc104b1a469ec9b91276f2646ef49e4a41ba1e21", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219805, "uuid": "6cff4edb-89d6-4c5c-b222-f945b5f54268", "comment": "Malware payload", "value": "923efb582c36b8824b81505bae734f31bb05ac0a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219805, "uuid": "e11963b0-b95b-4b11-a128-3b5b1de199f2", "comment": "Malware payload", "value": "3a11727f51b9f47b152c08d0455560c702001d0a9144e3e5498e03b23d6a9bfbf5c964deda40966c1cb83b30f141ae8e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219805, "uuid": "0efecaef-f0c8-4055-ac02-6dfbb3763fe6", "value": "E88302E9254236BFC9FD951D206F3D402EACB2E56E3212E7D207D93770F9AA894D0718", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219805, "uuid": "8a69c058-0945-401e-a981-f96b44d87cde", "value": "1536:6eF5u1k94TfvqBuKXxLG1ZQUcDwiFALqCJI3+xOtGkwdO2eDiFXu7:zF5fsvaXxLG1ZQUcD1FALAOxeh4ONq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219805, "uuid": "4832d5fc-e3fe-4c45-8073-ea21f51eb6ea", "value": 86928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219805, "uuid": "ce4aa38d-4975-4aa4-9f30-3c9cb84f800b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219805, "uuid": "3258b92b-8669-4fc0-835b-82692ed9ef6b", "value": "catalog-34948305.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d1a6b19-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218604, "uuid": "1b5bcefe-d1b5-407e-b99e-3d390a7b9a77", "comment": "Malware payload", "value": "5e77122092e94430f2d40fcb32bf134e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218604, "uuid": "478c7a6f-a3d7-451e-9e32-ac4074819028", "comment": "Malware payload", "value": "135171d32e5436f04b5eeeed28b0f521d57fdf090855035faf8bb2f9efbfa88c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218604, "uuid": "4f1bde06-9aeb-4e5b-ba39-dee16f6b56be", "comment": "Malware payload", "value": "7d7d6a235b89b781a2891aeb083bf142f045b9fa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218604, "uuid": "2d807645-59c9-45e3-a72d-c6182dbe5b53", "comment": "Malware payload", "value": "5090deb1bbf0bf26b6ade3aaa6d44fc7cbdb0665c53a93f9188b3780da06a0fddab9f0f78addc70a7a91b29325ff7052", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218604, "uuid": "cef139fa-f50d-46ab-83c0-7be86f79c692", "value": "C58312F7CFAE458482067E16B2255DBBA0583818611436EADEDF16508BC25E4E8F3CBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218604, "uuid": "641972a6-39f1-4d9c-9715-9fba4d4cf842", "value": "1536:aG02Gk7xSWWRpNdZ2rQD2FPdo1f+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnS:/n0BpwQKW25NfuQjMCYNBwltD0DCuADW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218604, "uuid": "5775a0d1-8e1c-4540-92e2-8cf7f8b2fcef", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218604, "uuid": "85572502-901e-43a6-a1dd-413d6a8243b8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218604, "uuid": "1b122766-1eb3-403e-8f9c-6a4b5f94411b", "value": "catalog-162822708.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff26c69-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222367, "uuid": "5cda91e9-383c-412f-8ee1-13b2546a444b", "comment": "Malware payload", "value": "27c136260708928588bc9f5e8f16a4ca", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222367, "uuid": "483f6ceb-cdc6-4fa0-a695-da70f85501c5", "comment": "Malware payload", "value": "136ab32c5ca16e7892756771cf3952bb0f55deca04d39697849d2708f2bcd561", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222367, "uuid": "fa8da423-4978-424c-87b3-199da406262f", "comment": "Malware payload", "value": "d9a1df07809e6af6f5e6ee118ebb124e118e4046", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222367, "uuid": "17b97c7e-8d6d-452a-9a30-e8707bd628d5", "comment": "Malware payload", "value": "6368a4d597fffc84b9204cc2ba027f03dab683faac621a8bbea1caa3bc15284dad1dae5abed6febead3217cd8a419ec0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222367, "uuid": "21da8fac-e3f1-458c-998a-844ec87d308b", "value": "FD8302A1A87CA15F638FDB73D0777757E88009E5512C1E9B534222393DB8DEF8827229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222367, "uuid": "99125c92-c7d5-43f8-95e0-6bb287cccd53", "value": "1536:h9taLgbb9ZvjL3+xnxv5ZUS8CWb/bLCDxxp/ERd9QnGlRTH7qrelcD:h9Z1ZP3+9xv/UHnfLMZERQnGnTHMeu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222367, "uuid": "8d7f3244-681c-44be-8e28-1cc22aba7528", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222367, "uuid": "2ec52330-a4d7-4245-a411-0b0b97dc34eb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222367, "uuid": "edb67a6d-37dc-469a-a3fe-e31d15885589", "value": "info-342325164.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5172d224-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219954, "uuid": "be035e71-e7b6-4103-b510-1ebf6771d17d", "comment": "Malware payload", "value": "d1d2a2cf60a2eaa5f507ea8a59dcd09b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219954, "uuid": "4215aaf0-f034-4dbf-8a67-90f800dd3af3", "comment": "Malware payload", "value": "1379406d8e68d8839b636e60e250b959826ca131ecdd090a73ed97426f131335", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219954, "uuid": "2e848c5a-f9ca-4494-a86c-71d14a2121c9", "comment": "Malware payload", "value": "eacc96b960777cd07ef45224661dbd924fdc0fc5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219954, "uuid": "0b622cbd-854f-4a3c-8bd5-60047a33f2d9", "comment": "Malware payload", "value": "6163cb49c61ee203917d356adfe58c6f08d6405a1b8ec9e48b03ee8fad34ab096557cb9a1d7d0173a137bba22e065efa", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219954, "uuid": "d7121244-ad83-48ba-8071-3f3cc94f4fca", "value": "A88312D964163ABECCFCE54D646F3D001EECA2D16A3212F7D14BC97370FAA9894D4218", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219954, "uuid": "4d46e033-0966-4495-8e19-de56284c5246", "value": "1536:ZFFms3cgHk94TfvqBuKXxLG1ZQUcDwiFALqCJI3+xOtGkwdO2eDiFXL:ZFl3usvaXxLG1ZQUcD1FALAOxeh4ONq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219954, "uuid": "909ad656-02fe-474f-b2b0-b027243577bd", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219954, "uuid": "88a1d440-687c-4eb1-acd1-911f6de319ca", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219954, "uuid": "96b1f09d-3888-4ea5-a103-0387caeacd02", "value": "catalog-435247075.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d07afc-a3f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1619157068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157068, "uuid": "a65c3f87-bd9c-4ce9-8c76-a820eef953c3", "comment": "Malware payload (RemcosRAT)", "value": "06b2befd05d60d47183797b1e079b6e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157068, "uuid": "a78339f7-59e5-404b-bae9-447d49ad095b", "comment": "Malware payload (RemcosRAT)", "value": "1384907c30bf5d2185b80dfbc63359a50f087e87a5caa3c27edf8cb3a3a6d2d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157068, "uuid": "17f52e1d-c205-4042-ad07-94e2c813d25f", "comment": "Malware payload (RemcosRAT)", "value": "8d1abaeb6d198014767384dc6594b28bea6d6e69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157068, "uuid": "65bce62e-8962-4401-ac59-091197323d15", "comment": "Malware payload (RemcosRAT)", "value": "4d26494570fd4badd4741b9a275deaeb3d953adfa0da156a881eabd7e631e3d6da22c30ac59975112d4484e6b4e11eac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157068, "uuid": "e51fb5d9-badb-4a52-976b-cf76dc459e7a", "value": "CC04E8A0F2D8DCD6E81612744836EC241267AF7CA4B5551E25BE713AB9B33D3206BD0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157068, "uuid": "8ff2de9e-e7c9-4612-8a59-1efbe6466063", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157068, "uuid": "737bc771-21d9-4d44-9d90-918519bb9d96", "value": "3072:wKr+qEM+NQfqNliqk7jCvHAAwCDKY9Hd3q5P+qYVY2YzY8b80BcY98YtrdYYR3Yf:wQ+RypUvI/p260xsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619157068, "uuid": "5a280687-4893-472c-9c45-b7300445ba8c", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619157068, "uuid": "80df3357-5adc-42af-9a3f-e921131c6298", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157068, "uuid": "d019b12a-27b5-439f-b075-80e4eadadba6", "value": "Factura Serfinanza_0296079315_661568_61612474042820568_45916442_20577348272646701_73141196223677_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b65b9438-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221841, "uuid": "e9e8fb2a-02f8-48ac-83bf-5f36ed4108fc", "comment": "Malware payload", "value": "f652e1e3b7a6aaef3eacf0d65e63e0d2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221841, "uuid": "1d8071e9-7db5-458e-8b57-556fe7348141", "comment": "Malware payload", "value": "1391b05868cf1e23386d755c250f80a3a2f5699155cd5d44a31a8089a86ff199", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221841, "uuid": "215b5c49-f0c6-4396-9874-3cc406ae7c57", "comment": "Malware payload", "value": "06f360d719db955fe047d57d557219637249b651", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221841, "uuid": "3cc307d7-8ba0-40c4-8cc0-90dfb417bd73", "comment": "Malware payload", "value": "1d65884e105616aede2d84f9006870fda499ed9be6f0d1aa6bc241cfd9ce8d3d7e17f7cdc0785aecee84a1a1a8d48ea5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221841, "uuid": "856510d4-cd20-4c17-87cc-fdb3ee25c8e9", "value": "B383029C34FF0144957A6CB8613FE80750FCAFDB2D37B74947208574AA114EAB6239AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221841, "uuid": "8cf279f8-bd98-4198-aeb5-240bace47ad1", "value": "1536:Wr7l+KI0ejUgUlrZKFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbXYZTa4hpl:87l+NUhlrZ6O6xoKDShicdBMM1/XPQTP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221841, "uuid": "29a3c8c1-110f-4720-b190-98a0fb1f3c72", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221841, "uuid": "59c5a519-01af-48d1-9106-92847b81a1a1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221841, "uuid": "44c2e63b-9199-45e4-95a6-7a2cf9d29fef", "value": "info-1922868421.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d34d904-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218336, "uuid": "8bf47e32-d731-4736-9eb9-ea1efcda2e4b", "comment": "Malware payload", "value": "046af15faf58bba9186cde89354e8745", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218336, "uuid": "45d80c1d-29e9-4d50-a7e6-64ed013324b1", "comment": "Malware payload", "value": "13b0eaf8fd145cf675a0b5d69be697c4e916621c6c6c79c87fd19da36ff807e3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218336, "uuid": "d3bd23b1-a1dd-4283-87ca-3da6365aa55d", "comment": "Malware payload", "value": "ba853973e67fa4de8df6ff2fa68eb6652b118b8e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218336, "uuid": "055f58d8-5c11-488f-bd8a-2114d2a26ae1", "comment": "Malware payload", "value": "29e09215b20dae2eebd860a40b600ab69fac5612f5981e60c831e7c7057ac20d23deffbe6632c1d0d7aa94a39a9965fb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218336, "uuid": "bc691d4d-a703-4898-9d09-5ec27075bcad", "value": "2D8312A306CD584D711BF868C1647F8F95ED8F579F040A0FCAFD462F11969BD3990289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218336, "uuid": "d9e48d09-0768-4b83-ba9f-8e84932cf7db", "value": "1536:n2fnBKjQUgFsqi+nTnfZA6l3SNZzTJAsB0Ic6DMADMt5zC/IDIz109:yJiifrCNBJAIlcAGIz1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218336, "uuid": "456fe2a3-2573-4437-be0c-d8b3e55f7243", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218336, "uuid": "c668b042-87dc-4f2c-981a-ee2299ace3bd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218336, "uuid": "f41f22e7-9e41-4cb1-98cd-e160a088af45", "value": "catalog-1449323273.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24c7119d-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218590, "uuid": "5ae6174d-cabc-487f-b2d6-2b3769ef8f11", "comment": "Malware payload", "value": "5ce72796cfa3d2bdae0cbf85d4d67cb5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218590, "uuid": "b15f4403-5474-4569-8298-e1f58202f038", "comment": "Malware payload", "value": "13d1712f5bee3946847ea296572352082c654aa8852363ed374e02f24fcb551f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218590, "uuid": "b643a1ac-8c60-4e02-9fc9-c3f5ee2b748f", "comment": "Malware payload", "value": "28fca9a661e32f02f64ae46cae22a3a35bf13979", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218590, "uuid": "6b58b761-6195-4a82-b4a5-caf9022b7af3", "comment": "Malware payload", "value": "853eeb84935215cee09ea7a0b72c36c824793917587ea209c5b9194c276e05e4bb9df925e22704a39258b8f254182e3a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218590, "uuid": "ef4e0558-ad61-459a-a2b6-acb496c0253b", "value": "B8830254CB9F8C849015ED0ABB22F8ED74506248706973B7AFAE1524EF478D8B2728F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218590, "uuid": "92fdce67-c60a-4911-b9ea-8d81f26f12cb", "value": "1536:+aA6P7EGmwH1zVQLQDYflSJXvoDqf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrna:JAY31zVQnIJXaq25NfuQjMCYNBwltD0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218590, "uuid": "d018d196-c3ee-4fcd-9ea4-2f20a8144dd5", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218590, "uuid": "43e5b00f-da4e-4a76-be6c-6ee30a4e8a2e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218590, "uuid": "8e285db5-3864-4978-ad67-72021bea2c6f", "value": "catalog-1617322339.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c92813bc-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222302, "uuid": "e5b0bfbf-ada7-4933-b4e7-2d8974f42039", "comment": "Malware payload", "value": "589e002e07befbc88a5edf7fb0896a72", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222302, "uuid": "2cf4712a-8f86-4142-9543-34f19145228f", "comment": "Malware payload", "value": "13d60705ae95e18f476c4e24ac066a22659bef8b322cdf45561a9430634b8b65", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222302, "uuid": "8cc24d7b-55de-4a54-ab19-66af2648b668", "comment": "Malware payload", "value": "e195ccc0644e2f38f8257495749cbebb8829067e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222302, "uuid": "2e9a8e94-865f-45e2-b437-603326d87c28", "comment": "Malware payload", "value": "8e804e2ed54f54c14f5025d70a84e124c13cc23c9962bee9a9668bac8f35455e8934a63f6e6940dd2465849b66d22a7b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222302, "uuid": "eadf04da-fa12-4c6f-bfb8-ee7292088d4a", "value": "FC83124D14FEC004D1BFDDB5B27FAE4512FC8F9B9EBAC2044B9889369021AC25E9255F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222302, "uuid": "0df8d8bf-966d-41d4-83a6-a7615556abae", "value": "1536:51dW7cmfQFxV/L+qSGKyuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbXYZTa4hp8:51dmozVj+yEO6xoKDShicdBMM1/XPQTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222302, "uuid": "f99d0345-43c0-4af1-aaee-8b0494ffebaf", "value": 86795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222302, "uuid": "afb18653-f2f5-43fe-95bc-1252f0eed486", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222302, "uuid": "14f0dd4d-7846-4080-ac0d-4241d1e9940b", "value": "info-315718440.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b61ea3a-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221259, "uuid": "c86805f3-11d9-4634-ac02-d4ed397ee8ef", "comment": "Malware payload", "value": "f4c759c4ab67e00e9168ed952a84a244", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221259, "uuid": "cbc18d02-a02d-4424-9dd7-8e13b12c6d99", "comment": "Malware payload", "value": "13e427708e0e2b25f1efb5b3a456c4e6a3851be5288907465f71759023b862cf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221259, "uuid": "c7d676f3-fa94-48b2-99f8-34d0093b7b6b", "comment": "Malware payload", "value": "d1eb0d8792482966d8aa35c931ae7d8b7c563141", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221259, "uuid": "f74d3505-b24e-4b3c-9730-e51d1335dd6f", "comment": "Malware payload", "value": "567b52dd809b7a4cfbf27d4c241577db6ae56e35799b83036c41eb24374f00ad7bcbe5dc7c1974f5915c4a0fa77326c3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221259, "uuid": "2884999c-9425-420a-bed0-7839e1dbfa44", "value": "6D83121D78BDA3E960D1C6022E347A914B94EBD38C47C00571B55E2AA4F0FB609B7E9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221259, "uuid": "8fa5aba9-5007-4654-b80f-5d4119cb16f9", "value": "1536:5NZdYvHm4HQWVy+sb/QM5Y2VXw1QFsrGq9ZMlmZQTQdu:3UG+3Vy+0Xw6Af5du", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221259, "uuid": "d31aee60-12f1-4276-88fb-f5c886d9602a", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221259, "uuid": "2722ec57-c967-4d8e-bb3b-2798eeebcf1a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221259, "uuid": "de54d3c9-de80-476a-8487-7731d463a906", "value": "info-1580686993.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d53ac19-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221719, "uuid": "744e6323-aeca-4806-95fd-0f69f8ab3b93", "comment": "Malware payload", "value": "f940f373ef67da666f8b9ea154fa3b0f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221719, "uuid": "fb3d17ae-3005-46d9-b01d-51757843f445", "comment": "Malware payload", "value": "13e70d3926cb9e16f5f1d43e00daa4567dcd84fdbde1193545fdc4f4e1d09cbc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221719, "uuid": "dc22e483-5ec0-4b03-b08d-8d4ca9a6b02e", "comment": "Malware payload", "value": "d02b5daf72e89f1e972d4119a479bf30ae969fde", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221719, "uuid": "d1cad01a-4802-4129-81bf-5a8707562c53", "comment": "Malware payload", "value": "4437b06221e8ad5c116a7e002588e8b1a381dfe1703e24aed019acbb5abd6185a539051490a00319ca5fe595469c27da", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221719, "uuid": "c32a985b-89ba-4643-879c-f1c55ca289d1", "value": "BC83121E78BDA3D960D1C6022D347A914B94FBD38C47C00572B55E2AA4B0FB609B7D9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221719, "uuid": "610ae33d-8be6-44aa-8c47-cc9a3ecc1e40", "value": "1536:FNZdYvHm4HQWVy+sb/QM5Y2VXw1QFsrGq9ZMlmZQTQd4:bUG+3Vy+0Xw6Af5d4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221719, "uuid": "01069b49-86da-4c1a-bedf-fd18ca975e74", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221719, "uuid": "7d55124b-eeb0-46af-8a80-e91b8d0d66d5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221719, "uuid": "a92ada75-98cf-4259-920f-4034faf6823b", "value": "info-1839198874.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac665946-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221395, "uuid": "5e687d28-7acb-42a7-966f-143aef57b488", "comment": "Malware payload", "value": "94c875f3d3c4f8aada07771e9c05413b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221395, "uuid": "d5f00be7-e67b-4216-8b00-337a8f3fed65", "comment": "Malware payload", "value": "1404f923439953509f34a0cdd74cd941c635a39dbbd0203091a2071731f846b9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221395, "uuid": "9640aad1-10f5-4ccb-85b4-6fc3078c148a", "comment": "Malware payload", "value": "823fad96eb6128db489a66371ca4a6746be805fb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221395, "uuid": "f5cb6894-5e6e-47d9-896e-9fc2412fd052", "comment": "Malware payload", "value": "069294aa3ea5cbab39a68d96d97bcaa155299ce01aba52501e093f3e07bda8725353b92c05f842a757435ff80009bdd5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221395, "uuid": "a1065c2f-d07a-49ce-b321-beeb9a56e3e9", "value": "DF83121A99BD1CD9C0AB13F00D73494D4860EF6D411C8449F10AA68F78AEE85DEB7AE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221395, "uuid": "b977e56d-2d01-4cdf-a523-7102d5cf1727", "value": "1536:oAt1QVGeGAg5dwSp6yMvBjqqxPGLuhCWdHsh1oSFWsfEFhHqLW0:o4AG7A8l3MvBjqq5OsZdHAO5hKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221395, "uuid": "65a3be46-6038-48cb-95a4-a9db83f946cb", "value": 86794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221395, "uuid": "0e24fbdd-5d47-4cc3-8d34-57e015b2ba04", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221395, "uuid": "afd6c577-816f-461c-bcb8-86b6b1de6cec", "value": "info-165100820.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b880a164-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218838, "uuid": "9406363a-9aaf-4acc-a005-f23127cb4fa7", "comment": "Malware payload", "value": "998f3ef3df8f6b69c6e9c9932b4bef80", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218838, "uuid": "90272f64-9e4d-4939-ba00-d4f4ceb3715a", "comment": "Malware payload", "value": "14086240db22bc84f7457baf6ec6b680fc0d466f1138d82a8d3cf5d069489233", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218838, "uuid": "e6dbbe37-58bc-4c9f-9a00-e394060e562f", "comment": "Malware payload", "value": "5e3cfc7a4cff8b6d78cc8db002b0620f117f1301", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218838, "uuid": "f0d50d0c-9093-4de6-b17b-98ac4d5366d6", "comment": "Malware payload", "value": "85ad13a94014e30b4011cc2b392d58c74ce40912f8f3dface48860fce255b711d336e984a5594345316ff13ebc585cd0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218838, "uuid": "2a8ebc64-7688-4a42-b2a9-dbc2f878f93b", "value": "2E8312C5FE771FED8C998D398066ACA41E17CB85D11B2268B06C39F3261C7BD67018E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218838, "uuid": "2709bb4c-f63c-4fe3-be8d-e534bbd8cf72", "value": "1536:SE+3fNtg2tq2vxQqAvqBuKXxLXUAAWBHTe87VqINbtezgVRxr9AiUbQTKXs8FI+s:SlPjtk2vxQFvaXxLXne8JqmdIbLjFRbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218838, "uuid": "529fd3db-37d3-4ccd-a702-b23e4388ecaa", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218838, "uuid": "f4e4fe11-0595-4085-a4d1-b4c46a1a07d7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218838, "uuid": "2f15ad5d-0d3e-4591-b2bf-4d4f03e9b40a", "value": "catalog-1735677129.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71fb7900-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219579, "uuid": "65a8240d-ae90-456a-9091-7a448b2dcee1", "comment": "Malware payload", "value": "3b1a7c931d0ba4337b30d8d1079b9b3e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219579, "uuid": "c8a39bfe-b72a-4b1d-a2b4-8cdb4ae81cef", "comment": "Malware payload", "value": "143aa8cc2dcc9cf1a0437adc5a43ec8b9c319a682201f26712a3d086a08e58c0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219579, "uuid": "80d537d6-e6d8-4f8d-b7eb-978b53dd36d3", "comment": "Malware payload", "value": "921f8156948b3c0d71b63904286601f4cac30ffa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219579, "uuid": "b012fbed-8877-417b-b682-4173aaecc53f", "comment": "Malware payload", "value": "d9214b84d397de89ace0f81af0a8738187a793eaf6cf57cac0cf1537f6f2f2c4bc1d6b5ab097f9c112885c1be76dab74", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219579, "uuid": "80ca1c83-fa21-4b8a-b069-1edb29f3412d", "value": "A58302ED3A16C666E2B1932DCD3D88C533A28EB8900EF0526C4F7F7A7D215AF9811534", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219579, "uuid": "e0441752-221b-4b60-ad60-69abfe15c7c8", "value": "1536:2Rn2h1Uf0IbwZQ72ZTYzqcIcUjoB8+wXdpUna5ahL2dmTLUVVvv:2R2hsbG6IcuXinakEmEVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219579, "uuid": "82f4504d-797a-4140-aa71-56b610f1b047", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219579, "uuid": "815421a8-2e5a-4c81-bcaa-1aa7b147df0f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219579, "uuid": "778a414a-8a33-45b1-a2ff-ea42d81725f8", "value": "catalog-217072072.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd11f383-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220671, "uuid": "ebdb6d8a-a908-4b87-80bf-b0b08a91f36e", "comment": "Malware payload", "value": "7cfab4e58005f6e7eb960f2b59d01173", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220671, "uuid": "e95ea21d-2590-4648-8048-7e20d85b7965", "comment": "Malware payload", "value": "148a5aefddf989f8bac53407f8a96266d659b14a4aeb66cb64fe1f824bb6b326", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220671, "uuid": "b298a1e6-6812-48b4-ba57-aaa7f7977ffb", "comment": "Malware payload", "value": "d5ebf38a323a89610d2d57680bed381ca5ee3948", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220671, "uuid": "ce67c2da-3ba2-4e7a-8161-16da3222f3ed", "comment": "Malware payload", "value": "47df53faf0359d10c6e5eac4b00c8fc37c7be467f20da07d2bfef74c07c31f436b6add5e1df65c7d9c04af8ef0bc5fa0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220671, "uuid": "507e2cbd-2d14-4594-bc09-e3acbb57528f", "value": "6883029C30FF0144957A68B8613FE80750FCAFDB2D37B74947308574AA114EAB6279AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220671, "uuid": "8b8ed8f7-fdb0-4a26-a2ed-624865c96d4b", "value": "1536:Er7l+KI0ejUgUlrZKFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbXYZTa4hpH:e7l+NUhlrZ6O6xoKDShicdBMM1/XPQTZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220671, "uuid": "eb1e6795-5265-4f27-8096-cfde7d79a142", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220671, "uuid": "d6ab6d66-65d9-46d0-a5d4-22fcd56586dc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220671, "uuid": "4bbe4dd1-a9a4-43f1-a3fc-abc5f73fe4a6", "value": "info-1304540937.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ab6b50-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219099, "uuid": "0964c440-4765-46e7-ba06-614f2faecb1e", "comment": "Malware payload", "value": "99be0671f3c55df8d60f787aa12f8d52", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219099, "uuid": "40c47670-bdce-4d3f-bc5d-c3fa30c630f6", "comment": "Malware payload", "value": "149bd076304dc0cace1bf88d7c81941f89e03909f0a619bf680628630785705e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219099, "uuid": "ee4deab4-b9f5-45a8-9faa-d61a81f6465b", "comment": "Malware payload", "value": "51d3f5ee52d899d05c814921d0c7c1828b0bac64", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219099, "uuid": "c68265bb-caae-4b99-8f83-1d8ae2e2b131", "comment": "Malware payload", "value": "ef0f368c73e383f73291995d101b63f32bbdf0555fc2f6d1a56b5156d12ae350c6cdf812edfbd15823b1d895f12d0fe5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219099, "uuid": "b6bc3351-88a7-41ac-8c16-cf94f1000b10", "value": "C583125D5B1B69A7501F7CF21B322A5ABA03BABD0C1C7096CB38C2C0E73995F29642D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219099, "uuid": "b423119e-b0a4-46b7-94e5-0c0a1be44192", "value": "1536:jf1lwtMJDrsPSpV8LS4v5YFGrfZg6kxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGX/:LcQ8PjLRv2FKeJ9a03fjwe1moYpoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219099, "uuid": "80ea41c7-c667-4037-92fc-881aeb0461e1", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219099, "uuid": "3fc6d681-da74-46c7-bdb7-c117508dd054", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219099, "uuid": "1fb21aac-23c4-4c5b-a0e3-de4e0cd8a790", "value": "catalog-1890324850.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fd72c24-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221374, "uuid": "2f2f68f9-c67c-477e-afec-369f7438d6c1", "comment": "Malware payload", "value": "67dc576b63678b987b40cf5d2f8d469d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221374, "uuid": "aae31c02-2fb5-4da5-b774-f4d0658128a0", "comment": "Malware payload", "value": "14b679e94d4dccfab6bb92fa3b6b8d5a41d629cd3bfbe243c951a5c13144d172", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221374, "uuid": "42ca4bfb-13ae-41f1-9dfe-ced977b3a0ff", "comment": "Malware payload", "value": "29e993a69a04622f1a270f55422975ce1eb33a66", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221374, "uuid": "47e46b1a-5657-4027-9a1e-5c807298fd7e", "comment": "Malware payload", "value": "457b3b10a43c082b444919d29b62e833bb0b8433d042c0437897acf53fcbe13ab38132a874d5e994729cbe7ff24dc416", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221374, "uuid": "a4a6344e-fa23-4f08-8912-bf816fedc51d", "value": "EA83124D35EDC040E17F7D6093AAAD5901B86F4BEFFB9164CA6961329901863FA0368E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221374, "uuid": "3534a166-98f8-4f09-aada-cd4e4bd6373a", "value": "1536:BwJNfD6jITxi7UnLkb/Yw3LCq1GeOuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbP:BwzOEliUne/L3LCq4kO6xoKDShicdBMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221374, "uuid": "fdb783a3-3bdc-4e67-a384-6bf251831aa0", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221374, "uuid": "a216a244-4bad-4d1a-9454-87e35df4ebbc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221374, "uuid": "876902aa-5dd8-4024-8be1-39b9dd397909", "value": "info-1638166903.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8488d241-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219610, "uuid": "af5bfcb7-59ef-457f-a6da-ac279ab0cde7", "comment": "Malware payload", "value": "879a37b62d643c7c2c319ea9d6cc44bc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219610, "uuid": "be3e49b1-feba-46c3-b16c-f113226ab22c", "comment": "Malware payload", "value": "14c4835790a20d9d581055aa8ad9eaca96adbc72c8124c57aa9d494be25ff2c0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219610, "uuid": "e556ee5d-c333-4ccf-96f2-8d3b2925816b", "comment": "Malware payload", "value": "bc97444055c927a4f6821ed50a41e90e268c7319", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219610, "uuid": "eee16d1f-2d9f-41d7-9843-3b4b2ad6a92b", "comment": "Malware payload", "value": "34b7dcff703655b9c54f0a4acc878ea81d722b26f938de055c508a9281cc5684167037e3f38cf071b2694b04d806987a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219610, "uuid": "625d4acc-5ec6-45ea-a9d1-548e972375ba", "value": "778312979F9A3B9E24599C3DC57B9CD10905CE33C157301D22283AF6281BEBF9B054DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219610, "uuid": "43c35a78-41d5-406a-b1b9-b4dcd115bd31", "value": "1536:lMaAK6VMtJDrlSnna6UAAWBHTe87VqINbtezgVRxr9AiUbQTKXs8FI+bH:lzAPq1Sa6ne8JqmdIbLjFRbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219610, "uuid": "0f7a3a2d-859e-4d75-bbb0-43658ffe2620", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219610, "uuid": "e2e83cf5-bebd-4ff8-8d8d-c04eedbe022e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219610, "uuid": "0bf59506-76ed-4982-bf35-f14152753100", "value": "catalog-237274933.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e5e23d-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219176, "uuid": "74257fd2-0c47-4fa3-9b12-a803c23603f0", "comment": "Malware payload", "value": "b2f867f4eb737376e2d1c6bd86804630", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219176, "uuid": "b1ddc3e8-a3b2-4520-a5ca-017aeb5d9927", "comment": "Malware payload", "value": "14cc6e72a701d592e822a7715c228074661a086b47dc7af3b2fc318f936f6518", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219176, "uuid": "5723906c-de0a-4241-8ca9-2d6ae472292e", "comment": "Malware payload", "value": "e85fb1da99cea3dfe2a860ca21b51e7679c668f5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219176, "uuid": "e5f16105-0880-4294-845a-12a98a1ba2bf", "comment": "Malware payload", "value": "de1a5f40529b5b23883851f833e6ddf7268545cd1cadd238ae9601e84645f65561512be129e1b37fe0a24e9db7cdb3f7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219176, "uuid": "64fc506a-d40d-4ca0-a6d8-6d1235d17e77", "value": "068312EBCFEA5D884202BF0673065CBBB45428096118BA7A7EDD11506F524A0F8B7DED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219176, "uuid": "d1b314ea-d714-42de-ad81-84ff0cb7a0f7", "value": "1536:KZKLWkP7EBmnbRARpNdZ2rQD2FPdo1f+5ff9fuQjMCYNst+IHClPLqkwD0DCuADh:uKLWSFbkpwQKW25NfuQjMCYNBwltD0Dg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219176, "uuid": "93479e2a-0fc6-4ee6-ba83-44db816365aa", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219176, "uuid": "a99836bb-4254-4e24-b8e3-175a88cc6a80", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219176, "uuid": "c3cb68ae-0f97-42b9-940a-8c172de0adec", "value": "catalog-192671366.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1446b87b-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220281, "uuid": "12dd41ee-28e0-48db-9dbf-1fcf6e09ed46", "comment": "Malware payload", "value": "85ee7498d305666b220f0d52114d2595", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220281, "uuid": "426da4ff-adaf-4886-ba05-26397ee44a3c", "comment": "Malware payload", "value": "14e8a19c162d18288ab20d771576a902ab0eff807960efb38947588c5778b8c0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220281, "uuid": "0aff1333-433e-40cd-af11-dc7eb64a48cf", "comment": "Malware payload", "value": "6dba36f7dbeda1e3ddd35e75d1f726659c45cf0c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220281, "uuid": "6f5d845d-bd36-4f90-ace4-3108b5442c66", "comment": "Malware payload", "value": "740f9739013c105f9b55447074833ccd4e46172b1e39932402bb78a088975144f3351f4dae200b503f5e69cafb34ab92", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220281, "uuid": "6b7f2d17-43f6-4a10-a4f9-89d2c758a896", "value": "B183124D35EDC040E17F7D60536AAD5901B8AF47EFFF9164CA6961329901863EA0364E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220281, "uuid": "c13f4f25-3c6e-409b-91b7-5ea3728f80b1", "value": "1536:nwJNfD6jITxi7UnLkb/Yw3LCq1GeOuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbO:nwzOEliUne/L3LCq4kO6xoKDShicdBMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220281, "uuid": "fe843a82-62bd-4d1b-b8c7-023761fb9957", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220281, "uuid": "0a6fdb4f-6e89-4682-b2a2-ce6f4648d288", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220281, "uuid": "8e9e42e4-9367-4988-aa0a-86976469694d", "value": "info-1057773479.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe5b87c-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221240, "uuid": "c979d261-4748-4def-aee9-86ccb41e5e12", "comment": "Malware payload", "value": "f06aa8273eaf19a59071b2c4d706dd3f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221240, "uuid": "a1369fa5-3d9f-4d32-98fb-6dc1f1887a31", "comment": "Malware payload", "value": "14f5b852c9eca5ac5250fa8a91aa759b6bfa6ea3fc18c65bb0c0f816fc62c002", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221240, "uuid": "b506770a-df12-4376-a000-4550e2dd606d", "comment": "Malware payload", "value": "fc3ed9bae4d07df6ce6cc9132df876537b587b8b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221240, "uuid": "ee07341a-7a05-4fd1-9a82-5fb54ba89ec9", "comment": "Malware payload", "value": "60e13434711fef22c4e1f635ccff5a9540b97ba548282b10e391d69effda78c02aa55f8b004bb7614ca2ccc51d28a788", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221240, "uuid": "eaa6100f-ad47-4a6a-b8db-b7732e0f419b", "value": "CD830215A1FC879781E305A22A307AC78AC0EB97585CC043F1349A27A4F6B79857BF5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221240, "uuid": "cba8bc61-4ead-4c7e-851b-b414b85e7c15", "value": "1536:lt1QVGeGug5dwSp6yMvBjqqxM5Y2VXw1QFsrGq9ZMlmZQTQdG:VAG7u8l3MvBjqqqXw6Af5dG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221240, "uuid": "a2c6c51d-0668-4965-939b-71918c08a6b8", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221240, "uuid": "2f368e91-252b-4c3d-a9a8-1e2c7da0739c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221240, "uuid": "5eb280ee-0d92-4213-9ec6-373728a09e47", "value": "info-1569321670.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d67c5cca-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219318, "uuid": "80327dd3-83d3-4753-ad53-bebb848bb097", "comment": "Malware payload", "value": "f46be7bc7a170cda9dc78e82bf068ef7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219318, "uuid": "d4af6df3-3ab0-498d-a59f-600e775273d5", "comment": "Malware payload", "value": "153196cd31315ac23204e059463f39087795cb2ae4d426e1d0e67f56161273f0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219318, "uuid": "97660234-5afe-41d9-98a0-74950fdef8a4", "comment": "Malware payload", "value": "c8a27cf6c0938c4951ff808eb491acb91d932b9b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219318, "uuid": "43677540-ee3f-4118-9ab3-d667c55cf66d", "comment": "Malware payload", "value": "089285618e8619d57d3c93aef9c726d04ecf874ad4ce574cf96bc5ae192bd8307e0f835d33420ed39bb3f07d8e3565ba", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219318, "uuid": "71de39cf-1858-42f7-a72a-0184942e9606", "value": "F18302CFB8E5473E47322A77051D0E5956A0353F0400AB9D3AEB75342B65A31E8AB38E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219318, "uuid": "fa252545-5336-4c8d-8063-6cd41176c782", "value": "1536:1dKLWkP7EBmsbLlBRpNdZ2rQD2FPdoeVadrj7ZIXFWgKilkAq14HE6M5XL2l92VQ:/KLWSibL5pwQK3U9j7+XFWtYe14hbOjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219318, "uuid": "39c7fdc1-90b7-406b-877f-3ca1ac5a103e", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219318, "uuid": "d9f4c693-d490-444c-b41f-1139c97d0548", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219318, "uuid": "1570cdfc-a337-439a-872e-37e08b306770", "value": "catalog-2009029818.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f724444-a478-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1619212273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619212273, "uuid": "c544da4a-34d8-446c-9725-a9c66f77ffb6", "comment": "Malware payload (RedLineStealer)", "value": "fddc756befc5648cb86f7654c91fc8a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619212273, "uuid": "c072ccf4-1580-41bb-9022-c4f9c5bc08ce", "comment": "Malware payload (RedLineStealer)", "value": "15509eb0045271635c94808f8291b4a0a55e1be0a78296315ec67201ccf2ab01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619212273, "uuid": "09acd634-e511-4bfe-9fba-b298926610ed", "comment": "Malware payload (RedLineStealer)", "value": "5a2c58b1653a14ae00941d4cafccf5174ad801b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619212273, "uuid": "547a0e96-30d3-4ca4-80e4-ae7aabdbe3f6", "comment": "Malware payload (RedLineStealer)", "value": "499a1d9b035701507e128c8c358c0b037e764b75a95c05e41edca8dc0a0773231c29e11f7b05501efa6e235cf7eb56b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619212273, "uuid": "0442fdc7-cf74-4c52-af04-db982fe458df", "value": "4FF29513C78A98C4D0BE2EB58DB506D55A21C21751F2F3263BFA25AD0693EC2390F7D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619212273, "uuid": "5110bdda-a7e4-4353-86d2-3ad719116797", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619212273, "uuid": "dde1dde2-76ce-49f7-a549-5e6c88598642", "value": "768:eHRpmxZEqtSN/VK0z9dJ6+3+tgHDHxv6N28yD2XiUyDVvR:DxtuQ2sXiUyDBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619212273, "uuid": "79bb47cf-f0d9-4eec-ac41-70286b980f98", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619212273, "uuid": "9184c315-9a91-4950-b7df-600cd63c9384", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619212273, "uuid": "17e5f85b-6de6-4d57-8f28-ac0830b042d7", "value": "FDDC756BEFC5648CB86F7654C91FC8A9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98deaa79-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221792, "uuid": "1d7a5776-cc62-4dc7-8f3f-d3fe7044be4c", "comment": "Malware payload", "value": "527c7594aea063a242f4e060168ab1e7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221792, "uuid": "541581dd-121c-4fde-b44a-a377d87d952d", "comment": "Malware payload", "value": "1557699ba845d339407f3920a797e4e5855f0d5fb00a65e54cc3d8f36e083cc8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221792, "uuid": "32aabb5d-8505-4c47-98b5-a78350a3ad05", "comment": "Malware payload", "value": "107a7bc1adbd814f757798668e72782f1d88a1b2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221792, "uuid": "8ad43e4a-4cd7-4917-b4d1-e9e25453c10a", "comment": "Malware payload", "value": "ef8a046b421fb7d245fed5674b12c1be3525ff809dc64b7cfe02d8e5cf39c5c72e457ba11080f3491f57053b24e8b6fe", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221792, "uuid": "9bf25073-905c-4752-b0a7-6d8bd5bbcce6", "value": "C58302CE31EE01486A7B786470B7F54B50FC5F5B3D73B6288230A570EA114B67A126AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221792, "uuid": "269e30e3-5209-4d15-8556-f439d2ee7a68", "value": "1536:twJNfDtI/W4UgUlrZKFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbXYZTa4hpZ:twzpIpUhlrZ6O6xoKDShicdBMM1/XPQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221792, "uuid": "b4e59fdc-bf57-414f-9cf9-afcc12cb0c41", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221792, "uuid": "cb4bf3f9-dd0b-4ba5-bad3-7fc5febaa60f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221792, "uuid": "602a58cd-4664-4275-b4ae-1f274d6ce48c", "value": "info-1883365727.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5e4ff27-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220552, "uuid": "dc27c6b7-f47b-4930-adda-deee88660706", "comment": "Malware payload", "value": "30a736848585db14caa4aa01812c11f3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220552, "uuid": "feb3d28f-308e-4341-b6c4-d616669ae856", "comment": "Malware payload", "value": "156aa4eb63fbe04499488bce014b55ea787a9b25208843a319d3a4d2fac17e92", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220552, "uuid": "1c376904-f485-4f3c-bbb5-49d3bb0b519c", "comment": "Malware payload", "value": "92dacef70d452e15c8242876c73ac6d5cbae3cdc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220552, "uuid": "41a88aca-2b9b-4160-86bd-6873831b895d", "comment": "Malware payload", "value": "82a34a0a8df7c6df38e539bb4e96cba927b08702988415d02628ea7c68b4f9e98049fd7cd838f0861594a03acd673d33", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220552, "uuid": "b9ebd57f-c2f4-47f4-95f8-b7eeba345234", "value": "5C8312B7F9776DB6C15CE1E7E53E122824FC85C07435968BFA0A5E0AC91AEDD9204C0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220552, "uuid": "7aa3b0d2-f40c-4fdb-80f2-820218618aa9", "value": "1536:/r7l+KI0FlLHfAkZ8kISNq7xWgwMQZcUT7oqlaHvvbFq9GHocnoe1RqfwSOJrpMt:T7l+6FHfA210waUT7o/v096oiBkwPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220552, "uuid": "995efcaf-ea2a-4655-99fb-d7e89030e1fe", "value": 86799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220552, "uuid": "30a3d4ad-5c86-4bf6-ad1f-a61d41ae95da", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220552, "uuid": "ec4c32a6-f594-46e2-94f3-caf58bf1e21f", "value": "info-1233938393.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "341d1dfa-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222052, "uuid": "6cd17717-252e-4f8e-934d-81e713ee5c77", "comment": "Malware payload", "value": "7c892d45ca50eb612b6023406eaf9564", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222052, "uuid": "14471e56-98e0-47ff-b2b6-8469ca1aa22d", "comment": "Malware payload", "value": "159b2ca270ed014e555bc94e9bc6fe66a89fb0b881609745ee19947dbe2dd62e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222052, "uuid": "5295a8e5-f792-42cf-8377-45b77771993a", "comment": "Malware payload", "value": "fc9747bf46e0f334c0720f48d27c9a5a1ecc4e8f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222052, "uuid": "40310242-fd1c-40db-9e11-c5d34ce2fa48", "comment": "Malware payload", "value": "f35758ef0ad80361ebc36885515b9bb6b667d4867e25ab0254225a481cf03ca7f44206657a76db208aeea0c15fbca367", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222052, "uuid": "8bb02c61-a535-4722-af9d-cae6e81e7ddc", "value": "E88312A128BC04DB938F6BB3956217C2897413E142BC4F9F6317332939A19DFD92B358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222052, "uuid": "7c1c0e7f-e353-4abb-9ec7-58f61c00bbb0", "value": "1536:q4s6qinLPXZ54w3LCqBqh8CWb/bLCDxxp/ERd9QnGlRTH7qrelcm:q4PqmL/Z5r3LCqBqh8nfLMZERQnGnTHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222052, "uuid": "c3c69de1-be72-4163-9cd7-b7884ea79bd3", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222052, "uuid": "fec60882-4875-4c32-b6ad-68e6653d5b9b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222052, "uuid": "d9bea431-eda6-4965-a29f-3cfa30d5ea71", "value": "info-2088476165.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ba92d6-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217980, "uuid": "a9bfa347-ee1f-4fe3-82eb-1a65a29b69ea", "comment": "Malware payload", "value": "beba0bf7fc8d7a46d121121f963d2128", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217980, "uuid": "00604001-47a2-4eac-b8d1-33b0554587cc", "comment": "Malware payload", "value": "15acd48f4c078094fec8ca84ca115fd062b806d4a16a1a15c27e78275d72a939", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217980, "uuid": "af719a62-0205-4b8f-99de-76dd4221730b", "comment": "Malware payload", "value": "53f1ffceb60d6a82d1ce473604ff4378c3fbbb84", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217980, "uuid": "a47a428b-1f89-49b8-bda3-4eeee31ff730", "comment": "Malware payload", "value": "65de0e371064b77226d52249704b1bd3d9055975e291d513107431001f5579a2eeb9b651fa732d490b3e5e0382ab88c8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217980, "uuid": "0941f5ad-6c07-4400-94c3-4cd9143849c8", "value": "AC8312E4C78E0CD5C1558E0D7B22F8A8B901711C3118A5E7FAAD58B56B534E8A2B3DF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217980, "uuid": "5c1e2587-5ef0-4941-a9c4-99aefece0d6a", "value": "1536:tEmf1lwz7up/vqBuKXxP8JXvKDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnG:t5cvuBvaXxP8JXoM25NfuQjMCYNBwltS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217980, "uuid": "6dab0b7b-e1c4-4887-8a3a-e03adaa4d210", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217980, "uuid": "0f99ea02-0d5a-422d-bfa3-169a0da6bb5d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217980, "uuid": "89c2d0f3-490c-40a2-badd-aa1f6585b207", "value": "catalog-1263442818.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7bdcc89-a3ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1619152265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619152265, "uuid": "d137138d-e392-4c20-9f34-5d9957544958", "comment": "Malware payload (IcedID)", "value": "df7d50dcaa88a5a3bdfc9a2bd190cc70", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619152265, "uuid": "88a7ccf1-239e-4346-a7bf-adab70435022", "comment": "Malware payload (IcedID)", "value": "15b65ccfeced9c5ae3359db9d3a0e68ad0201912b65a0578d5dd7a0f7f7b387d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619152265, "uuid": "d0a7d9d3-739e-445f-815a-a97c57a937ba", "comment": "Malware payload (IcedID)", "value": "5e68299152884300f6ac0a51a0be99fc64d8e98f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619152265, "uuid": "dbb846b7-ddfc-4f1e-b4b8-e85d24178c42", "comment": "Malware payload (IcedID)", "value": "6a21ae152c9e580d3be5039ecafb7a57e2a202389108e2029e51d296d5ba719d1d38ee3aeda883e150c19d1d7f6030a5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619152265, "uuid": "1c64d7b9-2574-46bc-894f-172c68d62a20", "value": "FAD3D5382391A971F196E6FA6A86C29490B532F114BC53FF93B8CB35421C6E52ED720D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619152265, "uuid": "a314e0b5-fcf8-4a82-9c0d-59e873f46e64", "value": "da25e7f76b319fd96ec2476b6a11a44a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619152265, "uuid": "843bac00-de5f-4304-844c-cd204de78b2b", "value": "1536:S4i9Nvf/y+m++oPJ7fQVPF4P1vbLvSsL6Rn0qlt3b8F72DK88:SLxyzWVo0zFL6Rn0qbb07AK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619152265, "uuid": "d0ce6bb5-535d-4189-8386-911ac98a6437", "value": 132160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619152265, "uuid": "b37341e4-9853-4a82-bb9a-d3f9d42779ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619152265, "uuid": "9a100521-0d36-4155-be94-908c1b1ad203", "value": "15b65ccfeced9c5ae3359db9d3a0e68ad0201912b65a0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d1a216-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221998, "uuid": "1b2a0759-b366-4e61-ba74-a4d73a64b271", "comment": "Malware payload", "value": "b976996676b2e04699ee48e71dfd6e49", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221998, "uuid": "fbf5fcd3-54bd-4bed-b768-f112d79ee64c", "comment": "Malware payload", "value": "15d0e4870daa5485aea1d92703b6bcd1502f348ca948601ee554eed1798f6127", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221998, "uuid": "a5f18f6d-16df-4068-a526-c1a0fb4619c6", "comment": "Malware payload", "value": "6696a96f7a708b2d1ffc4ce0b55cd8807421852c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221998, "uuid": "5de6072d-ce1c-4c77-af14-bb73c866135b", "comment": "Malware payload", "value": "7d9a459aeab0f02b89efecc0bdb33234d393d0997efc6f6e7d288ea7b3bc130f872a7730c42986e31de4eb25759671e7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221998, "uuid": "3440b6ec-429a-4927-9724-ec669e250419", "value": "D983029C30FF0144967A68B8713FE80750FCAFDB2D37B74947208574AA114DAA62799B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221998, "uuid": "ae07d404-c1fe-46cd-8b70-f3213f73ec68", "value": "1536:kr7l+KI0ejUgUlrZKFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbXYZTa4hpf/:+7l+NUhlrZ6O6xoKDShicdBMM1/XPQTp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221998, "uuid": "a3e3a096-1966-4bf0-9637-d9e2ca1d8eb4", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221998, "uuid": "f1dad13d-b1cc-4427-815b-0ba1c63446bf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221998, "uuid": "67747f46-3690-4eab-90d9-bed46031a3a2", "value": "info-2052398143.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a6bc0b-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220585, "uuid": "bd0ecc73-bee2-4688-b711-90dabc7fc611", "comment": "Malware payload", "value": "0bae3e39ec2b625cec7fdbe634b5655c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220585, "uuid": "d284763c-61f4-4cb1-8138-742fa9c8c4a8", "comment": "Malware payload", "value": "15ee3de52b45fd5def4ed0799ed618d7b30da93b803d0c19e59654148dd0797d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220585, "uuid": "ea038661-87b2-4b0c-bbbf-e973c98d71e9", "comment": "Malware payload", "value": "d029d75756a231c407f968a255e0c601ae3b4484", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220585, "uuid": "0d2d5438-dce4-4bdb-a809-16b332d2076d", "comment": "Malware payload", "value": "d8f8f6c670258c12fb4af997cec00387e92c309b553f09381b30850b3bb306b63f3b3c35d136237a7babd1c856421ab6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220585, "uuid": "e9edd0d2-d0b7-40be-95c8-3a6e25563ebf", "value": "9983124D35EDC040E17F7D6093AAAD5D01F86F4BEFFF9164CA6961329801863EA0368E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220585, "uuid": "54711160-647d-4b1b-9626-74871b364a26", "value": "1536:xwJNfD6jITxi7UnLkb/Yw3LCq1GeOuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbV:xwzOEliUne/L3LCq4kO6xoKDShicdBMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220585, "uuid": "e929d1c6-25b8-40e3-aa6b-0b63fc053f59", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220585, "uuid": "4f273887-b11e-4e58-9271-fab2ea840372", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220585, "uuid": "fd4e8f60-3bfe-4591-a894-fbdda760927c", "value": "info-1257099147.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11f1f52c-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217700, "uuid": "1bc3d15f-39ec-4426-90f6-4c5c3c3e29e0", "comment": "Malware payload", "value": "21af25a1e1bf3c5535c72000fa4cb80b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217700, "uuid": "aff8063d-e643-4773-ad0b-94be0c6cb38c", "comment": "Malware payload", "value": "160ce4dcb36aa7c670f03c734a23d0df1a2dd2e9aeb556a24c93fa23810d46c0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217700, "uuid": "6a39ea40-d0a2-4a8d-bb19-e381b0d61416", "comment": "Malware payload", "value": "a3d2f076b5d66148fa34b2c3d20af236b0f4d4af", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217700, "uuid": "39de1558-fdd3-48fa-a42b-b3a3dc9b29ea", "comment": "Malware payload", "value": "7e56cc756d432a60ab76a42df88be79b8e75d2f8b9e6731404bc3267599fd681dd807840181df98f938910c1ef18ab89", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217700, "uuid": "2710bbc5-83ad-4dcb-a99b-eb42fb292391", "value": "67830268CB9F8D948005ED0ABB22F8ED75505248716973ABAFAD1124FF478D5A2338F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217700, "uuid": "0a814d00-c88d-4138-904e-a533b3cb9bc5", "value": "1536:aA6P7EGmwH1zVQLQDYflSJXvoDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnd:aAY31zVQnIJXaM25NfuQjMCYNBwltD0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217700, "uuid": "84c3dedf-6866-437c-8299-1120e606c15a", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217700, "uuid": "cf057c61-755b-437c-a1f6-4941cd226dd3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217700, "uuid": "7fb13680-3367-4eec-bc9a-d8a2833929b2", "value": "catalog-1109482945.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979326df-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221360, "uuid": "d3434ab5-7059-43c8-88f8-f92969b7bc7d", "comment": "Malware payload", "value": "ad03348ad2bf93a08e2a0d20b09e240e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221360, "uuid": "09b2353e-6f4b-4ebf-ba96-fd29fa01583d", "comment": "Malware payload", "value": "160f7e2e7539de8528f72f629a88d3086e3d7be9cea4c6e73f5def80150cb041", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221360, "uuid": "0e07c623-2901-40f8-8f9f-7dabc6cca608", "comment": "Malware payload", "value": "a4fcd650fb7b14167bd7fa932717cd42d0324d29", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221360, "uuid": "a779f215-1968-4597-8ef8-ac6d1b56c9e2", "comment": "Malware payload", "value": "c16fc78f2dee7a175192cf92388d4475b9b4b744ff95164933c5430079887b3e9dc5a561a8c1ca99c3e7f57e9d2d87b2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221360, "uuid": "3660b359-6c81-4e08-94be-9b274ad6d545", "value": "BE83124D35EDC040E27F7D60936AAD5901B86F4BEFFF9164CA6961329801863EA4368F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221360, "uuid": "2de9da12-49b6-44b9-8aa9-cd1978cb24c7", "value": "1536:WwJNfD6jITxi7UnLkb/Yw3LCq1GeOuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzb0:WwzOEliUne/L3LCq4kO6xoKDShicdBMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221360, "uuid": "3cd9e9f9-495d-4dc0-81a7-427bf3027f89", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221360, "uuid": "5c9d547d-41ac-46f4-abf5-4b41cfceebf7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221360, "uuid": "2df590bc-c55a-4a87-a5c9-4a4dab618bf9", "value": "info-1633958205.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9627bfa5-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218781, "uuid": "ab6ff7f5-0d8c-4aa1-9c36-47e268ee41d1", "comment": "Malware payload", "value": "920ba63ed018b6a19774179b37f131c3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218781, "uuid": "ca10f241-cf0c-42a6-b534-ad2143751640", "comment": "Malware payload", "value": "162581116c44b694fae5343c6231efbc34795e09c7e58ac39bfaf0bfa0e5df74", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218781, "uuid": "adee28a6-0f4a-4533-929f-8cf8f6bac573", "comment": "Malware payload", "value": "00fe648051d1da209b4712058154a7021ebb3a34", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218781, "uuid": "1c38bd8d-25ce-4565-b1ac-613003286d29", "comment": "Malware payload", "value": "e879520409bededfb04bc24bca91379cd6ab72de191aefc3653efa2906d5d6976fc3a21133850e2f70c0d6d2cd416b13", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218781, "uuid": "da5ec308-f326-4985-b154-2e0ba789354d", "value": "FD8302D58BDE8814C4019E0C7E39BCA57560692CB10EF2E6BECF0B50BB5349AD1F2A75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218781, "uuid": "0565f277-c74d-42e6-bdfb-0b336a83b164", "value": "1536:NLYnBKjsMlbCIv4DhQ72ZTaNqhJXvoDLf+5ff9fuQjMCYNst+IHCkPLqkwD0DCu6:NLYZIvU7JXaL25NfuQjMCYNBw0tD0DC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218781, "uuid": "e58a971d-613f-4c58-8af6-9be045607594", "value": 86930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218781, "uuid": "7573c837-5943-475a-9478-acd4ab1ae3c1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218781, "uuid": "472f0649-f8b3-4e66-9f33-68431617a071", "value": "catalog-171042945.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed6072d-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217883, "uuid": "dcdb12f9-2b14-43e7-a241-25f9853e1d8c", "comment": "Malware payload", "value": "c57aabf0178323a1ebeef19e9a93d859", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217883, "uuid": "199cddc4-b16b-44d0-9ec0-55d4e690fa66", "comment": "Malware payload", "value": "162774589e6366643755a708a4a473a9f5c15765241765f8701223f05885dec7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217883, "uuid": "2a4981e2-04a7-4237-a34a-b55b2a5bc58f", "comment": "Malware payload", "value": "fc1c5364918b48ca7d02312bc88f4c613d93e552", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217883, "uuid": "f76a7a37-24ea-4ab8-b089-946ea409abde", "comment": "Malware payload", "value": "48aa9d0f0d421aa87eac35299acb8669b5cf289e85387e5af29dfe934b2b8d7a803020ae77fb877fa1bdc72ed2b50098", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217883, "uuid": "6c80a6ef-4024-43b3-b14a-c9608c44aec8", "value": "C3830298876F4C9C8005AD0EBB22B8E971506148F176B3B6BF6D1134EF468C9B2738E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217883, "uuid": "2685b986-c8e8-485f-a87e-2dc711ef0f7a", "value": "1536:NA6P7EGmof2vtQLQDYflSJXvoDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnw:NAYn2vtQnIJXaM25NfuQjMCYNBwltD0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217883, "uuid": "58261618-427b-479f-8f66-85141766d858", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217883, "uuid": "c26c9d10-6bef-4702-b4cb-31599ea6df47", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217883, "uuid": "9ea5c57f-bbb1-49be-98fe-9b268a26a9ad", "value": "catalog-1218364263.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1270b35d-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218989, "uuid": "d12df411-2c8f-4aaa-a851-df6ac896f89b", "comment": "Malware payload", "value": "697452597130873cd867fae3d669f0c2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218989, "uuid": "78dec56b-2d78-439a-887d-ab1a65551f0f", "comment": "Malware payload", "value": "163819a4d36045bdc9f3561a7c2cfad5a7cef43a2fb2bc260d0888a0d408df10", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218989, "uuid": "30669d4d-1523-470f-a57b-54b6e2ce797b", "comment": "Malware payload", "value": "c8e41cd8c45b04ade744491937861adb9dfbeede", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218989, "uuid": "b5f1b488-c633-4223-8afa-c776e1577329", "comment": "Malware payload", "value": "669285cbb87e096d88d1f1983dd6ac15f9b44d1108126dc67f56dd621652572d8e5ce41c10eefb351456a3d6fb119ab4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218989, "uuid": "e26465b9-3883-424a-bbca-8d9dc0e4cc59", "value": "8A8312F347D9289D7067BC2882647F8F98D95B23AF041C4F8AFE0B6B11974AD3650790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218989, "uuid": "5f4a4970-8329-4d6b-9fab-c8a030f941fb", "value": "1536:mA2fnBKj0MlbCIZi+nTnfZA6l3SNZzTJAsB0Ic6DMADMt5zC/IDIz10X:ABIZiifrCNBJAIlcAGIz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218989, "uuid": "edede2d1-8441-44dd-b84e-01efbe977bca", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218989, "uuid": "6617cf44-766c-4826-ba74-2024b6ee04c9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218989, "uuid": "f76174b4-6559-487f-85eb-2b040f1bba70", "value": "catalog-182656708.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b0f6d9-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219904, "uuid": "df18298d-0715-4665-9a0b-0a9142793126", "comment": "Malware payload", "value": "e4452dd2a40704d6b92d9c59d2922c80", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219904, "uuid": "39a2c81f-8690-4847-87f5-38e274a4ec14", "comment": "Malware payload", "value": "163fb7de3942892f89ceb2d491a72ba6d600f51cacd5b7d1e858a3351532e3b1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219904, "uuid": "f4d0bcdf-f7a7-4adf-92a0-396d486b1e8d", "comment": "Malware payload", "value": "47db27430578bcc84f5b7c056701b1aa02e8606b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219904, "uuid": "7fbbb1b7-125e-4967-a0fc-07949db6f114", "comment": "Malware payload", "value": "70548decaf8839b9a80cfed59433755ebd87b0587ca182b0b72608474d14f4d367eba9195ee7e489834204ed8b98ad41", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219904, "uuid": "3298b9f6-aea5-48ae-a646-46061b8dda05", "value": "FF830294CB9F8D849015ED0ABB22F8ED74505248706973B7AFAE1524FF478D8B2728F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219904, "uuid": "8b0ba4dd-92be-4ba9-8414-3d5a4488c285", "value": "1536:TTA6P7EGmwH1zVQLQDYflSJXvoDqf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnE:/AY31zVQnIJXaq25NfuQjMCYNBwltD0t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219904, "uuid": "f5c4ac53-2c83-4d88-9d76-c59b588bd704", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219904, "uuid": "500ef1e9-33e3-4323-a546-de8eca9938b9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219904, "uuid": "203e3355-628f-4058-b6c9-40f193ca8ac3", "value": "catalog-403513830.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1afbb63b-a41c-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1619172618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619172618, "uuid": "a4248e79-fd6a-4224-84dc-900a7193d74c", "comment": "Malware payload (SnakeKeylogger)", "value": "c970749e63ed83838c488f5a4ec219a0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619172618, "uuid": "ca885aea-144b-4b39-8adf-749a822217da", "comment": "Malware payload (SnakeKeylogger)", "value": "1643114e9ad4ea69831dc8f052dbbb30fee25835742eb0dab1002db35d30203e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619172618, "uuid": "0470c998-c093-436c-96e0-f5099cc43d1f", "comment": "Malware payload (SnakeKeylogger)", "value": "660af21a0614202ce966e2ae9ea5795cbc430e82", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619172618, "uuid": "96506166-9aef-4f46-8c29-e68ee26148e8", "comment": "Malware payload (SnakeKeylogger)", "value": "cbabf0e2f03765adc66758645b979cd91de9b18b899eeba1b454dca21b0c95bb1e567e4ad90faf498845f3f15befc88a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619172618, "uuid": "f7131b50-6e72-42f4-90c4-bb01432390fd", "value": "12A423A8C7F1C94FE830A2660B0D739159626855AFE1412EA1F36EE7321786C177B0FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619172618, "uuid": "9034b121-84c2-45bf-8295-f8ccccbf64ea", "value": "12288:vXye7T10HeUbk+z6PoMI6WukqjhuMh92Yoec:viiM7rz6wMIdJqPh92Yoj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619172618, "uuid": "04cd5d23-d721-43ae-9dfb-a1ae3e13c719", "value": 469253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619172618, "uuid": "a93f4413-68da-4676-9ce5-ab77106bf420", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619172618, "uuid": "ab74f916-be94-4dc7-a0f7-af9b685af28a", "value": "_ACH Payment Initiated & Received___pdf_____.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04dea82-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220623, "uuid": "263ed47a-c8f3-42e1-b15e-e7fea674b6f7", "comment": "Malware payload", "value": "c626c05203cbb586655af158e648b53c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220623, "uuid": "1c2b485d-4997-4226-ba63-28d5e7f5d154", "comment": "Malware payload", "value": "16591f9f5357cd774435a2540d5d7b4bccc020f2eac3c680ef2853627824d433", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220623, "uuid": "33305b64-2d6f-4136-a154-ed8e3cd4bc76", "comment": "Malware payload", "value": "40ed2a6fb5e06c2db52f3363cb401c7e11e72d58", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220623, "uuid": "3254f174-7e89-4338-84bb-5105c64b714c", "comment": "Malware payload", "value": "6d2d76d4b6044174df4daf0840f86d9f970d079bd7a169f6555e0ea9f4737b41464ef4aeff4bdf327d91d9de5cdc25d6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220623, "uuid": "58bbe618-8576-4077-91f2-91be1a39fb59", "value": "AA83029C30FF0144957B68B8613FE80750FCAFDB2D37B74947208574AA114EAB6239AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220623, "uuid": "bc0cf67a-bf55-4ef6-af81-09809ecb8def", "value": "1536:Qr7l+KI0ejUgUlrZKFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbXYZTa4hp5:C7l+NUhlrZ6O6xoKDShicdBMM1/XPQTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220623, "uuid": "912e54b6-dd5e-4ea9-9e41-6ebb84d40757", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220623, "uuid": "c91318ed-0afc-4a0a-ba89-f25d7e71d859", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220623, "uuid": "ec74a58c-89e7-4b84-9c46-72c359262658", "value": "info-1276087936.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc6a9a21-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220992, "uuid": "a60e5f52-8be0-437f-ae30-18b059c18e15", "comment": "Malware payload", "value": "6b192179a002a9b7782c8ad4eb3a3e70", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220992, "uuid": "9bb8e560-43d5-426b-8026-ca3723abf229", "comment": "Malware payload", "value": "165eac80fb11fe417527d9c7aaf10c99313c738df50eae40ded038015595061d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220992, "uuid": "6f5db2fe-6769-461d-a8ce-352cf51542aa", "comment": "Malware payload", "value": "93f3a8d9761693b5de01fcb4324009479540b668", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220992, "uuid": "1a196965-a011-4480-b67a-486b980d0180", "comment": "Malware payload", "value": "8bdb0ecbb1a096d4fc1af0605961eb7001f61af399888f406eae99be3608cecf4b10533983520fa687c67a44afdc9607", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220992, "uuid": "63c840ba-693a-4f27-ab5a-a29f1605e5eb", "value": "B5831277F076E95E829CE0B1A41E3A1839F875C3A435878EFD1D3A17C426DCDA91181E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220992, "uuid": "be40f17b-8968-40b2-8e27-dcf5dd2aaa03", "value": "1536:nJs4DkjRjDC+ramyNIPjLxx7mgV3e27JWgtrQZcUT7oqlaHvvbFq9GHocnoe1RqV:JLoNfPrG+vxxSCxIGUT7o/v096oiBkwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220992, "uuid": "cd488c91-4029-4860-81b4-091e7e84c34a", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220992, "uuid": "70d2fe95-32ba-4bc8-a63d-8e3ca2ee7fa3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220992, "uuid": "7d0bad2f-0380-448f-9792-ee7a7b0d9133", "value": "info-1415211427.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db71278-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221290, "uuid": "e2cfc23b-3fcd-4ce1-8b21-e53d20d3d84d", "comment": "Malware payload", "value": "dec0f03fbb2dc0a33f2a3f110ee7e264", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221290, "uuid": "83f26a49-bc12-4c5f-94ee-cf93ff83b7c5", "comment": "Malware payload", "value": "166732264447568d9ca6726e3ae1a9e87a6fa4c2ac2fc9196c841eeb974146fb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221290, "uuid": "527b81f2-4782-4f24-89da-579fe23414cd", "comment": "Malware payload", "value": "6422521aa0d5083d7459ddd78fc3ede25dfd526e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221290, "uuid": "581690f7-7e40-4981-8047-9c7c9cd079e4", "comment": "Malware payload", "value": "cd140448293dd861faefa179226c9cee44209f85f07b06a3925d9204ae09a470cc23ef6c66d5d7ee96d5b45fb61b4146", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221290, "uuid": "f78305bc-53ed-43e2-bce9-bc9d1a4fa86a", "value": "AD8302CE31ED01486A7B386470BBF54B50FC5F5B7D73B7288230A570EA114B97A126AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221290, "uuid": "32bd82b0-bfdf-4a97-b8c2-cf412122aef2", "value": "1536:qwJNfDtI/W4UgUlrZKFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbXYZTa4hp/:qwzpIpUhlrZ6O6xoKDShicdBMM1/XPQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221290, "uuid": "71fefbb8-2e82-4232-a83a-1f22d2231bc2", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221290, "uuid": "f97fccca-9e02-46e7-b403-d7ac3182578f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221290, "uuid": "31118a65-a962-4121-a0b3-1f3a8976a4d5", "value": "info-1599591789.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aafad9c3-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220104, "uuid": "08488b61-c29e-4107-8edd-b629952ae074", "comment": "Malware payload", "value": "fc3abfd7aabf5af4e4cad67ffc00cc45", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220104, "uuid": "05173381-c9d8-4b2e-a9da-5caee3d2337b", "comment": "Malware payload", "value": "16805ab2da697c83b09ea1879737558a6e3cd6e448e8b697a4fcaf47a0c5e42e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220104, "uuid": "6da01f93-9bd2-482e-b287-2060023e76d8", "comment": "Malware payload", "value": "c0d4a26a6546d887d4f61c108fe59513f8351b20", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220104, "uuid": "16abfe1a-7652-411d-86a6-327d0d079776", "comment": "Malware payload", "value": "62c96eabc9a63f320bce5f1166e4ed708c2de582ebb659bb41b724ef3ec7b3945dcb23ea34cf8f2ef90066723d864db7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220104, "uuid": "8e8ce376-d7db-4f8e-8893-782842d367fd", "value": "E98302588B9F8D848015ED0EBB22F8AD75106248716973ABAFAD1124EF478D5B2338F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220104, "uuid": "5fe76ec6-d2e1-419f-aa7f-3ae5cd611a59", "value": "1536:jA6P7EGmwH1zVQLQDYflSJXvoDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnj:jAY31zVQnIJXaM25NfuQjMCYNBwltD0C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220104, "uuid": "38e066d6-9e22-4813-ad65-365b91b14ae5", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220104, "uuid": "53ece428-9ade-436d-80d0-3f04239243e1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220104, "uuid": "e39c23c3-b9b6-49a8-b5ca-96763d76212a", "value": "catalog-521034325.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7115d44-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221440, "uuid": "5c7d5b82-4bce-42f0-9f9c-0d2a452bb28f", "comment": "Malware payload", "value": "09f39cf1e1799a396aab830f8e29f456", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221440, "uuid": "a2db3f46-c95b-4a4b-979e-b524c55866ff", "comment": "Malware payload", "value": "1689e2987b4dc0e8b9ebd71884542caf5c0c61f779bd10c3cd1bb9648b38a431", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221440, "uuid": "11b8c294-92a9-4bbe-9b72-f5ca2beb3dea", "comment": "Malware payload", "value": "3d755ce8423f5cf7f51af542ccf3dc73e1fd6e52", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221440, "uuid": "50752e89-47db-4e06-bdca-6f92d287da29", "comment": "Malware payload", "value": "c57a5d95894f4b3ade4f6c3d9625ad266a7ba8c09780d55a511931d14789b219585d90c3f5bd294b117e9f13b19bbc62", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221440, "uuid": "df5df7dc-84da-4407-8758-b3f756e1dcab", "value": "E983024B599828FFE255AF10232CD98AAA0FCEF4D9705514F20BFB5CD0B7B29726041B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221440, "uuid": "74fed91a-2204-435c-9d2c-0dfab90fdd52", "value": "1536:r6sEDF9MwsqZSCzfAkZ8kISNurvd197v7UZoctQ2kPo+4mpRlDi1nUSUqxuul:r65R6wsqZXzfA21s19T7YptKRNpoUSUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221440, "uuid": "44d034de-1a0d-47ed-8136-8444d12ad0c7", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221440, "uuid": "54129194-853c-4286-9037-8db0e19c5229", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221440, "uuid": "b0d54b73-6a18-4d79-9636-d0ac635b93ac", "value": "info-1686814168.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a9fa30c-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217875, "uuid": "9c598588-013e-4706-a0c8-537f3dc8eedd", "comment": "Malware payload", "value": "83cc766e8e070fcc1fbcec8c7b017321", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217875, "uuid": "472d36f9-4215-441c-992f-cb0b8dd6ad0f", "comment": "Malware payload", "value": "16921cacf1b13cddeab9a4a6004a99cc3c4fb79f043e1f347da7161e2795bef6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217875, "uuid": "762ac029-1017-429f-8017-2e6e00e709c1", "comment": "Malware payload", "value": "431f84baacb15da641b63753ee31b87ebf985ecd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217875, "uuid": "de0b32f5-c46b-4f7f-b3d0-c491dbda944e", "comment": "Malware payload", "value": "e80bae24aed7f495c99dd56219dc92b567f3d00dfdb074149c63b86c22930939e6d3de9f7898fe57b6634d1a7367ecfa", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217875, "uuid": "1a822f1c-a899-4c1d-bc69-06b38591abe3", "value": "5B831220DB87DD9CD418E4001968FF980F2AE7626156441BFEB4987B366E82C14C2EF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217875, "uuid": "64ea04cd-113e-4fd1-a075-25e1c172f18b", "value": "1536:Lq6WB7yMfHNwvqBuKXxP8JXvKD2yWxaqQ6Rxt5AB/aqPwL3VbCbd:rMlwvaXxP8JXofm/Qwt+awaxCbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217875, "uuid": "5e34a2df-b934-48c2-a3eb-558cc9af0e1d", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217875, "uuid": "2b29e36c-d2d0-4c15-8395-7f4a09291c45", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217875, "uuid": "45306a7d-7e6d-48d9-a390-4fa7a85111e5", "value": "catalog-1212385212.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce015e7-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220564, "uuid": "f6a1e1c5-7620-4c42-9f63-a7e5a11fc4a3", "comment": "Malware payload", "value": "bdfe174fa5fd2c170fb638656b0bb4e0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220564, "uuid": "0fabf48a-6a7b-4f11-af49-9b1c1846072e", "comment": "Malware payload", "value": "16cfa9cdf530095a789d6c77b9d63285a05803edbc4f38d37724cb2bab35165a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220564, "uuid": "6f4d1e81-8dd0-49f3-9708-229cbc22ee3b", "comment": "Malware payload", "value": "eeaaffb1011ee37eba9a71a83585846c1b2c9cfa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220564, "uuid": "e50f1eff-87ed-40bb-9f92-823bbf517d33", "comment": "Malware payload", "value": "29aab5a19b443fe8c8c08667cdf8dcfd3cb26481a4092b24500212cc4285093a89311cfaa0c6de580672e7398ece974e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220564, "uuid": "eea233fa-cc3a-46ca-a8a4-6756edd654af", "value": "2083121A99BD1CD9C0BB13F00D73094D4860EF6D411C8449F11AA68F789EE85DEB7AE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220564, "uuid": "f2fa3501-921d-42d2-a2e7-51c944dfbe00", "value": "1536:gt1QVGeGAg5dwSp6yMvBjqqxPGLuhCWdHsh1oSFWsfEFhHqLWF:YAG7A8l3MvBjqq5OsZdHAO5hK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220564, "uuid": "bb978554-3e07-46ae-8f09-506de6696639", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220564, "uuid": "fadcb52b-f506-40cd-b448-b844f3a5d0d8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220564, "uuid": "2f9b65f9-f84f-449b-9390-4c7e4102c32d", "value": "info-1244712687.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdfb1a2f-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221881, "uuid": "787d3ef2-c15d-4bca-b18c-ac895baaa269", "comment": "Malware payload", "value": "b0510371ef451d542b135729ecff44f2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221881, "uuid": "52373af4-48da-40d9-a940-a050690030f1", "comment": "Malware payload", "value": "16df73dcf71ce47213f3d1d6342ecc3b4b6b48c496edbd1d063f9a2e3cebca40", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221881, "uuid": "279d1477-b5d1-4197-9a99-c8fb0ab44140", "comment": "Malware payload", "value": "d1070a47e84495d48f91b8c410af02621b27b8a6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221881, "uuid": "bcfe644a-bf07-4367-993b-282adc244d0c", "comment": "Malware payload", "value": "4c042d1f7f07f188922507dc0ad731c64a42d1d609f3bb30c76d848ae5338512f98e77ed95b2b36b86c10f9c75753779", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221881, "uuid": "d6d892b7-49e4-4999-a9ca-2bcca08bfd0a", "value": "CE83024B699828FFE255AF10233CD99AA90FCAF4D9305514F20BFB5CD0B7B29726041B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221881, "uuid": "7db856af-9325-4cce-8781-1eefb94dd764", "value": "1536:R6sEDF9MwsqZSCzfAkZ8kISNurvd197v7UZoctQ2kPo+4mpRlDi1nUSUqxuud:R65R6wsqZXzfA21s19T7YptKRNpoUSUe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221881, "uuid": "78bae6af-5db4-4817-825c-c8022e9dcab0", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221881, "uuid": "51da62aa-be3a-49af-a7d5-17d3e38814cc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221881, "uuid": "8edc5734-eea6-4d60-8493-17b23410fc48", "value": "info-1944410397.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5e4f879-a3fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1619159107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619159107, "uuid": "1bbe4104-53df-4cd0-b5f6-6e08ce6a6955", "comment": "Malware payload (Formbook)", "value": "a25265897eb15a01e83159d193be2da7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619159107, "uuid": "676574ac-788b-44e0-86a9-097fca3d4c99", "comment": "Malware payload (Formbook)", "value": "16eb5e2a64b372f6262ab29c04a835905de88a8be71c2c17a5431dcd5a45e487", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619159107, "uuid": "09526e7c-a2e3-47f1-81a6-1b6e469455d0", "comment": "Malware payload (Formbook)", "value": "a889d708536f80c9820f1190996d29b7cb2965e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619159107, "uuid": "789d580f-fe95-491f-88d7-5e9ba634eaaa", "comment": "Malware payload (Formbook)", "value": "34918b404d64937381de0e15f9a1d15ba105470df457632a93adb2028e956c43c1021911dbac3d88d665e8fb25d3da90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619159107, "uuid": "038a9e31-15ad-42a8-9802-ebea8e88b5f6", "value": "D4158DAC7650B69FC457CD778A642C60EA60B4BB830BD303A46712AD9D4E69FCF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619159107, "uuid": "482467a8-992b-4796-bbfc-8def75eed4ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619159107, "uuid": "dc5a9c15-867a-4165-b438-3549461ea79b", "value": "12288:uAFSoGEbqAtUgNCcoU2+Nun4fStYznzuDGrWo3hHqnI0GZNQgNxop+ZF4S3LrX+m:uAIF8gqomuRWzzuwjsIBQtckVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619159107, "uuid": "cc697ff1-1114-4b07-abf8-97db83e7a9b4", "value": 895488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619159107, "uuid": "e43bb788-2759-4bd0-a4ea-c1a6bb9370b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619159107, "uuid": "cdc0fcc9-5ede-40b9-9d29-99c139844997", "value": "a25265897eb15a01e83159d193be2da7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "850341b7-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222188, "uuid": "e5ed0ba0-eb52-480d-8135-5bd5b02295e1", "comment": "Malware payload", "value": "81a068c358e00c27ee055805fb766cd3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222188, "uuid": "0eb4b47b-df0f-409a-b254-bb5ed3a42930", "comment": "Malware payload", "value": "16f5b372ee7e53b316d450c314824e7463a875a7d0b6ef0fcb98fc2a616db686", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222188, "uuid": "3ac790de-e64b-466f-bcd6-d8713dae6871", "comment": "Malware payload", "value": "d3739679b897b9175eee8adb4094d869ca8e107a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222188, "uuid": "cfa57034-95a0-432c-8b1f-d9f64ab51986", "comment": "Malware payload", "value": "49342c97b3af829bbfdbcb6b4c0d3aa96e6df890dd8a4fc8e2add5a8f0af738383804d568b517a2ead360568e4c82baa", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222188, "uuid": "8bd3d310-be62-4c42-bb13-ad5b6ef386ec", "value": "8B83124D35EDC041E27F7D60536AED5901B86F47EFFF9164CA6961329801863FA0364E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222188, "uuid": "e3c51f52-f68b-46ab-b7af-72a38a98b1aa", "value": "1536:GEwJNfD6jITxi7UnLkb/Yw3LCq1GeOuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzb:GEwzOEliUne/L3LCq4kO6xoKDShicdBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222188, "uuid": "e0e1b387-57b1-47d2-bf1c-099a0790649e", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222188, "uuid": "14edfc0e-18e8-4715-8506-e843c8d5dda5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222188, "uuid": "29b5cdc3-7353-4653-9d6d-42f049a7e4f2", "value": "info-238492383.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f679d4-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218567, "uuid": "5d6b3b78-2763-4ee5-aff7-406e8a1dd162", "comment": "Malware payload", "value": "92d834ce42822c41310191d3731389a7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218567, "uuid": "95c7347d-124c-4c5c-bc98-543070cabbac", "comment": "Malware payload", "value": "172e1b81c619b21ec1d757e03d44587162a4dfb55ce38666433edf572ec90c00", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218567, "uuid": "87e252af-d7b7-4569-8bdf-9618ae4ae7a7", "comment": "Malware payload", "value": "fc4ebefe00f05a562b260c80ac392f1a934194f0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218567, "uuid": "1a335262-5388-4653-b49a-742d1591008e", "comment": "Malware payload", "value": "446de0a8c00eb65e534887ce4d1dcdf7b0ab5d30ac078c2578a38951dc4ce303ac72202060a759b2f25d371c9cb75f40", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218567, "uuid": "d45fd14c-c637-4536-a541-6c5fcf42e2e7", "value": "1E8312A6FDF91BD81C29DC25819AADF1097F8D5D81433378947C34B1290CABE6A026DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218567, "uuid": "7efaf74f-20ab-4232-8a8f-91fc4d063c64", "value": "1536:ZpKLWkP7EBmrk7xQrqQaiwotTqFUAAWB9Te87VqINbtezgVRxr9AiUrQTKXs8FI9:3KLWSUeXvtTqFpe8JqmdIrLjFRby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218567, "uuid": "b648f0da-6986-40e2-ba4f-f140e758070c", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218567, "uuid": "6cbf28a8-a72f-46e1-9824-b6d0df0148c8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218567, "uuid": "cea2a138-0888-496a-813e-b3f684bc971f", "value": "catalog-160309069.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8b322d-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218949, "uuid": "0b42ced6-7230-42e9-b005-ae9ff2402d4b", "comment": "Malware payload", "value": "30343f15e00de856afde8459b751b89d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218949, "uuid": "9186424d-4922-4c30-b306-242d8d2e3659", "comment": "Malware payload", "value": "1734e45194db42e72feeda95613d226dcac8f39b6403f92a30d5150b4150d150", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218949, "uuid": "9a5134ac-c16e-4a65-8a21-cdbd10cf7924", "comment": "Malware payload", "value": "c5f3a30e4579b172972cd6708447e619231d1ca0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218949, "uuid": "9bcc5218-3b58-4931-a390-5d9b8c1c1673", "comment": "Malware payload", "value": "616bc043605266b4d0240c59c56bddccb27333b091fd9208b58a4dabdb48c078efdf8d34d31cc70680f0ffe675d43f40", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218949, "uuid": "1fafbbfb-7f42-4205-bfb0-ec0a307a38f0", "value": "748312599B1B7DA7505F3CF31B322A5ABA03BABE0C0C7096D778C2D0E33951E25642D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218949, "uuid": "94b1a635-4a57-43da-838c-a49c78d3fd93", "value": "1536:J0f1lwtMJDrsPSpV8LS4v5YFGrfZg6kxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGm:4cQ8PjLRv2FKeJ9a03fjwe1moYpob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218949, "uuid": "3e6404dc-dcc1-4dcf-adbf-a734f656f2ab", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218949, "uuid": "5d10c9a0-72e0-4e39-a7c3-cce4fe86b0ce", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218949, "uuid": "fcc3d987-f8ce-452f-b115-81f0c6b4d520", "value": "catalog-1806530554.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf3ed8f-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218067, "uuid": "7890e209-8391-43aa-bad9-70ecd2c93850", "comment": "Malware payload", "value": "62b7a84f9ce1838ed3679cf051d100e0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218067, "uuid": "f67288b2-3acc-4a80-bad4-e9af07ee1273", "comment": "Malware payload", "value": "174408d850cc1c54de3fd6380d85805657921d1258f25dfd1efe15885a5d1abe", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218067, "uuid": "5b8a0ab0-5928-457d-a9dc-43cbff85820d", "comment": "Malware payload", "value": "0f4a790279d4725644dc68044757cd8966c3d500", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218067, "uuid": "1c2e0a94-26d7-435a-b5b9-0d2bdc478ae3", "comment": "Malware payload", "value": "5064283291cb397c5efdb790ba24dbf956c8ff0f9b4c71a5cd79cc84bbaa74d1480cf5f28e526cb1f132bbaf01c2f489", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218067, "uuid": "b6c91f0e-1db7-4d7c-a0dd-f753e65da3bf", "value": "A98312595B1B7DA7501F7CF21B322A5ABA03BABD0C1C7096CB78C2C0E73995F25642D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218067, "uuid": "3f259855-e874-4159-90f1-c271fd63b304", "value": "1536:wf1lwtMJDrsPSpV8LS4v5YFGrfZg6kxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGX1:ycQ8PjLRv2FKeJ9a03fjwe1moYpoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218067, "uuid": "d3c844c0-db3a-4704-bd96-d4e522b718f7", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218067, "uuid": "28a3b422-9552-4565-b738-5cd0892ae303", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218067, "uuid": "ab2b8e0b-8fa0-4836-a359-0a9258f701d6", "value": "catalog-131978710.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b0a10f-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221302, "uuid": "99efdcdd-f167-486c-a905-23f2b7f0b337", "comment": "Malware payload", "value": "f54db4c2464b57e3697f8605302006ca", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221302, "uuid": "1ad0677a-cd23-4074-aea6-1b1519adb140", "comment": "Malware payload", "value": "17c1f6aee62b202a28694c8e09d0e06233768497cc62a4d121adc2dcd32eeb3b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221302, "uuid": "ebf1f1b5-008d-4624-b135-cfaf95ab07e7", "comment": "Malware payload", "value": "39341ece36ef7f620503d5f17cdac78dd77fa05d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221302, "uuid": "156e2689-b8f8-44da-84ff-c73ef0f6bbb4", "comment": "Malware payload", "value": "ae5c76eee7d8c2d79118f3e396c32919687bef9e84557d71f0d4cdf6d3c4552aba2a81b41cce9c31634c844a7d136279", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221302, "uuid": "8d00dcf4-bad9-4fdf-aa4d-f41d69f67e57", "value": "5083029C30FF0144957A68B8613FE80750FCAFDB2D37B74947208574AA114EAA6279AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221302, "uuid": "5024551d-8e29-41e0-9e25-6d0e40ec67e3", "value": "1536:Jyr7l+KI0ejUgUlrZKFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbXYZTa4hpA:Jg7l+NUhlrZ6O6xoKDShicdBMM1/XPQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221302, "uuid": "d44e45f4-59d7-4483-a3a9-e8de5ad998e2", "value": 86795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221302, "uuid": "dacd1707-a6f2-44ee-8da1-21dfa95bd316", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221302, "uuid": "457ee414-989d-4bef-accb-9c01fc537691", "value": "info-160737781.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5182759e-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218665, "uuid": "cbc3ae28-f2de-4d3a-96da-99df9d38e104", "comment": "Malware payload", "value": "f54ec69e7e34e732ca8d3436522c7b55", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218665, "uuid": "e70b9cb6-db67-4aeb-8a53-fa2709923bf4", "comment": "Malware payload", "value": "17c5a607e093181ad7ff4d28581cc0de437405431b80826fce37e18a5f90afbf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218665, "uuid": "367956be-8c84-4af8-8348-edea89c58da3", "comment": "Malware payload", "value": "428fe75949b0f87ba2ab3ebcec7100832ce686ba", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218665, "uuid": "ab4e2334-2a66-4e67-99f0-80ebb2e39bc2", "comment": "Malware payload", "value": "b2a2cdf49983eda8d3edfb1862e9f54b6ae2ea7fb0fe81144885e088e77fc400cd5db1a1db6726bbef1f885957356e7d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218665, "uuid": "a6e6c332-d418-414d-a985-ba93af2f951e", "value": "0B83028BB4D9433ACB3513F65CAE1E4422B1A47F140CC6DC79973B786B53672A572388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218665, "uuid": "b7fe5c41-9fcd-49ae-b284-c226776f0b4e", "value": "1536:KAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJva:KijtuPmU9j7+XFWtYe14hbOjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218665, "uuid": "eb77ed80-4467-4f5f-b5f7-5a246f7f51f8", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218665, "uuid": "30e0949a-295f-4fae-a3cb-a0499c087231", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218665, "uuid": "70d6fdde-3013-4d9f-8704-ed7fef71038d", "value": "catalog-1659990152.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38543e89-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217764, "uuid": "a8b727c5-67f3-41ff-b9e2-a935a8049b16", "comment": "Malware payload", "value": "4aa2b947a4c445c2e5bc567d432f384a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217764, "uuid": "a51d5865-f311-45b2-b956-b04da0d810e7", "comment": "Malware payload", "value": "180a04f6ed08d663080d8b30f5b1007b7eba1a8c5256acb702537a860970778c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217764, "uuid": "766c0765-9e3f-479d-8f2c-7e0af8395a0a", "comment": "Malware payload", "value": "f6f04a47ca1c62ec54f03c7b69d14e51c5ac1d44", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217764, "uuid": "905e2401-44ab-458f-afc1-0f6fc6fc2b4a", "comment": "Malware payload", "value": "def789913af989998435ba91ebae3fb6aa459d45970c3f399f7bf7722552d7d3d1125f48b94b0f3d12650d5eb7de49ed", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217764, "uuid": "66317f74-ea24-4413-8640-c1d661bc73af", "value": "E6830276DE8F8289C016B23003786FA61F286B7146A1141E5BB0743B2F5B9BD4C85FD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217764, "uuid": "bb0e9e08-efe7-49b1-a5b8-1d2ef0554db6", "value": "1536:PEfHCzlWAXdZ2rQD2aCvdyWxaqQ6Rxt5AB/aqPwL3VbCb9:PYCzh2QKmm/Qwt+awaxCb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217764, "uuid": "743fe544-f1d2-436f-ba8a-9f020efe1653", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217764, "uuid": "19971264-d484-40da-8c59-044d4182c0d5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217764, "uuid": "05251ffd-b510-4a9f-ab15-6b947ccb6470", "value": "catalog-1149990232.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67fa5146-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218274, "uuid": "9239ff11-8fe4-41ef-93e2-10c819b86f7f", "comment": "Malware payload", "value": "25c9b7be7c3f90083e2a6553d1736fab", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218274, "uuid": "9ecc6173-8b32-45c7-9a1f-5095904c60cb", "comment": "Malware payload", "value": "18c0d90f661219b4d5b9b71c8af9d719c4c3422404809949221b32cbce25785e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218274, "uuid": "dab137b9-4dc8-43d6-8ba7-3510e89bd5ef", "comment": "Malware payload", "value": "d4fa1b795e673f1d3b1848b723b697f434860e77", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218274, "uuid": "25d8382c-2fb1-4046-9e68-e034d793ef2e", "comment": "Malware payload", "value": "5513ab1fc8f3cd590f2bb8c38d907559d7fe1eda54ded13e4111045e6d5aefc030e5ba71c0136b0740772c9aa9cdeffc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218274, "uuid": "8b4c4dcb-2b2e-45cf-9314-ca54c8038d81", "value": "1D8302467EF90FD81819EC3085174CF90E67CF6EC1872239F268247669486BE7E065EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218274, "uuid": "05fffed3-7ad0-47d9-8ab0-a6d478c9c756", "value": "1536:TEFL2dSRV1UgF68rh4Khs/9qDUAAWB9Te87VqINbtezgVRxr9AiUrQTKXs8FI+br:T+L20RNrhDagDpe8JqmdIrLjFRbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218274, "uuid": "252348b6-ca8a-486c-af81-61a887c8f31f", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218274, "uuid": "e21bc7a4-dbd8-4d1c-94ed-6653dfa01ead", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218274, "uuid": "2962ff5f-c3c8-490a-b67d-dc13c88b4881", "value": "catalog-1421521471.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d05b0c-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222033, "uuid": "05e9ced8-0364-4544-8910-19428d5f00b5", "comment": "Malware payload", "value": "57b303f9c3c2f995edfb71e58854edeb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222033, "uuid": "ae04408f-9ba2-4137-803b-53b8ef80813e", "comment": "Malware payload", "value": "18e215f2ddafb422c6e29f526ae4883564894b2348036cea87e5409a4426fb9a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222033, "uuid": "f5d82c10-5817-4595-ac11-979f329c3fac", "comment": "Malware payload", "value": "3bdf5c8fe737149212b8dbee8d842f4514d89c15", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222033, "uuid": "16bd9639-47bd-4e2b-9ab3-8949db1f0284", "comment": "Malware payload", "value": "5c55bbff713bed4ad65fa23014cfa2e7a4078ed6488d0a0fcbc061c1dc8c84709ff076c45728f7b56348578460e285e9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222033, "uuid": "9a2873c7-345c-43fd-84cf-16cdd4167faf", "value": "EA83121B567F3D98C21DA5E45EB21F6D2D600CE9819C80AD514B64FE21BCDE28E638E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222033, "uuid": "aaf45982-f612-41d2-bf48-cb1dba1a2193", "value": "1536:ytaLgbCL+q1zmW7WPGLuhCWdHsh1oSFWsfEFhHqLWG:yZG+xW7qOsZdHAO5hKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222033, "uuid": "ef47ad0b-ba4c-433c-b318-3816bc06dfc7", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222033, "uuid": "87f19553-e87c-4fa8-9fe7-d4c7ff5ba9cf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222033, "uuid": "cea2fb56-7ac9-4557-93ac-d03de8ce073a", "value": "info-2081289398.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1dd606-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219084, "uuid": "6079f0db-a2d3-4bd2-a136-dc6535f3ea08", "comment": "Malware payload", "value": "7c6bc0e2ca67e7652cc2c7a9d1506d65", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219084, "uuid": "66ed72e4-b15c-4827-b6fe-51285c5ee2c0", "comment": "Malware payload", "value": "1907f8a5e2719d186678014a6e2f3e1df05b8971f42e73e05adc32ae593f5106", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219084, "uuid": "0b0f01f0-e2a4-45ba-a931-d42e09df1e66", "comment": "Malware payload", "value": "0eae9351a387eb1a66a3fa1a4b795713e487dc4a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219084, "uuid": "1261ba2e-a2e6-44de-9c19-5cb2b78b2d84", "comment": "Malware payload", "value": "5ab1c9d067da8b8d9125b6adbcb52d88e88dca9e104f7e6a084453fd6a3ecc0f9a132eeeba336b359b407e2d03d5f5c3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219084, "uuid": "7a388472-cc17-4383-8cee-d3882f597212", "value": "C8830298CB9F8D948015ED0AAB12F8ED75505248706973ABAFAD1124FF478D5B2338F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219084, "uuid": "1c7d3598-046d-4a22-bd8e-d9130389bb25", "value": "1536:OA6P7EGmwH1zVQLQDYflSJXvoDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnr:OAY31zVQnIJXaM25NfuQjMCYNBwltD0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219084, "uuid": "90eceaec-e4ea-4ba2-880f-481a8d7ab36c", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219084, "uuid": "1de0b2fa-9bae-43ac-a85b-c896d7660f8e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219084, "uuid": "ae412567-2eca-4cd5-aeea-fcd1f7255c4c", "value": "catalog-188246733.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e85051d-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218607, "uuid": "ff9b486d-0d45-4b77-96ac-3ba41ff33ad5", "comment": "Malware payload", "value": "1d0d10cc4bb1e4adacdc7afa0b1f6638", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218607, "uuid": "88b580c1-c7c1-4551-9ac3-1b7feddb55ad", "comment": "Malware payload", "value": "19306cdece9514aa41ebadd10ab1e5ff169a0cb9ddf2bf21b5b04ff6e974f70e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218607, "uuid": "96bcc41f-6917-43b1-81d4-130888eba429", "comment": "Malware payload", "value": "d13f0a7d79a310769bc4e22814ff1603bc8900f0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218607, "uuid": "8ba10ee5-fc96-4321-ab18-d08ab2ebce42", "comment": "Malware payload", "value": "b790bee641306a725f1640698407a30c786185298a45a5d765942493a319cfad97bc34f6ac43b76097c8e18e01c20a76", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218607, "uuid": "97fc762a-ba4f-4659-aabd-4bf37f76180e", "value": "1C8302467EF90F9C2C19EC2185574CF50E67CF6EC1872229B268247628486BE7A075EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218607, "uuid": "d98fdada-49c7-4a58-864a-ba4e690e55a8", "value": "1536:WL2dSRV1UgF68rh4Khs/9qDUAAWB9Te87VqINbtezgVRxr9AiUrQTKXs8FI+bq:WL20RNrhDagDpe8JqmdIrLjFRbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218607, "uuid": "b3f68b61-b490-4312-8640-76232463dcfb", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218607, "uuid": "3eea2fee-6268-405b-a7af-d6a932b8d2de", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218607, "uuid": "77ea1f36-3a21-4dfc-a838-db9617682d3d", "value": "catalog-1631823417.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e8c5e90-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219949, "uuid": "ac7e7d26-e713-4587-816a-8195084719b9", "comment": "Malware payload", "value": "ddb12fac3b1974c94e6ad98bfac2c0b2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219949, "uuid": "2c420dc2-bef9-49bd-873f-05c4a0cdc732", "comment": "Malware payload", "value": "19343c849d6170a3b4945f725885e7b17e3784c7f26b0b8ca4634ea80b1ec68b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219949, "uuid": "f49b710b-4d3e-4410-98cc-7e56a78c94ac", "comment": "Malware payload", "value": "370c3a275174dc9e6707b1045c46e35d386fa478", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219949, "uuid": "139f5d06-b067-4b2b-8104-8165b9a9c177", "comment": "Malware payload", "value": "2b684bba477840913346adb3ca4b6c6cc38ac97db458343f64532100a923f71987b36df43cb435e0fd0ae3d216e2e22e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219949, "uuid": "bf668220-de91-4ed8-94da-94a96983e1a1", "value": "DA830232FCBA2BCC5C1DD820D0656DF40A6FCD9A959333B859682D32208D67D6B019EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219949, "uuid": "9e898a51-9d50-494d-b2d7-766ba9d60481", "value": "1536:Ig2sNyMfHfrqQaiwotTqFUAAWB9Te87VqINbtezgVRxr9AiUrQTKXs8FI+ba:mM3XvtTqFpe8JqmdIrLjFRba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219949, "uuid": "aabe64d6-61e7-4807-86f8-f82a5dc7253d", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219949, "uuid": "997a4f46-f5ce-44a1-82bb-3451102ad86f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219949, "uuid": "7d296ebc-c795-4c9a-859e-287cde739da2", "value": "catalog-434049673.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e918bec-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221318, "uuid": "f4fff85d-fa32-41cf-9749-ee3f112637ed", "comment": "Malware payload", "value": "05003916d639c44f64894aa3a13e1292", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221318, "uuid": "c65719fa-1bc8-4908-897f-12cb5ee58765", "comment": "Malware payload", "value": "1947ff7c5185674636c05db0a05f099c5a0fdd1df6c0b3e90a587efddfd9cdf8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221318, "uuid": "dcc21dc2-c8d8-4281-ab53-29c50152a66c", "comment": "Malware payload", "value": "81d881c1418ed9772582f66d609a35188c8e2398", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221318, "uuid": "7b691076-3670-47af-a665-4f5f3fde23bf", "comment": "Malware payload", "value": "941b6c3e745a9ef5d0d81cfa46f3d6e7d14551af585d41a7d9078691ab929d5abf1a0fbd39ccf4ab848eef8a5a8712bb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221318, "uuid": "0560f4f2-b9c9-4f81-b047-1818c99812d8", "value": "2E8312A1A87CA15F638EDB73D0773747E88009E5552C1F9B534222393DB8DEF8827229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221318, "uuid": "a6347795-60bf-41fa-be10-5a85857917b7", "value": "1536:4taLgbb9ZvjL3+xnxv5ZUS8CWb/bLCDxxp/ERd9QnGlRTH7qrelcU:4Z1ZP3+9xv/UHnfLMZERQnGnTHMeD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221318, "uuid": "0f072670-7e93-4f28-8733-3d027bf3007c", "value": 86799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221318, "uuid": "fc3c542e-8edf-4334-b298-fdfe521eed63", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221318, "uuid": "e61f7800-cd88-4984-a7be-59248edd8bab", "value": "info-1616179839.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301eff43-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219039, "uuid": "d6bdce7a-855a-46cd-a16a-91c4ae511e41", "comment": "Malware payload", "value": "44c5c91f12dc20fd47cceed267fbdcfc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219039, "uuid": "00b02f5d-79ea-4add-aea5-f0943a38e937", "comment": "Malware payload", "value": "19acb568be877ca2a603286e0329a7408e368bef675e2fd33eb8600c0c5ac3d6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219039, "uuid": "31183a94-ce44-43d3-9f2f-98a5dd289c5e", "comment": "Malware payload", "value": "c0c55f8b4fec806c19dc9b8c72a84db41ad92b2f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219039, "uuid": "3990fe9e-48cd-40a7-b2c2-61b89a2c8bca", "comment": "Malware payload", "value": "3dfd12720ea4836fd936b136d30cc9cd9221011782f77c1c6a756c881300a2ef87bb6a60dd35f367b655e7ac1daa5af7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219039, "uuid": "110bf147-fbd5-4bd3-9d23-2fad759fd439", "value": "18830254CB9F8D848015ED0ABB22F8ED745062487069737BAFAE1524FF478D9B2728F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219039, "uuid": "2f3e2b92-68cb-4105-a978-406a75eaac8f", "value": "1536:/EXA6P7EGmwH1zVQLQDYflSJXvoDqf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrc:/gAY31zVQnIJXaq25NfuQjMCYNBwltDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219039, "uuid": "07da93b7-78a6-4cbb-8b7a-7ce408a5c291", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219039, "uuid": "7783c1f5-5730-4c7d-af50-9dff34c96fc3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219039, "uuid": "edd3a60f-2512-4d6d-93f9-538af48c6e27", "value": "catalog-1857555258.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d106b628-a484-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217591, "uuid": "54b8b03b-44bb-4d9e-aa84-33b15ecd232b", "comment": "Malware payload", "value": "d7d5f13db3532e0ecf64fd3ff48ee1ca", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217591, "uuid": "52fc7007-9f2d-46b3-8a43-1243cfdd5366", "comment": "Malware payload", "value": "19c16afff52d86de99aed58d2e66e0963d27fd079b92a5dbfd9f6d3c43c93198", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217591, "uuid": "1f8a46c6-0e54-4ea4-8484-354e96c9a40a", "comment": "Malware payload", "value": "241d37e664216b5a371ca728f4f8c0f5e812b30d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217591, "uuid": "f9d685da-a9f2-4b82-8658-6672d8c62882", "comment": "Malware payload", "value": "8e8450ec09255eed2f07fabe610bcacbaeea9568f6f643ce9f22a96f8adea44cd3d19904a2821ad8e3ea12e3bba50a97", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217591, "uuid": "31c9a579-c054-499f-8f22-63a8d794902b", "value": "DE830232D6CB48D9E404E2501595BFA57F6AA762647A0107B878F87F3A6B4BC0C11BD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217591, "uuid": "a95ead58-f504-4f2b-98b2-462df9bcb00a", "value": "1536:UEV2KMwcPGjVWvqBuKXxH23yWxaqQ6Rxt5AB/adPwL3VbCbG:UC2MEGBWvaXxHpm/Qwt+aZaxCbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217591, "uuid": "21ba4b0c-99f5-46b0-b2a3-c788e3cc65a6", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217591, "uuid": "aca92ccc-a5f7-40b5-8dcc-324c517ac300", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217591, "uuid": "435d40b9-6ef2-44d9-9ae9-a3e1132a6324", "value": "catalog-1056656284.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79784ab5-a463-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1619203271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619203271, "uuid": "15e2f84d-b153-4464-a872-46fa5cedc0c1", "comment": "Malware payload (AsyncRAT)", "value": "aad039f52d1b771a48cdf3e4fb72c66c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619203271, "uuid": "fe1d9626-e550-412d-808c-f5d2d92547c9", "comment": "Malware payload (AsyncRAT)", "value": "19c180d9097514b4cc1141d7e22b164a6fa70314abbb74b68cd878aa607df8c0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619203271, "uuid": "9383f8ae-f83f-4ef5-a407-4e12548c01d1", "comment": "Malware payload (AsyncRAT)", "value": "2fef940110b7ffa5592a649aa586de23f4e4a4ce", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619203271, "uuid": "7c0d146c-9608-4004-bcb8-a01ba252c0a4", "comment": "Malware payload (AsyncRAT)", "value": "e0d1bf774924ee4ad5650d13069ee9269200c44640b3f4d8cef51bec386f207bcc7fdbd7886be82660fcc80ff917c482", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619203271, "uuid": "5c148697-8725-46e2-848f-05eb3e6ae3d1", "value": "FA475B217390AF38F07F97394064220497F9BE26D721EE4E7CD6349E5671B82C6A271B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619203271, "uuid": "c0b65d96-2bc3-4f8c-a2a4-5c012fc3718f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619203271, "uuid": "8e49cccc-8ee9-46eb-8e18-470df6020b8c", "value": "24576:lto6aBvNbDSO2aCaRRRRR9wj7YxbxZoeyg0g:HaVlRRRRR9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619203271, "uuid": "90ab38b9-1ead-4c79-a241-a258ebcf72d4", "value": 26214400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619203271, "uuid": "ed38baad-4cd1-4af7-b0fd-2823f9a84a11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619203271, "uuid": "08a7708f-9edd-41ae-8d80-22e2a8e13257", "value": "2fef940110b7ffa5592a649aa586de23f4e4a4ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab8f373-a484-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217446, "uuid": "1fec55da-b620-4b5b-989a-5464e758f7f8", "comment": "Malware payload", "value": "30502b8c33722ffcf4280e67908f176a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217446, "uuid": "6a8677ba-d33f-4dda-9b1c-822ed841fb20", "comment": "Malware payload", "value": "19f0bb788a9ff01d21a8d84ea538d6381f39f045f9aab75dd3eb13a1afb6242a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217446, "uuid": "32b397d7-007e-4863-af3d-3b35285f56d5", "comment": "Malware payload", "value": "296cf84662650586cefd424f556bf402d044f8ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217446, "uuid": "9bdb16a3-be8b-4fbe-9744-ed9fe6b9c6ec", "comment": "Malware payload", "value": "fdf44e1b0e24a0eb428915b17989d206fbb6e1150075ff3b0dc015b588065c4dbfb57275ec1092d37f07812265c33e4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217446, "uuid": "ce1ddc40-984c-4fce-85da-ad7d85c414f9", "value": "508312E347D9289DB167BC2882647F8F59D95B23AF040C4F8AFE0B6B11974AD3690790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217446, "uuid": "f4e4e14b-c872-405c-8da6-ffeba24ade08", "value": "1536:JA2fnBKj0MlbCIZi+nTnfZA6l3SNZzTJAsB0Ic6DMADMt5zC/IDIz10n:xBIZiifrCNBJAIlcAGIz1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217446, "uuid": "1a5ac082-dbd2-42f8-85b1-849f2850254b", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217446, "uuid": "8ac1983e-8514-478e-af95-5c6fceb33737", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217446, "uuid": "192e0d1c-e495-46f7-a068-b8d648d06833", "value": "catalog-1015042431.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f4da34-a484-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217579, "uuid": "b1d2f1d7-1298-450b-ae92-400e5bb376c6", "comment": "Malware payload", "value": "4659f5cb1f00e934f16091c4175fbd12", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217579, "uuid": "a812384b-63b7-44dc-abb4-1dee74292758", "comment": "Malware payload", "value": "1a0c025bdc102dc8af4678ad36f4ef067a0b0ef5a60ce660dc0bfcd351bfa151", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217579, "uuid": "db76eb9b-4cef-4e72-bd38-f76b08657d0f", "comment": "Malware payload", "value": "0e1928847b8b83d7c646e173695f45aedc2f32c3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217579, "uuid": "cb6ccb85-1cb0-4a64-8d45-74c31342dca8", "comment": "Malware payload", "value": "50d90b70eb5e4d292d169cff81b7332cf7822672bb534aee715e70587cd0d42d5a295ef67d51097bdf086efbc326429e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217579, "uuid": "6d1e6900-2205-4187-8ae0-9106ec8926be", "value": "808302CFB4E9433ECB3527B748AE1E046261A43F400886DC75D73BB86B526B36572389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217579, "uuid": "7f43a95a-6235-4cc0-8980-79b417df72fd", "value": "1536:GEwAfNtg2tf2vCapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvx:GHijtt2v7mU9j7+XFWtYe14hbOjp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217579, "uuid": "19093fb3-c26a-4394-869f-bd6eddcc2029", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217579, "uuid": "a6e0bcf8-6781-4655-b24d-72ab0b7237ec", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217579, "uuid": "4bc0bd14-20cd-49aa-a5a9-923dce7b10c9", "value": "catalog-1052621713.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b7559d-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222050, "uuid": "8d2e073a-f61c-4b49-a612-84a06bd91440", "comment": "Malware payload", "value": "fc20ded3d8a121369eb5397eb52f9af4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222050, "uuid": "dbf9ebcf-4699-4607-a714-407490d2e9d8", "comment": "Malware payload", "value": "1a23cae90d15fb111ea8c257acf846e770d238e3ed8c1064abc8d2ad306a6002", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222050, "uuid": "b8c74638-37ac-4c21-a060-07307131c5d6", "comment": "Malware payload", "value": "d1d7bf0b5881cfc7cd1dfeb2140b2aaa02bc544d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222050, "uuid": "eee7e567-9356-45c3-866d-409ce6556c26", "comment": "Malware payload", "value": "da28560de041b41a9800ff42cec94d6aab1cc1d01be28e1b2e8ef0e51f27733ecf44c0535d7905e0cbd1ff4728e7d377", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222050, "uuid": "63ac9850-a6c7-43ce-b2e9-f311b27f9f91", "value": "6C83121B567E3D98C31DA5F45EB21F6D2D600CA9809C80AD514B64FE22BCDE24E638E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222050, "uuid": "61be89dd-fad4-4872-8d7f-d9d74529b78b", "value": "1536:otaLgbCL+q1zmW7WPGLuhCWdHsh1oSFWsfEFhHqLWc:oZG+xW7qOsZdHAO5hK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222050, "uuid": "f47905ef-fb90-4e13-b7cf-e6ec4fdcec23", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222050, "uuid": "c42e2362-6efe-4680-93fb-d441c50fdd0e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222050, "uuid": "c90d744f-f564-49aa-9fd3-f7722c9e59d0", "value": "info-2087781620.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeebbe76-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220540, "uuid": "a256d3b8-8854-45c0-9938-66a8d0279590", "comment": "Malware payload", "value": "a1b4c4d9363b7646f8ade49c42f55ab8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220540, "uuid": "263ea9c9-5deb-45fa-8c2f-439efdea5564", "comment": "Malware payload", "value": "1a53ec301ea6fb43d2f11fb0d7f8a2418df05cfc41f3f8fed4db87d0fede4c03", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220540, "uuid": "203ea4b1-afea-4d52-82c7-855458402359", "comment": "Malware payload", "value": "dae2ab0df082895fef4a997535c46c3b52a2f2b4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220540, "uuid": "a4e5c836-d8ac-45d8-82a9-a205c18d8153", "comment": "Malware payload", "value": "dc55ff493a46f5a92ff2b78e3093f91429449d9c4767b5125d5bf47b8d064b771c7202efb7543d647802afe3c212c791", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220540, "uuid": "3411d87a-e6b3-4156-87ba-2af9837a94b9", "value": "5A83121B567E3DD8C21DA5E45EB31F6D2D600CA9819C80AD514B64FE22BCDE24E638F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220540, "uuid": "0c0820c7-1a39-4d49-9404-c76ebed9a72e", "value": "1536:ItaLgbCL+q1zmW7WPGLuhCWdHsh1oSFWsfEFhHqLWS:IZG+xW7qOsZdHAO5hKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220540, "uuid": "3a693697-1b29-4c48-b13b-d90f6a70833a", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220540, "uuid": "0619ed03-0f0d-44f3-a324-e4fd4a978bde", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220540, "uuid": "b4397dee-5db3-41ec-8280-d7fd160e2c42", "value": "info-1228282512.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f90724fa-a3f0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1619154093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619154093, "uuid": "c4d20f8d-e0f8-4b0d-bc9e-b44d7802f4a2", "comment": "Malware payload (Loki)", "value": "392e869e3782666929ae1ba9b6678dec", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619154093, "uuid": "c83b543c-a66f-4fb3-ae06-6a5b1d261b53", "comment": "Malware payload (Loki)", "value": "1a84c34e4fc3aa5f49d168c46fb88f06aaa77b580008be0e0c4b8f5c4a0974df", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619154093, "uuid": "af18f4b4-65bd-4f6b-aae9-91f15e908256", "comment": "Malware payload (Loki)", "value": "8177777089f9e03fee70a9eeea5d27504297979e", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619154093, "uuid": "fe7ce213-f04a-48e4-a182-1e7fd8f495b0", "comment": "Malware payload (Loki)", "value": "8d4808a1e5970b5968f4942bab1a70650340f2bde5bb09a803c642414c464a2d8f8b8d8d5be0766cb145a2df69d28cbf", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619154093, "uuid": "ff41c8db-848e-43fb-8bdf-eecaa591e28a", "value": "E9C5335D18D6E75AC9ADA430CED2014D417E2FA224644ECA321D3FA5B233F712B8A73D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619154093, "uuid": "c7271f11-c985-4688-9111-30784375a151", "value": "49152:HQ26WS5gSHYJY8M/Lks7kl6YBdV+H2+Eo8tr3s3SYMGik+16xKvS+B3qdlSH51WH:H367gSl8M/N7kl5dEH2Ftr6SYMGv+4D1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619154093, "uuid": "39674845-b517-4e71-9ffd-c287f559548b", "value": 2682880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619154093, "uuid": "4f71f209-b020-47c3-902c-af7d2500b86e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619154093, "uuid": "36a6edde-55e3-4b3e-936e-3939cea51c93", "value": "Shipping-Documents.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d84697-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222022, "uuid": "36659750-4a73-4313-8eda-7be777987735", "comment": "Malware payload", "value": "5e89185f3c998d27a9814784fdec0f39", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222022, "uuid": "977d6a63-9b63-4936-8c67-c98da2374248", "comment": "Malware payload", "value": "1a93cbfd271b4a9abf091f1085f67963a9de380d5195d733b9d6091f258fea7e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222022, "uuid": "e66d290c-482b-4742-a9c0-5aa40344ee46", "comment": "Malware payload", "value": "c571077b4cc7f6297813df5a32c7c653ad858648", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222022, "uuid": "3f33b84b-de9f-4c44-af6d-54d0bcd0fee8", "comment": "Malware payload", "value": "e63ce8c436a388e5fc55ef8dd2d5edf1b4fb46ad7b1681c2702a793df8b25887fef314f3fbbce427ae96a130b1c75128", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222022, "uuid": "a45e2743-f1e7-45b8-9763-9813342e1dc9", "value": "7483024B598828FFE295AF10232CD98AA50FCEF4D9715514F20BFB5CD0B7B29726041B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222022, "uuid": "504f114a-8aab-4250-8ad4-ef7e0b4b9521", "value": "1536:hM6sEDF9MwsqZSCzfAkZ8kISNurvd197v7UZoctQ2kPo+4mpRlDi1nUSUqxuup9:+65R6wsqZXzfA21s19T7YptKRNpoUSU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222022, "uuid": "4dc59948-c0ed-477e-8109-a43863f85025", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222022, "uuid": "9b3e63a8-81d8-497f-846f-6b8838aae695", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222022, "uuid": "2282c581-88d2-4d1d-9297-9f8f583ff091", "value": "info-2066781861.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c8db33b-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219087, "uuid": "4babc66b-d60c-4bc2-87a5-371375b40105", "comment": "Malware payload", "value": "64df09d96d2bc341ad3e4fc79e5b4e63", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219087, "uuid": "6b09b75c-7687-4133-ae1a-ae1a08fbb6a0", "comment": "Malware payload", "value": "1aa76b1a72fc0d3c20ca63c98777eb80b83514ff31e2dc7d9c397f358c476b44", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219087, "uuid": "25745f0e-3510-4fd2-8256-12555f698f43", "comment": "Malware payload", "value": "dd01ba18ed01ed1fc338ce6e27758d1b3af722bd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219087, "uuid": "902e8852-71d4-49a4-b517-6ccac6e246e0", "comment": "Malware payload", "value": "abd8c62ae8c510c453d513985158038a7ef2716b11f903ba7191184a3c740ea5c1fabbbabbd74c18aa126f907ba7e506", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219087, "uuid": "6141e49b-f903-4729-9926-38b6753a6d65", "value": "4C830217FB8666628066E9F25B3A3B1E6A8379DD785471A64FBC03C0F53614E1CE81C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219087, "uuid": "bfc18d72-5771-461d-a0bc-56f9874d0b05", "value": "1536:Tqmy0pi0wcMlbCUN4gCQZiwotTCWxxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZ1:fy0pgGUNEvtTCWzJ9a03fjwe1moYpou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219087, "uuid": "9246542f-c2c0-4d5a-899b-bf8af3c9ea8c", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219087, "uuid": "08286fde-4f48-47db-987f-bb7890cec56d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219087, "uuid": "a4655f24-e5d6-4ca3-a65b-0d761bd906e1", "value": "catalog-1882901249.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "107f4dc9-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217697, "uuid": "1247bf3f-3760-43fd-b292-16e74ee3737c", "comment": "Malware payload", "value": "ded687c82d5d66bb1b0cad298b3c71ee", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217697, "uuid": "3849346b-6a67-4c7b-b42b-081ab97bf855", "comment": "Malware payload", "value": "1ab0aac65c872bc176fc8acd790790ab3eda99fffae25b6223eab3afeff2dc4e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217697, "uuid": "fdeb44fb-0918-44cb-997b-b670787e31e6", "comment": "Malware payload", "value": "c09f619e12e643f75d370e3bd8ce26bf6b95ac84", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217697, "uuid": "7fa9a615-b8ee-410b-b981-8f21e90f37ba", "comment": "Malware payload", "value": "a70bf4636056cf6987a7af82569e55804114d909df806e001ce31e08a8b9663e3b6ada214ee2bdecdaef0b0fd2637e82", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217697, "uuid": "0a874b30-279d-48b8-806a-457868eb76aa", "value": "B68302229ACB54E9D814E2200464BB942F75A7A2913A4107E9FCF97F3F6B46C0845EF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217697, "uuid": "5d70b1bd-3f4d-4561-9af2-3e52742fa9c8", "value": "1536:bERIn2hxBsvqBuKXxP23yWxaqQ6Rxt5AB/adPwL3VbCba:bmI2hxBsvaXxPpm/Qwt+aZaxCba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217697, "uuid": "cfd76f39-124c-4a9b-8ed3-2f896204f373", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217697, "uuid": "4cad2347-6162-4755-b7b8-78c4e811d508", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217697, "uuid": "2c8a0e0d-e135-4a15-93d4-5123d72220c5", "value": "catalog-1107785971.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e41f18-a484-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217596, "uuid": "bdb983e9-a7a6-4d9e-a695-1f4d03208bdb", "comment": "Malware payload", "value": "e6150a5c79463758dbf989aa11c390c5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217596, "uuid": "76e78b7b-a89a-4c36-99e9-901d9fc3dea5", "comment": "Malware payload", "value": "1aca7a90f71889b1f42fb792dc73ef366c9ba125b9d25b90bc2cbcaf876f44e9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217596, "uuid": "d72e22ff-73ad-4c29-8eaf-72b8c59b89b2", "comment": "Malware payload", "value": "97b6a0e38be50e7a4e670704a1f0602de31f449e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217596, "uuid": "46ad8310-4970-4e1a-b545-8570208d89f3", "comment": "Malware payload", "value": "fae4d6b585d9b00029b4db417bd19701e24a66cf27800d55e70b6b05f6c35e48863748a63d99b9bb79d9314f967d0be8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217596, "uuid": "039e7162-ab01-49ff-8de6-3da409c1c4be", "value": "2583125D5B1B6DA7505F3CF21B322A5ABA03BABD0C1C7096CB38C2C0E739A5E25641D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217596, "uuid": "185b2df3-3a71-4d44-a830-d1f0eea6509f", "value": "1536:bf1lwtMJDrsPSpV8LS4v5YFGrfZg6kxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXP:TcQ8PjLRv2FKeJ9a03fjwe1moYpoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217596, "uuid": "0285a6d2-6ef0-4796-a6e1-224308f2ea43", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217596, "uuid": "1f846afa-d710-43f5-8bc9-54a50fe1de25", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217596, "uuid": "0a4fc5a9-7f83-4d5e-ad73-6a7411faa31c", "value": "catalog-1057695021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4a2f9a-a449-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619192218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619192218, "uuid": "597772b4-1cf2-4f1a-8f0f-1e7899809778", "comment": "Malware payload", "value": "7146caf79122b3bf0b837af8b9a23387", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619192218, "uuid": "2c362614-3a0f-489b-99b9-f5672d359ef8", "comment": "Malware payload", "value": "1acb63ebb46a7caf6d88e2a9440010e4fb3188d7919d979b5e54f2faea309547", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619192218, "uuid": "46f052a3-0101-4730-9bd6-1ccecae6a16b", "comment": "Malware payload", "value": "02c5888b2f90c0ed07f1a71e6ffcce56d8c15838", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619192218, "uuid": "e1eea0b6-64d5-4077-b16f-1ba9c533f079", "comment": "Malware payload", "value": "92f3b2d486912d31516fb69f88ddbd73d7d81a39185ce59e48f84ecf6ade2170ce85a58805c790acf3e190e45e25f606", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619192218, "uuid": "2558374f-a18d-483b-8bed-e8ae238b9cfd", "value": "FA95BFF876047CE6666F576BDA96ADDC13762633DACBA4CC40A4B7C305A3361EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619192218, "uuid": "9d2be3c1-8514-4332-bfaf-2fc33efd0d27", "value": "24576:Qq7PUZoaC6tBuA8D6COX+qOW3P9lsR/Mfwz76+Es6P5az+vTi+9Nxkc/qdykCVDu:fAZ14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619192218, "uuid": "7d637636-b1bf-453f-83ae-95be5010830e", "value": 2020297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619192218, "uuid": "ff63d759-ea51-49f7-9634-43e473fbfc47", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619192218, "uuid": "525bf0aa-1eab-47f0-9ed7-ba166b7bf0f9", "value": "payment.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c40b3abc-a41c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619172902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619172902, "uuid": "9a5c50aa-58cf-4f5f-bf56-a9a26de22c76", "comment": "Malware payload", "value": "df048d7e308dddcf7a09de98637f437f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619172902, "uuid": "480f44e6-7e45-494d-ab88-42e9f5e82de5", "comment": "Malware payload", "value": "1aec808dc691fee0bf8de862cb088f97f3ab637fb7746668f04fe25798955c8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619172902, "uuid": "63a03165-be90-4306-98f9-141dc3ff0c72", "comment": "Malware payload", "value": "b83f7a9ea14de573e160b837b41fc8c59549ed46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619172902, "uuid": "ebbfd404-c3f1-4a46-8285-9afbd5dfa7ae", "comment": "Malware payload", "value": "b6de9f110061e7ee9d34188fd835b8415dea8075a5d225d1277399126fc2ca9aa9107971893e3b8b33f1063e9161e448", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619172902, "uuid": "df0fca43-ae31-4f46-ae83-547f80bb50e3", "value": "77F2D0FF4397F93CC2B3147550BAD9C0FD5AF066E0291F160D8821A96EF29A55530E36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619172902, "uuid": "b5cf2b87-a0a6-4282-9819-d72e30f5d93b", "value": "768:+XHm1e/IalsxwOlrn/pn/voS6ZLHrhyzh4XE15PY9sv9sPx:+XxsxNrnxVwIAS5nFux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619172902, "uuid": "110f7319-adc8-45ba-95a0-45a58a71b7e4", "value": 34720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619172902, "uuid": "9a0687b2-93ad-4710-b91c-4bc6621b3ad1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619172902, "uuid": "7e6433ae-a009-42d5-a51c-1e0672d668d3", "value": "X86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e930708c-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219779, "uuid": "d32853c0-95f0-43e9-ac99-8f601c0eed9d", "comment": "Malware payload", "value": "2ac133adb8384e289ddea75cd2a7750c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219779, "uuid": "f9cf9266-e7ee-4e8b-be6a-99ec6c9ef8b5", "comment": "Malware payload", "value": "1af229c6c3d87fb2b6f83c049b5df0599f29bcc63fade1258e7703b41fa0b9a7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219779, "uuid": "e565146b-73ce-40ff-951e-4c611a48b0c6", "comment": "Malware payload", "value": "0d5a829ff14879c8477ffe08dd90aa6bc15960ee", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219779, "uuid": "e42382fa-268c-46cf-8c8c-dd657ee16261", "comment": "Malware payload", "value": "d9d48bababe5a50d6ace4853ab45a66892b956c9bfd693066509a74fa0c76f11338ddd2f61e4f910527e6b808a26c676", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219779, "uuid": "a050ca66-af7e-4d7c-8fa0-5b0a6dee408e", "value": "88831220CB87DD9CD418E4001868FF984F2AE7626156481BFDB49C7B366E82C14C2EF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219779, "uuid": "79a946bf-1f4a-4f31-a1a4-45aa29108676", "value": "1536:pq6WB7yMfHNwvqBuKXxP8JXvKD2yWxaqQ6Rxt5AB/aqPwL3VbCbU:RMlwvaXxP8JXofm/Qwt+awaxCbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219779, "uuid": "95c2997f-5edf-4cc0-8238-ab2e39340be3", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219779, "uuid": "670269eb-8a1c-4801-9ea8-b3523a243b2c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219779, "uuid": "3d137f6e-ebba-4724-ba63-962f0cbb8cab", "value": "catalog-330068183.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4423ea1-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219288, "uuid": "3df44787-6688-4bca-a6e2-2c976b6cfefc", "comment": "Malware payload", "value": "969df1f7c6eb9831d6e68ad655795faf", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219288, "uuid": "9c0e9225-959c-4f49-bc17-4c2a3ab7400d", "comment": "Malware payload", "value": "1aff855e9dcff7ee055a58a9b3bb72345ac403378a3b3e921bd5b7f7199bc1a2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219288, "uuid": "9fae70a2-588c-4a07-b92d-9468f63baac2", "comment": "Malware payload", "value": "901435cf3e0e247d29a497500b65dbab57951c83", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219288, "uuid": "a329051a-6a51-4786-9bbb-190285f6bed3", "comment": "Malware payload", "value": "f76c638647f263db4b764723debac4f0fc4b539922e7c449a8cfbc56d358bf370647f0d66f8862fe194ec528530672ab", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219288, "uuid": "f6354b76-10de-475b-91bd-8bf78ad98878", "value": "29830268CB9F8D948005ED0ABB12F8ED75505248716973ABAFAD1124FF478D5B2338F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219288, "uuid": "508fe918-6794-4710-b340-0c1196d79143", "value": "1536:zA6P7EGmwH1zVQLQDYflSJXvoDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnK:zAY31zVQnIJXaM25NfuQjMCYNBwltD0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219288, "uuid": "7c4bd4cf-d409-444c-96f4-7c79d303eed2", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219288, "uuid": "4c8ef5ce-cfd5-48d7-913e-dd7f9812b1ec", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219288, "uuid": "c70d0be4-4a2f-48ce-82f6-76124a938e24", "value": "catalog-1987577169.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f0789b-a477-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1619211855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619211855, "uuid": "d062066f-3603-46b7-a3c9-c211ba779f7b", "comment": "Malware payload (AveMariaRAT)", "value": "9a89565b71206c021451ed091c5ffc9a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619211855, "uuid": "a6577fa0-4823-4a20-ab8d-0325e21adaa8", "comment": "Malware payload (AveMariaRAT)", "value": "1b05f9ca3ce96cceff4d08bdadad2adf107ad69101c070e7b9034e514956ec11", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619211855, "uuid": "9845f79d-fc4c-4655-8a17-0fc108feb9c1", "comment": "Malware payload (AveMariaRAT)", "value": "5a87dfc3dd63b54fe6918f7654a9cb480ea3271e", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619211855, "uuid": "3c41f5ac-fa66-4d2a-bff5-8546ad984d98", "comment": "Malware payload (AveMariaRAT)", "value": "80781dd324c4e8b5a22f1bbfae217b5ba50acffe25e1a2216668e770c5d66a6f4c2d559699f7c9f05d1ee37627d71d04", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619211855, "uuid": "3279339d-aaa1-4208-b129-0bb0e386151e", "value": "1FC4E132271CAFF5E57EA73E1025040403F9F515E312EB8ABEAC40C99997F825773A59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619211855, "uuid": "c0c7be29-fd18-4ebd-b768-067e193e039c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619211855, "uuid": "ee047969-f7bc-4521-ba28-1252978ae1e3", "value": "12288:giozHjPz9UWkzhpEctj/Jrc/SYR7dCJ7K5o9fPJPD:KZkp1dJruNU7KWxl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619211855, "uuid": "daa9e1ac-e616-40c9-b992-676b06e3caf5", "value": 545280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619211855, "uuid": "1eacb9df-16e7-4715-8da1-dcafdbedef99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619211855, "uuid": "5ba9a5b5-61bc-4ed5-93af-403419b33b78", "value": "Unconfirmed PO-Evora-376628.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef4eaf94-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221078, "uuid": "25dd88a2-71c0-41e0-aaff-522a768b8dde", "comment": "Malware payload", "value": "a3ec1bc6dd616fd636d033c6541ad187", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221078, "uuid": "fab90b94-9e3e-4d60-bfa7-421861df1fc1", "comment": "Malware payload", "value": "1b0ed2af16db112bbddf04274ee54052950214b9a9742a517e0685443a9460dc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221078, "uuid": "81ab5c8b-35d9-4522-b2b5-d247defd1c3d", "comment": "Malware payload", "value": "a20941406046bdab959f463b85ad3d32385c994a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221078, "uuid": "7ebe961f-860a-425a-ad2c-0e2efb2ccb70", "comment": "Malware payload", "value": "e0a09f597fb11076477d8a771f1c5255c0ca0693f265fe515f26505bd270ee33cc356d4eb3c5bca9100cd6d9703d5d91", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221078, "uuid": "e749683a-372c-4a73-844e-d7aedcd7af46", "value": "8883126C1C0AE29FF985FE9357EC31981FC81373E1BA0399495E22327262A3DF5551C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221078, "uuid": "b0af2eb7-7e70-4590-95dc-7d13d4a6bd36", "value": "1536:oNZdYv9b/Yw3LCq1GeOClTJkv9c/EWd8E//nfYRq1o+VCQHeWnsUWuopyV:eUJ/L3LCq4MVJklMdT//gRL+VbARy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221078, "uuid": "eac86ca3-da69-4f73-abf1-1b219711a6e7", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221078, "uuid": "d127f9c3-7ccf-45e1-b4c8-15cd4b44f560", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221078, "uuid": "0955f4b8-c05a-40c1-a04c-08e8f4102101", "value": "info-1479209200.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6888a55-a41a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619171993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619171993, "uuid": "7e362594-009d-40f2-9022-7b7c97eabeab", "comment": "Malware payload", "value": "4e2f8c88f870d9f8f301596d0641573e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619171993, "uuid": "470e38a1-5c9d-403d-8839-a7b977c0043c", "comment": "Malware payload", "value": "1b1b5e2fc8f140b02fc6afe5b8e3f109c4285e666bb67e1496ea1ec8b632e4de", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619171993, "uuid": "dbfcb387-a3f4-439c-82a6-cac993831e98", "comment": "Malware payload", "value": "0dd4c59f0a554e9176b43b6998de35f5a2f8ca6f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619171993, "uuid": "49fe3667-719e-45a6-9902-d9cd642546d6", "comment": "Malware payload", "value": "f9aa1ced4c70249355b7eb73e631dba4110093d8b8d728cff861b326bb46167f54bf888ab6baddc9a3deb3bb3a10c0b6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619171993, "uuid": "0fc4a5b9-d15b-4b94-bcc9-3672efdf6613", "value": "E7E4E01E65906910F5AC7BFBC9E5A411B37AEC125643C36E48F17B6C98B27A7CC0160F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619171993, "uuid": "61366205-8241-4de9-94db-2e724f3261f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619171993, "uuid": "416df88a-aba5-4ace-ae64-e104cf0c3438", "value": "12288:X6Ny5uH755TRWULdEcCqL47kF1INhUuQp8OXOli2R02tpY9pp1ohmzRRRRRJ0:KpV1114QF6hdQQS2PYDYCRRRRRJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619171993, "uuid": "2839a654-d5f3-4cdf-a329-73e74e715efc", "value": 693248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619171993, "uuid": "a1c7d923-7656-4d6d-ba2c-e9e6e49ef723", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619171993, "uuid": "937f0a24-a4bb-4866-b44b-913e1f0a8ad6", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ceb77a7-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219973, "uuid": "6cb9b1c0-c0ad-47e7-9fe8-496673eeef97", "comment": "Malware payload", "value": "3e0320032093dbb7ff565ab699b9f1ed", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219973, "uuid": "058d80f9-d366-4a08-ba69-cdeba9c3ec50", "comment": "Malware payload", "value": "1b20815da85b35fcbefa49bc9219b15073af33ffab37b6ec6b77ecaf6c2462cc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219973, "uuid": "57204d89-ef77-431e-80b2-2f150ac8592e", "comment": "Malware payload", "value": "b2c7af38e82aa47741b108de066bbfd28deeca66", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219973, "uuid": "91d8dd02-83cb-4aa4-a2de-8177a15e6764", "comment": "Malware payload", "value": "dc235fce5c0aed56de73fbef05cf2e6123279a110a91199241bfe736dadddeeddd6f74ed541894261d6d05745a617bb0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219973, "uuid": "fbd67837-6f13-4b82-b16f-82470bd229d6", "value": "278302EC70238A66637341A6DD7E90D33B6BDBBC441DB096A82B693649307FFE121531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219973, "uuid": "05ec282b-c687-4d12-b1f3-0eff01909d72", "value": "1536:+zKTWDE4Qgl8LS4v50FC+p7UjoB8+wXdpUna5ahL2dmTLUVVvf:+eKDPKLRvaFjp7uXinakEmEVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219973, "uuid": "50af19a5-4d4f-46a5-bd9c-319f44e5a202", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219973, "uuid": "560e0b0e-170a-485b-bdee-00de97dd7afb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219973, "uuid": "99168eb1-c51f-44e4-9326-f30e2ae3d5a9", "value": "catalog-442066694.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a278936-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219620, "uuid": "a6d916be-9076-4f92-8f8c-25d03e493400", "comment": "Malware payload", "value": "1871f7af6edfb3cb4b6de7976c282c1f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219620, "uuid": "c8bbd103-0a19-4c03-b4b5-aff44b94c269", "comment": "Malware payload", "value": "1b3518571b54218938d512e2dc47c894801548b9eb554a4759ddd434e047bf98", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219620, "uuid": "f2e18c41-5f84-451c-8c9d-15cf62271d42", "comment": "Malware payload", "value": "6be6f93a50b201f1f8021883efee45fa9316f541", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219620, "uuid": "f980a625-cf92-4ec7-b48a-d12fddca5bfd", "comment": "Malware payload", "value": "168a8ee8a834c226d442619c345f2ea2d8317a159c28dd0058d0cb1553c2093a2c68c1bf4d453892de528dc604a4f5fa", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219620, "uuid": "c067c5bb-058e-4fe5-9d47-76beb7739355", "value": "76831277B6752DFC5922E930E128EB5E39FE2F43B164445DC67C143351422EE3E942A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219620, "uuid": "724b7ba5-22fa-493e-9242-7164bc722ecc", "value": "1536:V6eaAK6Vo+OWNqQaiwotTqFUAAWBO3SNZzTJAsB0Ic6DMADMt5zC/IDIz10k:0VAPobWxvtTqFKCNBJAIlcAGIz1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219620, "uuid": "b8db7f0f-5683-4a45-8ce9-4da77eb1873d", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219620, "uuid": "48b85871-6903-49e8-bccd-c0e3171df894", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219620, "uuid": "5a36429c-63c0-4592-98ae-43f548288fef", "value": "catalog-239660493.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7503f2fb-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220014, "uuid": "cc466319-e6b2-4e6b-a9d8-60dbb9a7c767", "comment": "Malware payload", "value": "7c2cdf2c80a236f158f2a598e2a000d2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220014, "uuid": "b6d0bec5-16c0-4471-b9c5-c8d52072e3db", "comment": "Malware payload", "value": "1b4415b670c9a1569b43df5c31c9ef90a20818800cc5f27fc1ac3dde9ccb4083", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220014, "uuid": "5d893ccc-8db9-4780-b9b9-aebde208456e", "comment": "Malware payload", "value": "1d26d46d109e907a20cda5b67898bff9d9ea49e6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220014, "uuid": "85249af9-1998-4cff-8b2d-45df5e19c0f6", "comment": "Malware payload", "value": "05c2c01b31be000f0dc4e08d42e60595d56e0d0592c5c0fe1d99fe987b9b4898b362263ebc965de9e09b9feacc9bb97b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220014, "uuid": "6e1f77a6-457a-4dba-ae0e-622ebc038ebd", "value": "9B830276DE8F8289C016B23003787EAA1F286B7146A1141E5BB0747B2F5B9BD4C85FD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220014, "uuid": "1ec603c3-95c3-4f64-a673-d4ca22d23bdd", "value": "1536:QE5HCzlWAXdZ2rQD2aCvdyWxaqQ6Rxt5AB/aqPwL3VbCbf:QaCzh2QKmm/Qwt+awaxCbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220014, "uuid": "11886425-4da2-47c8-8117-916ff738712a", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220014, "uuid": "2e7ce39f-918d-4322-af00-641a48cbbd45", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220014, "uuid": "8da01449-ebb0-4bbe-9357-cb3fdce8e12a", "value": "catalog-466444978.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6d7fd21-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222245, "uuid": "5240e079-e31c-4f47-bbd8-36f2c029b2e3", "comment": "Malware payload", "value": "fe24d5aca3a5eac4ace2a71527c06722", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222245, "uuid": "6ce3a46e-dffe-4f54-8ef7-a8022358ccca", "comment": "Malware payload", "value": "1b46ff99434dd6e05f305d176d03190a61a3ff973f557ebb4f9fc658f8dd7650", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222245, "uuid": "63d21f10-c4a0-4936-a1a3-d84cc8069e46", "comment": "Malware payload", "value": "e5cdee505ca826683d6c0736444427ce910c5653", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222245, "uuid": "4235b649-cc84-4bba-9f2c-66b10c17dd41", "comment": "Malware payload", "value": "6d0d555e8426023ad44a3af0d93c9ce06eea4104e8399fa5c9dce5998c0a2c0c08d19413e0643d68b62a977e3b245ac9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222245, "uuid": "0e8fadb1-32dc-42f6-a489-a5998e2d7d06", "value": "AB83124D35EDC040E27F7D60536AAD5901B86F4BEFFF9264CA6961329801863FA0368F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222245, "uuid": "e0cf5b8c-424d-496b-9a91-2962f85391e4", "value": "1536:pxwJNfD6jITxi7UnLkb/Yw3LCq1GeOuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzb:pxwzOEliUne/L3LCq4kO6xoKDShicdB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222245, "uuid": "cc1f0291-f229-4b29-a5c0-0a0147e089df", "value": 86795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222245, "uuid": "fd54c59a-a449-4276-80f3-fcfb55aec3d2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222245, "uuid": "af0e9cf9-bca4-4677-a07e-4a5b96f9e8a9", "value": "info-275999869.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c8fdf1-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217814, "uuid": "d237a82f-a844-4573-b977-573cee4c6dd1", "comment": "Malware payload", "value": "44843d478b6ac3c574ef36556a8c3cf4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217814, "uuid": "e95a0800-ba2a-4bc4-a891-0d40bcfdc184", "comment": "Malware payload", "value": "1b7365b0084eee1fdae63e1bcdc28e832384e1533a835dc472244807c6cbf6ae", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217814, "uuid": "68d70948-5ec4-43b7-8f33-da41385765b1", "comment": "Malware payload", "value": "23d9955b61349313960019c3cef237906e4ddcd8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217814, "uuid": "b8235081-c893-406e-adcc-c69c674b4360", "comment": "Malware payload", "value": "2dfde8e2c32261a06051a801ba97a6698c90665ba4321021347504d34b5f9b7f639263bfa591d773f5790ea718255813", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217814, "uuid": "b5cdfd2b-6a7e-4d88-900e-b36b01efbfdf", "value": "EC831277DE87624EC102723013782FE64B2C6B325A61150A1770747F2B6B9698CC6FD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217814, "uuid": "0e482560-3383-431b-bc29-f5dbbcb8a373", "value": "1536:PuxWAXdZ2rQD2aCvdyWxaqQ6Rxt5AB/aqPwL3VbCbm:PA2QKmm/Qwt+awaxCbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217814, "uuid": "e3020f95-bf8c-487f-a4e9-00a17d3116c2", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217814, "uuid": "200d8e8c-e7ad-45e5-8dc0-a715167955be", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217814, "uuid": "9c510df9-c1f4-47b3-8ff9-a881f161a14e", "value": "catalog-1178975991.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad025326-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218819, "uuid": "72fa10c6-06d0-4251-97db-ed25010387f8", "comment": "Malware payload", "value": "9b9c5ec7adbfcbac34d194dbcbcb962b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218819, "uuid": "5ce4f259-c322-4cf3-af05-9be77a08ff0a", "comment": "Malware payload", "value": "1b75a0ca160cd8418e4b8a84af5976de5f8e2229bd17059ab4fc17bbde3f6629", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218819, "uuid": "1d4300de-0036-46c8-83f0-bae3d454e6f3", "comment": "Malware payload", "value": "d30a1ca0a8e43fd8ecaae4a3a5eb1b7029ade643", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218819, "uuid": "cb710d27-3865-4522-8a52-b06513b1ef8e", "comment": "Malware payload", "value": "756c84f1f7e6b10d91fbe24e79f749d644f5a05b71c74b777b584dc35dc438d5417166690d6ccc4cfd1341046fe19456", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218819, "uuid": "053d9f59-094a-4586-969e-11f6bdbaa7c3", "value": "1583128BF4E8471C4D3556E39C9E2E8446D0903E090457ADF6BB3E34FB9A923D1A7788", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218819, "uuid": "20d0b652-a9da-482d-8d1f-44c94e0df0ec", "value": "1536:iLnoDc3g4MFD7flMonVadrj7ZIXFWgKilkAq14HE6M5XLTl92VyqJvb:iLkpBU9j7+XFWtYe14h2OjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218819, "uuid": "51534be0-7708-4699-abba-850e51a1cb02", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218819, "uuid": "e1727551-d9e9-4311-8197-1d2490fa15d4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218819, "uuid": "99c40566-941c-4491-87f3-d515db52a102", "value": "catalog-1726328778.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "789edd0f-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221738, "uuid": "7c18dc60-486a-4317-a888-7f69c61f8abd", "comment": "Malware payload", "value": "2f4b1d8e48c528a66671c8cf396e123c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221738, "uuid": "1704f0d7-ea03-41d6-b5c9-cfbef418a6c3", "comment": "Malware payload", "value": "1b8ff57f41f7a28421ff42bb775bca5ceb68da9cd48747e8d832b394398776c0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221738, "uuid": "1e633119-eaa9-4574-b1f9-7a92a4e164d2", "comment": "Malware payload", "value": "80b9374230ccab2015832daf2c63b4e791136802", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221738, "uuid": "95d53a2e-b2e8-4853-b475-e022d183493b", "comment": "Malware payload", "value": "e0f26c4fab741645b1c824944413bf69febadc5d6af4bbbce5548c1c8e6f7967fb75351a1d78ae7507eff8501a3d93bc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221738, "uuid": "c03610a7-f23b-40be-acbd-cfb63384e1f1", "value": "CC83121B967E3D98C21DA5E45EB31F6D2D600CA9819C80ED514B64FE21BCDE28D638E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221738, "uuid": "a404da1b-8b66-4a93-9c11-cf92b6c8a420", "value": "1536:XStaLgbCL+q1zmW7WPGLuhCWdHsh1oSFWsfEFhHqLWv:XSZG+xW7qOsZdHAO5hKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221738, "uuid": "722c8500-856a-429d-87f3-bc5563a36383", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221738, "uuid": "f47dd7f3-a599-4925-8ed4-cec0707eaf28", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221738, "uuid": "8b3baa69-18b4-45c8-bdd7-5dac8c1adf1b", "value": "info-184898882.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b71cf72-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221608, "uuid": "6f3203cd-a9ae-45fb-bc07-9da5ba65f299", "comment": "Malware payload", "value": "b1c785ccc20a7b4cd6c2741e9c4e6605", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221608, "uuid": "a6c9d95b-37ea-4211-92c0-9c470b47daab", "comment": "Malware payload", "value": "1b9061e9ba52b2f36d16bf75818b4f7385c19add3d86b60ac9b5fca910f36139", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221608, "uuid": "2ba52c99-fa8b-496a-9798-a87c0c5e2a21", "comment": "Malware payload", "value": "a338f23d703e11b545b9cd51fd2824d187e095fb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221608, "uuid": "6f4852ff-8e8f-40ef-bf6b-98043e218139", "comment": "Malware payload", "value": "2fdf3080b52d10852445f752717f66aca89372b99302377ff5f3fab6ce04f1a88ab0421603b1c0a08ac5a0814c84f410", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221608, "uuid": "2fd8ace2-b4f6-4207-b09f-cad0d91c2727", "value": "5F8312B7F9776DB6C15DE1E3E53E122824EC85C07435968BFE0A5E0AC95AEDD9200C0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221608, "uuid": "b8738b32-2c55-4021-9965-06ccec0fafc6", "value": "1536:vr7l+KI0FlLHfAkZ8kISNq7xWgwMQZcUT7oqlaHvvbFq9GHocnoe1RqfwSOJrpMn:j7l+6FHfA210waUT7o/v096oiBkwPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221608, "uuid": "6997627f-c3db-4fab-9807-62fd548fdf36", "value": 86799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221608, "uuid": "5e223038-249a-4f72-ab25-993f984347b8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221608, "uuid": "37429489-ac8f-4437-ab1f-3beee28e566f", "value": "info-1776863816.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb62440-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220669, "uuid": "51499ceb-ddf7-40f9-a17f-376cdc5cb5de", "comment": "Malware payload", "value": "458cd72851d76d10586974bac6d57458", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220669, "uuid": "b1bedf5f-315e-4edb-825b-ac8ac5fad662", "comment": "Malware payload", "value": "1bb739b701def384f0cc2762e9450e0b1890bd9bb19e47fadda0cc659aa6deff", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220669, "uuid": "8c1c8079-6269-4e74-b433-7fa59cba0acb", "comment": "Malware payload", "value": "c00af03d86a1d2e6fdc9e639ff63c78d3ff35894", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220669, "uuid": "d8bfdcb4-104f-4b69-bb91-2dc2b04666e6", "comment": "Malware payload", "value": "3480629eed73ec15e349e5dd9918d09298f4cc7a92053906bd1f568a474c63f5dcb3522a8cd3815a453be685f8b05997", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220669, "uuid": "1498cd24-f846-4e45-bbb1-817503e19da2", "value": "1583024C4C3BEA5D89A4ADF226FC31555F44083396B953C8CA9D72B2B032EB4B9950F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220669, "uuid": "1335bca5-05aa-4d59-8e86-d653fff2c6ce", "value": "1536:ITxZYSMcXRKL+qiGKyClTJkv9c/EWd8E//nfYRq1o+VCQHeWnsUWuopyNg:2xhM2y+isVJklMdT//gRL+VbARl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220669, "uuid": "cd7a5f6a-e891-42a5-a103-aa186e4357e3", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220669, "uuid": "1fd1e0a1-3ec2-4336-b2b8-b64fe8c78cc0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220669, "uuid": "5a0c2424-2205-457c-98a2-0e72c6364248", "value": "info-1304370673.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b39ea0d4-a41e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1619173733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619173733, "uuid": "b4d26243-5e32-4e6c-8fa5-744cc426f8fa", "comment": "Malware payload (Formbook)", "value": "6aa26e3bbdbc47a642d0135c43a69a26", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619173733, "uuid": "6161a8e7-4f0d-4642-8810-3f34d4bc968d", "comment": "Malware payload (Formbook)", "value": "1bc6d5da54668552e5e67f49c99f8b83fb021cea71e6ba7b834a95cbc25b2234", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619173733, "uuid": "390d771e-f12b-467e-b3d0-5c163cece3ae", "comment": "Malware payload (Formbook)", "value": "41ea2da259a3c89630e4d86a7950b805ac470b5e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619173733, "uuid": "c759bec6-1a5e-4a60-b475-947da6d94201", "comment": "Malware payload (Formbook)", "value": "e0fedd97f1749c2f6e4ce9fea8e5f1a50d89722e1ace8f757e076e1fcc312503a7fa64cb9a30adce6810ae6f4f5c9401", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619173733, "uuid": "de6b1329-96bd-422d-a047-67aa7f9b336e", "value": "B2C423098478C585E62F7A6B3F2105745DD6C99C6CB861A738C026DDF222AB710F3DF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619173733, "uuid": "ef578ed5-edda-4b88-976e-fa568f3374ec", "value": "12288:PEBYKlH6GyuVkKwiATTbAJDEFOUoH2yM5YYWsrq:czlH69umwAP2DE0XLM5lWsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619173733, "uuid": "6a2dc1dc-7789-4c32-8b60-bf796a51a955", "value": 569116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619173733, "uuid": "79bb8698-88ec-48d8-82fa-74a585ab58fd", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619173733, "uuid": "f6746567-bfef-4efa-8fe6-902d50a5c6d0", "value": "_sample drawing skm3467348002- diagram Purchase Order PRT1542 (SAP 15198539).pdf.r27.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7360ff2d-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219581, "uuid": "79715721-c5db-4bf0-ad29-779ea48e5a9c", "comment": "Malware payload", "value": "8ed3c1f1a2ec5b556a1acf59990cc597", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219581, "uuid": "76970b84-31c2-4d28-a909-fe8b10c71b3f", "comment": "Malware payload", "value": "1bd28e5decdf252491674f88a77c27a5df5af41ecdb3be43ac8c7ff56b3d63e0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219581, "uuid": "0db5da42-c163-4fd7-a6d3-72c9a605f84f", "comment": "Malware payload", "value": "02c468251125b0baae09170a5db39739e643700f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219581, "uuid": "e8ba4bd3-9842-4674-8004-4fc4d57394ef", "comment": "Malware payload", "value": "4d2f280e28e8e11519ad0ce5c614bc3f2dbcf19c1a8e619e627c957953fa5c1be74a46526bf8a81581dd7590c390592c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219581, "uuid": "c10223d6-f6ac-4473-a1aa-28fd4419e6cc", "value": "848312FC7E1BD8A4A672968FC4FFB8D5179289E4E119A0A35C0A3E35D4106EBF512470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219581, "uuid": "937db2fd-ab3f-4b9d-940f-dbc1de943637", "value": "1536:QAS5f/KPDChIDbflm7UjoB8+wXdpUna5ahL2dmTLUVVvy:QASl+Dbw7uXinakEmEV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219581, "uuid": "671bac2f-7c9e-4fbf-8d11-a7e9e4f551bd", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219581, "uuid": "ff750511-9fd1-468a-961f-6eddc6830587", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219581, "uuid": "0ddd44f8-c06d-47e8-a1dd-a9238d24665b", "value": "catalog-217224948.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe537f93-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219814, "uuid": "1e886abe-9069-4673-acd2-a90f0c831864", "comment": "Malware payload", "value": "fd36571d5bbe583cd4bfc64a80d3d716", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219814, "uuid": "bf967d3a-d489-44f1-9336-d45bed10262e", "comment": "Malware payload", "value": "1bfe14e3dc44e2a91ec5e3079c6851d7545f85997e8b3ad04d3ea6baed4bb206", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219814, "uuid": "9233b3a8-e69d-42e3-b63e-c71455a3908f", "comment": "Malware payload", "value": "e4f7d6c94a5940fd8a43851bbd603a2a8808491b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219814, "uuid": "7321cac5-13ed-45e2-9b34-9bde7c83eee4", "comment": "Malware payload", "value": "c9d623966295c5ae4cdbbf13838615aa39cb9c4ecbfda5700065e0bb13afca7366594f4399897805cb2472c37491a0f3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219814, "uuid": "1f43ac96-17cf-4228-a824-58c5937185c1", "value": "2D8312D965167A7E8CFCA54D747F3E001EECA2E26A3202F7D14AC97370FAA9494D4214", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219814, "uuid": "e3fb3e61-4cd5-4b07-be8c-e96b128f497b", "value": "1536:jFFms3cwHk94TfvqBuKXxLG1ZQUcDwiFALqCJI3+xOtGkwdO2eDiFX5:jFl3+svaXxLG1ZQUcD1FALAOxeh4ONqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219814, "uuid": "1347e153-ce1a-4f76-9316-f46b489f7248", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219814, "uuid": "6216433b-30ad-4b19-a504-77e919a10381", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219814, "uuid": "72025b7b-cb9b-48b4-b710-0d1ee60a923a", "value": "catalog-354237904.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41daef9-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220146, "uuid": "ca2380ff-ebed-4696-939b-b45fa0c49815", "comment": "Malware payload", "value": "e58f5ae39b0b081c46b9e94d24367449", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220146, "uuid": "bd0e8ffe-e53a-4886-9cb4-02d10115b809", "comment": "Malware payload", "value": "1c047c41ba3d1149de7416062d8acfa19b26ea5de7c68c254659550a978eb9c7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220146, "uuid": "781f3548-f065-4059-ab18-c349a429f468", "comment": "Malware payload", "value": "7abb6acc029a3fc0ccaea8940d9384f26d2c652b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220146, "uuid": "4f9ad2a6-57ab-4baf-af3a-b48c39233aa5", "comment": "Malware payload", "value": "04d8c28680f9001dec42e7a843cb0f96adbcce4c61252f46e4dc7c0c60b4bbed79786621ebbca5be22defa6a337909d8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220146, "uuid": "b0a941dd-3847-4470-ae7c-85b4e08fabd8", "value": "18830227FB8735A68056E9F29B333B196A4239D9745435A68FBC0380F63614F1DAC1D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220146, "uuid": "95975ee6-93f5-4871-b206-e3328ae2179c", "value": "1536:jHmy0pi0wOQMF4gCQZiwotTCWBxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZiZtT:6y0pgOQMFEvtTCWjJ9a03fjwe1moYpof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220146, "uuid": "ea532631-7469-4033-90a3-6ad0bc3d4e34", "value": 86929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220146, "uuid": "3d684cea-d045-4848-841e-0c3cafd753c9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220146, "uuid": "63dd02c6-b13d-4391-8379-cab64f652c65", "value": "catalog-55043441.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7263e3-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221960, "uuid": "fc709062-c67a-49d2-8407-cade09d63a10", "comment": "Malware payload", "value": "709d59198c79fa8984b0a924bd84b1d3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221960, "uuid": "5e79a585-f4e2-40d4-8dbd-c1b95d57a22b", "comment": "Malware payload", "value": "1c61be112cad1d4b16ef979794ecd381561a1b181f042781dd3d338cdaf9b5ba", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221960, "uuid": "2f62bf41-842f-4cf0-aab5-14d3ad97bb3b", "comment": "Malware payload", "value": "38cfa80347503cccc3c830f5f5b50d45f1982772", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221960, "uuid": "e417332f-05c9-497c-a01c-466a80d5238b", "comment": "Malware payload", "value": "dc967dd01472a23b44e564b8cc97e50f881f33c731cb4f348537b7f8fa6e74fab26b846f7f926c333748eebb335fdecc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221960, "uuid": "dc2e1ccb-f91a-4c5c-bda2-41d915aaff41", "value": "968312ABF5376CF9C1ADF2D7A22F625C36EC85C0B0358286F61E2E06C599AED550480D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221960, "uuid": "1cb10dda-af97-4d12-80a5-c92f63cdfaf3", "value": "1536:9HZbN5m6RtUlLHfAkZ8kISNq7xWgwMQZcUT7oqlaHvvbFq9GHocnoe1RqfwSOJr2:NBm6XUFHfA210waUT7o/v096oiBkwPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221960, "uuid": "da3afbdf-bf4c-48dd-b9b1-92a61d253fe3", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221960, "uuid": "21493981-e782-4542-9f06-6ffc2cf0ef50", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221960, "uuid": "60f61ba2-ddcb-402a-9994-8b272698f973", "value": "info-2011080109.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8590922e-a449-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619192124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619192124, "uuid": "35ac7a46-f816-40d1-8f2c-1a065bf2cb0b", "comment": "Malware payload (AgentTesla)", "value": "0b7c1c4390120724e014ecaa9e2932c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619192124, "uuid": "2a1d8e41-048b-492e-837d-fc69de764377", "comment": "Malware payload (AgentTesla)", "value": "1c71b4ae646929d80233e262319288bde32e5af4ba78261564ffb801b643fa55", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619192124, "uuid": "4c0155e6-0588-4bc4-9084-48419b2ff287", "comment": "Malware payload (AgentTesla)", "value": "592025e3b0dfef6caac10203623a0e47f93bc958", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619192124, "uuid": "0bae9723-1073-4aab-82d8-1a93ba0c1354", "comment": "Malware payload (AgentTesla)", "value": "c1700ac3f2299c6d8843a73b6f772110066d37da1436ba61e7dc8f0d319ae952276a722af8d99e13ad9f89cff50a56d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619192124, "uuid": "b82405aa-7cca-4862-908a-6890f117371a", "value": "9EC4E12927A4EA36D17D077C8466020143F4A2636617E76DAFC460FA1CF37D2C7662AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619192124, "uuid": "4d59caf5-9b6f-4122-b93b-7b833236bff7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619192124, "uuid": "96e1f13f-5f09-4805-814f-590f381f630f", "value": "12288:UpmExgsnd9zRRRRRDhlEbkJiBoyVFScsCx8oZiX8sT2ZFWrH:OKsdRRRRRRDhl9QJfHZissan6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619192124, "uuid": "99238951-0534-486b-8742-f6f5d302117f", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619192124, "uuid": "379f2f48-5641-45b1-ac09-95eff4affe61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619192124, "uuid": "a192e994-50a8-4c91-95d6-028bfe5cdf87", "value": "DHL In-TrTransit Notification, Reference Number.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4946a3f-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220657, "uuid": "760a4b64-3e37-445d-b32e-432a79f98830", "comment": "Malware payload", "value": "983dc215333ecbde1a0d022e6e46c01e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220657, "uuid": "37189e7f-d62e-464b-9e67-84874fc59782", "comment": "Malware payload", "value": "1c91517822facacdfeb8d4c0125de921c6e3a36bd7feb2a74b2f46654db8ebfb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220657, "uuid": "60871c79-4b1d-4872-b836-013ad9d06133", "comment": "Malware payload", "value": "62b9a19956105373985e9630f7ad27e811ef50c1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220657, "uuid": "f5a2e6cd-fb71-4965-ba7b-2b55e6544626", "comment": "Malware payload", "value": "e79dc9f950b8f7c0794c0c2b426d84979403d2802fa135f18bb8007c582898fd4ede37652bf96cef049eb9ea7db1a9f8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220657, "uuid": "6c65199a-071f-4dc0-a9dd-98b7dbae8047", "value": "CB8302B7322D0BFF900AA49B909FF5F9F156A93E5D1EE510B3642D20353153EA421AAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220657, "uuid": "9f7391d8-8d5b-456d-af0e-661b887c97fb", "value": "1536:cQBAV8QI/AATZvjL3+xnxv5ZUSzhhcBrasoi8vQMwdjV46CTq:M8QI4AZP3+9xv/UGDmrajvIM6CTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220657, "uuid": "22c8603d-91fc-48e2-9ddf-6050f767c65c", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220657, "uuid": "a56ab69a-2565-425f-9e3e-fa55a7d17416", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220657, "uuid": "a16f6e96-ee8f-403e-9035-00f18352b8c2", "value": "info-1292490815.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae1e1a4-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219003, "uuid": "4cd6f0f2-2622-4ae8-8b03-76f892a9ec5c", "comment": "Malware payload", "value": "ed928a111ca3ee463e321cb1d4ce1b1e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219003, "uuid": "696d699f-295b-4fd5-b6ee-7a8f1f63eac2", "comment": "Malware payload", "value": "1c9e83f6a0d802c95c769ef783ee8d543c1caace463b6f16cc70fad0ac88f994", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219003, "uuid": "556e4762-c8b2-4945-9461-379cf953b7cb", "comment": "Malware payload", "value": "19c34a71424420ae53e7fadd4479af13f6ad1e82", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219003, "uuid": "e85a4af4-869e-4a9c-9ef0-b8df95ac036c", "comment": "Malware payload", "value": "a41e9a8b8503259927e878e91188ac35ae2e85564287d7cf019961161bc9c6cf32f58e41c66159fa96322fda661fa703", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219003, "uuid": "d2c6c925-1581-44fe-bf72-7823eb2d28f7", "value": "10830276DE8F8289C016B23103787EA61F686B7146A1141E6BB0743B2F5B9BD4C85FD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219003, "uuid": "54352047-b9c7-4ec8-a9d7-ca980e3af5f4", "value": "1536:/EcHCzlWAXdZ2rQD2aCvdyWxaqQ6Rxt5AB/aqPwL3VbCbq:/tCzh2QKmm/Qwt+awaxCbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219003, "uuid": "f4f67c1f-eefe-47a5-8147-6355eac21b43", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219003, "uuid": "c72acda9-19bc-426e-a673-d9699a2bf015", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219003, "uuid": "fd460d1d-0c80-4e92-a3ca-927873eec364", "value": "catalog-1837162916.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf53d4c0-a45a-11eb-abe1-42010a9c0039", "comment": "Malware payload (XpertRAT)", "timestamp": 1619199549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619199549, "uuid": "45d168bc-6bdc-485f-8fc3-2ae4ec52b48b", "comment": "Malware payload (XpertRAT)", "value": "a5523425c4a1ec48a104970e15e55978", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619199549, "uuid": "5eac3b84-c18b-4f71-b712-30c8592022fe", "comment": "Malware payload (XpertRAT)", "value": "1ca3cfc63c029b0d6a0d312cac86c5dc77e9efe86dd711a08e1f25d0ec62c366", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619199549, "uuid": "51f5a305-da6b-440b-a0f2-bae17e004524", "comment": "Malware payload (XpertRAT)", "value": "43d820ee908bff37ed63dc8a13d8782637bd3203", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619199549, "uuid": "6ceb3655-aade-424c-8d4f-4ede2f054a3e", "comment": "Malware payload (XpertRAT)", "value": "dbf0e9c8d6f71a5d023677b02a64d97d40af9af0cfe92ffcca3a43b0eba8a5b9cd4f09902400d68a6758f54c0f789ad2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619199549, "uuid": "005b67f2-2d70-417f-a2b1-e85c9f84ca1e", "value": "F0724B6587D41D0DFC7F5330B1F189242F34ABD1A6228BAF209892C84F523C195EEA7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619199549, "uuid": "c949b99e-9852-4937-900e-673b30472382", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619199549, "uuid": "7e3865f4-76fd-4ced-953e-f89a839b8985", "value": "384:ikbkUs00hFzm+xPyKEBXBCI4l9XSiJSiYSihhR:icP0hFa+APMpiiwiNihhR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619199549, "uuid": "e1e912cb-d087-4e06-995a-188e0f492005", "value": 16024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619199549, "uuid": "27d15505-74db-4314-9a23-40469afda575", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619199549, "uuid": "d1f85abf-db66-4e4b-a2fc-cfedea02825d", "value": "a5523425c4a1ec48a104970e15e55978.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e6e832-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219450, "uuid": "bc5d1d07-06e3-4d13-a591-7d0efb278f3d", "comment": "Malware payload", "value": "ab7e061efef7795791ab1fac78d4c827", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219450, "uuid": "c2ddc638-284d-42e1-ba55-dc838f799a19", "comment": "Malware payload", "value": "1cbffbbe0b7cd45aa7783f01a6cda63b69bfcc7b9774882f70b7bf9ecd0f7375", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219450, "uuid": "7e315cf1-aa0d-484c-a894-c65250806b5e", "comment": "Malware payload", "value": "3bafac7e9080e01d6606a94bbbf5d85f83e3dead", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219450, "uuid": "005127fc-d8d8-41be-8e40-a77084625b1b", "comment": "Malware payload", "value": "2fe254403e1d95e3882b8dbe16e84fa958e4b87edc1cf0db8d1597d57067b9918d02ffe27c03a6e84ac9f8b4a01cd8d6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219450, "uuid": "505dde09-684e-46c2-8325-158ec56bfa13", "value": "938302EC7A1BC696E371835EDE3EA8C1335B9DA8C01DA062780F7F6B54216FF9524160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219450, "uuid": "010f3c12-782f-4b7f-8ce9-927609543e03", "value": "1536:vf1lwsMJDrdAZQ72ZTYzqcIkUjoB8+wXdpUna5ahL2dmTLUVVvs:Xcbt26IkuXinakEmEVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219450, "uuid": "9f298865-f8f2-445a-afef-f2189cdb2668", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219450, "uuid": "ed8ab4fe-0c59-4aa0-bb6f-d11d4486b931", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219450, "uuid": "678534b6-c556-4437-8e40-2199a3a8e070", "value": "catalog-2098590232.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba1c4d3-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218817, "uuid": "840e1895-95d4-4a40-bf33-0842f2808b9e", "comment": "Malware payload", "value": "77d8e84883050d895b6484c78ffe16d0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218817, "uuid": "d5d429f2-c0d9-4205-b9d9-d56c822ad9f4", "comment": "Malware payload", "value": "1ce3b0ed2142d83fc3d465157c0d5073a1dfdb33f109b269399dd7e49c288768", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218817, "uuid": "6f5d25d1-0f0b-4945-bd12-cb90465edca3", "comment": "Malware payload", "value": "c8adc8d09aaa7cdb6a5d01caa3d9cf1f49c26d71", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218817, "uuid": "a3744b44-8058-4031-aa23-8f7dde4860c4", "comment": "Malware payload", "value": "4ae1e7eccea9b3a206ddac912f69abf23c3ba664f28f675c3ae1ac7ef147321da23068c9a8798540036ff5426540ee22", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218817, "uuid": "a571eef8-213c-4c49-b11f-81279a5cf622", "value": "1183028B74E9433ACB3913F65CAE1E4422B1A47F140CC6DC79973B786B53672A472388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218817, "uuid": "b33ff680-b0e1-4040-a3e5-aa9074f1ed4b", "value": "1536:aAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvL:aijtuPmU9j7+XFWtYe14hbOjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218817, "uuid": "a54dd6e9-0445-4f40-925e-ff28ef2b013c", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218817, "uuid": "feab4862-2485-45f2-a5f3-3e2cbc7296ee", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218817, "uuid": "ddb3df5a-7a46-4a80-8f2a-ce7c225fd54c", "value": "catalog-1724047447.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e760e06a-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222353, "uuid": "c547f2f7-6c57-4320-aa73-645f1cae37d2", "comment": "Malware payload", "value": "53cb7fd6bb305f2f5598a62617451870", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222353, "uuid": "2d3da67e-8814-4365-bb50-88bba687e924", "comment": "Malware payload", "value": "1cfaebdd4a997f46e4ae98ceec51b2bb88c27fd061d797fcd7d6ce3c55e31617", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222353, "uuid": "44c16d31-ed2d-495b-9a16-11cd44452235", "comment": "Malware payload", "value": "03b49410f7d9dabea8e8ac579f208c0813e2bcea", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222353, "uuid": "4f78151b-d03e-43ba-9576-1bb403554dc5", "comment": "Malware payload", "value": "9d4e3860e9222bf38cddb3393b4519f7a60d5b7fa0934ade252f44ba966324af0786e874888d43cb5c62331053128dee", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222353, "uuid": "a33b0443-8de5-45a7-b3a0-03f3657aa3a0", "value": "DF8302681866AE4DCB5AB9D162FC32983ECA14333076039F6959F433B287F74E1741B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222353, "uuid": "0a8bb3b4-e641-4fba-b828-6329b0c3abce", "value": "1536:ZprZSmsPvSp6yM8zmWtNlTJkv9c/EWd8E//nfYRq1o+VCQHeWnsUWuopyy:ZpNSmo63MxWtNVJklMdT//gRL+VbARb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222353, "uuid": "b6343e12-1d7b-423c-8c17-f74433948a11", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222353, "uuid": "137abb15-6ebe-4c3c-b160-f372c78e86d7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222353, "uuid": "db9c4915-55ab-47f0-b5d5-4ea35331bba5", "value": "info-337677722.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d30541e-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221316, "uuid": "cd75fba0-faa8-4920-be1e-4f4364e9ac8a", "comment": "Malware payload", "value": "0d877f0d61dc8788eeeca034daeebce6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221316, "uuid": "665f6ca4-f9c4-4605-a5cb-e44d83e71ac2", "comment": "Malware payload", "value": "1d28463bfc87f490fc5acc0c12bff7e239d2073dbde4d6f4b78a95963b1a6263", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221316, "uuid": "b47e98bb-de1c-4690-b3ff-5f1abec6dc48", "comment": "Malware payload", "value": "86bb371115594f9b683b33a7d02f5a9f3e7a5b3c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221316, "uuid": "14fef3b4-a197-4be0-9ce6-fa9b8e1b58af", "comment": "Malware payload", "value": "0c8848e8d4cc95130f05ffe95b8bddeed35a8560e39f322197ab8dcc60070478b6819404e08d886e50e0e6eabdc4bd88", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221316, "uuid": "cd383447-a698-4989-9e52-75692c78267f", "value": "4D8302F02CEF15B983896676A17D1643CC9C1FE016686F8B631152282EB18DFC43B676", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221316, "uuid": "a6246b0b-017f-4946-92b2-3272c89e9ff7", "value": "1536:8r7l+KIkejUgUlrZcCWb/bLCDxxp/ERd9QnGlRTH7qrelcd:G7l+9UhlrZcnfLMZERQnGnTHMeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221316, "uuid": "af2c0363-2499-447a-b71e-048242af03d8", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221316, "uuid": "6b275d16-d2d2-4031-a27f-789605f60b6e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221316, "uuid": "c6e2c3bd-2d04-467e-af62-521450df61b7", "value": "info-1614686219.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ddf61c7-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218633, "uuid": "4180863d-e4af-46dc-a50f-7bd8ef469f6b", "comment": "Malware payload", "value": "e4f8d96ba8d2c989404c31438ffb70a0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218633, "uuid": "3e546693-7108-4e5c-b580-e2624f61c33f", "comment": "Malware payload", "value": "1d30bb656158750dcdb1b612df31b30a81003e9dae9beed7d0e91fd5c936b833", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218633, "uuid": "f793d4b5-2937-40db-aa98-044ee491bbfa", "comment": "Malware payload", "value": "f6f55b40057b30e93502cb1c2ed217486da03eb4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218633, "uuid": "d6fbb6a7-c014-47f5-bfcc-4a7e1a26d166", "comment": "Malware payload", "value": "74d4cff608c0cd85eb15c5d39640fad7a77d67db29341813cdba24a1ba79aec41c2b7c7079832d848b60ce2349aeecd0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218633, "uuid": "e6e3592c-6cd3-4c27-ad60-54840f36127a", "value": "658312EC74238AB6637345E6DD7E90C32B6B8BBC441DB056A82B693649307FFE121531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218633, "uuid": "f3d46024-1232-4432-b83c-5052aca0c02f", "value": "1536:+zKTWDE4Qgl8LS4v50FC+p7UjoB8+wXdpUna5ahL2dmTLUVVvX:+eKDPKLRvaFjp7uXinakEmEVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218633, "uuid": "0eeb69ca-7083-46dc-bcca-95acb240daee", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218633, "uuid": "1d78f1c8-e67f-4c6d-9b7d-0a65c4bc6527", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218633, "uuid": "54bdf5d8-a0bf-40db-84fa-209450491c3f", "value": "catalog-1649948188.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d004385-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220779, "uuid": "576ec172-a52f-4b4e-8cf9-2e4f099e6c48", "comment": "Malware payload", "value": "9271b618a7ed8b9891fe2a6a745aa581", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220779, "uuid": "117badf0-9234-48cc-b20d-e65946abbe8d", "comment": "Malware payload", "value": "1d358e249672b47e8d4cecd1bcfec20c877a13ba1de52d8d3127e88efc53a6d4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220779, "uuid": "bf454250-93df-4313-bfd2-cec155db410b", "comment": "Malware payload", "value": "a8d1f844e377412937f3d750e75c1093802dc270", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220779, "uuid": "49d37b60-db59-4697-8518-41c173e40610", "comment": "Malware payload", "value": "5b73d31ce6b7640920eda3011939c4d21737fc6593fc49c7349ac099f722272452d2e6ca313905a4cbb03bc88c21502b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220779, "uuid": "93aca655-7b43-4002-971b-13822d3be83e", "value": "E6831209A0BD4FE880E61D813D347A8BCAF4EFD229869443F1745B6795B1F360179E2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220779, "uuid": "e4406ca5-9e68-4675-9cb8-18f6a295ab28", "value": "1536:7qHyJmpq7rWVy+qBDkq7M5Y2VXw1QFsrGq9ZMlmZQTQdZ:WQmceVy+qBDkqUXw6Af5dZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220779, "uuid": "4cff6ff8-9bd3-4cb6-9190-3c8341e2e685", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220779, "uuid": "f0aae244-2bbb-4f88-af7e-86efc29720e9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220779, "uuid": "449554dd-1942-4544-8192-749a57a5de77", "value": "info-1368432220.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dba5cf4-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219169, "uuid": "bbf08959-b019-4bdd-8ed0-17369d6e38f4", "comment": "Malware payload", "value": "36b1f43fba64854d755391a6d64d088d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219169, "uuid": "a7f2242d-0aef-471b-8301-c9e9d2134eaa", "comment": "Malware payload", "value": "1d441f0fe86717349b91af1493c15aa80474734f40371d6d37833acfc61eec36", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219169, "uuid": "b7626197-d15f-4db3-be5c-ffdfdbb3bab1", "comment": "Malware payload", "value": "eeffb0d8f38e602bb7cdac64a3973e5573fff182", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219169, "uuid": "18854e2a-21ab-40f8-a471-ec54e1430f8a", "comment": "Malware payload", "value": "8de27e544318764e12b9d4cb7e5acda4aa0d00486f0562db7943422e64413451d0b2499ba9d0acde9bcdf3e83bc0b138", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219169, "uuid": "5f8760a1-a1c8-4b59-af08-532e104b2978", "value": "BC8302E9654236BFC8FD950D206F3D402EACB2E56E2212E7E207D93770F5AA894D0718", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219169, "uuid": "a2e9472f-5f00-402a-866e-0b47eaf07cb4", "value": "1536:dF5u1k94TfvqBuKXxLG1ZQUcDwiFALqCJI3+xOtGkwdO2eDiFXv:dF5fsvaXxLG1ZQUcD1FALAOxeh4ONq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219169, "uuid": "6fdd4c26-6283-4c12-8bd2-3233bb2aad60", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219169, "uuid": "0d38e19a-99b5-47a3-b284-611270aa7508", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219169, "uuid": "fb60cd82-bf46-4a21-9554-40ad4ce7d4cb", "value": "catalog-1923257105.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa243015-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218814, "uuid": "00079392-5617-4fe0-a8e3-976e52e35348", "comment": "Malware payload", "value": "668d97b334ea281b84b3407cbea14d06", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218814, "uuid": "33d70db3-9c5e-41ee-ad95-402c91b107b4", "comment": "Malware payload", "value": "1d444230fc93745aa2cb4491c525a4bd5ee53d29eb89ba7eb72353b66e9665ff", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218814, "uuid": "3988e044-6fa9-413c-9c56-18f18396d603", "comment": "Malware payload", "value": "8552d58377a427d55909e22be3b10ec275e4a835", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218814, "uuid": "491c00ef-9c75-428a-9770-5fc217bea515", "comment": "Malware payload", "value": "8e47d2a614606aa38fcc44f6c7b0d124c7c3959796e39a9c585ae47723ee067d3fcdacc99ae4dcd48b55cfad84bbeaec", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218814, "uuid": "ce7481af-6beb-4791-a84a-3bd940abe7bf", "value": "018312A306CD584D711BF828C1647F8F99ED8F679F040A0FCABD462B11969BD3990289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218814, "uuid": "186ab748-2b89-4176-9533-f6a0160aabb7", "value": "1536:q2fnBKjQUgFsqi+nTnfZA6l3SNZzTJAsB0Ic6DMADMt5zC/IDIz106:hJiifrCNBJAIlcAGIz1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218814, "uuid": "557f7386-4467-4cfa-8a8d-6f9acfc4bfdb", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218814, "uuid": "9fc65752-e71c-44b0-b885-0eaaba43bfcb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218814, "uuid": "cc3195dc-6166-409a-aab8-d984e80c8606", "value": "catalog-1723912953.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115d1f92-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219417, "uuid": "e28b61b1-a265-4baa-8133-ee9ece7efad6", "comment": "Malware payload", "value": "b80e004167155b8e1197a99af2e377c0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219417, "uuid": "a822a927-ed51-4883-9588-067a8dbac6b8", "comment": "Malware payload", "value": "1d49b344d7fa58d7e3e1d6945f90554d0331d4b3ebd8dc57159104d71ebf23ae", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219417, "uuid": "2036984e-508e-4aab-9519-48dbe5c3dc6b", "comment": "Malware payload", "value": "04eb946070dde3fec2ba40b25407a149e066306d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219417, "uuid": "ebfc32b7-3690-4c5e-9aba-2203ce27fa40", "comment": "Malware payload", "value": "5cd58486af4a72257dc9ec0d40c8f7422a3a6ad0edc520f4c3785f17e700be02059e40d5faa2c3a5db0395c1b01f5a1a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219417, "uuid": "3c192624-3fc9-4038-9c3e-be787c09d79d", "value": "FE8302E965423ABFC8FD951D246F3D402EACB2E56E2201F7E206D93770F9E98D4D4218", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219417, "uuid": "44c6993c-1e7c-4612-a7bb-80393d8d5db5", "value": "1536:SF5u1k94TfvqBuKXxLG1ZQUcDwiFALqCJI3+xOtGkwdO2eDiFXL:SF5fsvaXxLG1ZQUcD1FALAOxeh4ONq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219417, "uuid": "698a0192-8177-4a3f-a67c-725182c67a8c", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219417, "uuid": "dc511719-2038-4158-9c0a-80f6a71e9eb2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219417, "uuid": "d7b2c6c9-21bd-42b8-be81-f1be29d10468", "value": "catalog-2078436360.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b0846f-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220120, "uuid": "d9e32121-c3e3-4c24-9c75-70f43c4dc7c0", "comment": "Malware payload", "value": "123cd9069541ed9feec9cd9bd3751e8d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220120, "uuid": "d5b4150b-9661-49d7-b1b0-6c91b663cf6f", "comment": "Malware payload", "value": "1d5b252d83a0accf159c19ec1f3880ca43b30fdc9648c710033083c08ec28824", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220120, "uuid": "9c5f56f6-4ff2-42c7-bb67-ebfed595596f", "comment": "Malware payload", "value": "98947ae4e4472742bf4955b42c0fec65b84f496f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220120, "uuid": "d4cabe87-efea-459d-b654-99c7bf64f21d", "comment": "Malware payload", "value": "281226e5a9d02a66d8e33b57d4bb3b94b0e7a830e1ae36fdf67c9e74b64de1f652ef806e511a3d6b16022a691eed4ae6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220120, "uuid": "bfdb4092-62b1-46be-9a48-b36fc0257302", "value": "59831277DE87624EC502723013782FE64B2C6B329A61150A1770747F2B6B9698CC6FD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220120, "uuid": "5e6df61b-c8cb-49ef-8282-5b03e0ab1a78", "value": "1536:NuxWAXdZ2rQD2aCvdyWxaqQ6Rxt5AB/aqPwL3VbCbn:NA2QKmm/Qwt+awaxCbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220120, "uuid": "6750e798-0e63-41a4-921a-c3a1b9db2bed", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220120, "uuid": "09ae5321-bf95-4f55-87a1-ddb7c3036c7d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220120, "uuid": "a7a914af-9df5-446f-bfc5-c09d23222f02", "value": "catalog-529983249.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d02f8fa-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221799, "uuid": "681be95c-c236-4bd2-be4c-29d060f39c10", "comment": "Malware payload", "value": "e6343c2619b9c1ff6ee05b70506c89f4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221799, "uuid": "2872efb5-25b5-4f10-bb53-260ac3f21eba", "comment": "Malware payload", "value": "1d6a777816242298c47a48aeafa5278fa5a0283e488a48df10751181cb6bc452", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221799, "uuid": "120ab80a-ac51-4cb8-8d1f-5df3776cdbf4", "comment": "Malware payload", "value": "c07efc81f17749d1d8d960ff95238c3d74cb3da1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221799, "uuid": "85736381-8ef4-4412-a348-224e90e9f23c", "comment": "Malware payload", "value": "363c60e3017fe83ec49dfd9119075e46c7bc4e13a1e1488d9ee6540dc51dfce102887b54cd2ee58184828fa77df8b261", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221799, "uuid": "263074ae-443c-4a2b-bc5d-b21b2046898f", "value": "7983128C2C55E29EDB4879A217DC31986F942333B7F542EACC5E72227513E36F1441A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221799, "uuid": "371c0c84-b3b9-4157-942e-231adb05dd51", "value": "1536:TwJNfD6jITxi78nLkb/Yw3LCq1GeOalTJkv9c/EWd8E//nfYRq1o+VCQHeWnsUWc:TwzOEli8ne/L3LCq40VJklMdT//gRL+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221799, "uuid": "d08de639-7d35-4591-b4b0-6d89a5b1b08c", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221799, "uuid": "a95d997f-9d81-4cd9-966e-e009c16befd2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221799, "uuid": "d0007a61-dee3-4ef0-a032-11bb99e6ba10", "value": "info-1890556085.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a51762-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218374, "uuid": "25a16da9-32fc-49a5-a7a5-ddbea72e1474", "comment": "Malware payload", "value": "10280fdad1054052c727c925c8e9598f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218374, "uuid": "2511e8e5-f8d0-48a5-9330-0ae13c0114cc", "comment": "Malware payload", "value": "1d7c64331af5d86d2eb7adc33591f33ca92b8ae5c28b78c55f719976c99870a6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218374, "uuid": "11fc87e6-aae6-48ef-80de-c2925e998aa2", "comment": "Malware payload", "value": "cc11e4b92370732794637ba0dd9f6536aa41df35", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218374, "uuid": "1b2317d4-4fac-4db1-94f7-eb4b9825da2a", "comment": "Malware payload", "value": "a684e0a3292ab6dbbd9dff6f7d8e29a620cbff4732b19d1e0708907f58fe5b9324cb981052c842802a543a630b731284", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218374, "uuid": "efc7c876-62b8-4299-97d6-3abdbbd4f303", "value": "F08302467EF90F9C2C19EC2185174CF50E67CF6EC1872229B26824765848ABE7E075FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218374, "uuid": "199c11a8-64f4-48b3-8721-9dd2cd1e6402", "value": "1536:BL2dSRV1UgF68rh4Khs/9qDUAAWB9Te87VqINbtezgVRxr9AiUrQTKXs8FI+bt:BL20RNrhDagDpe8JqmdIrLjFRbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218374, "uuid": "4ca830a3-d315-440e-8ed7-835010ec6673", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218374, "uuid": "60980d4b-2932-4b37-8dfc-cb2d0dc6cc17", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218374, "uuid": "4bf22c5b-3655-4630-999a-33b7be122ca2", "value": "catalog-1463664614.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa50fc4-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221956, "uuid": "43cd188f-c5a9-4e9c-bcd8-dcb2364e5dc1", "comment": "Malware payload", "value": "15d206e15ae9662fd10178e843de97d1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221956, "uuid": "2f6280e3-f646-40d8-a68e-cf07dea147bd", "comment": "Malware payload", "value": "1d7cba505313bcfa903398b415758892c97f284064605b2b5cfa0d7bc70a26e4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221956, "uuid": "77fc0ed9-c9f1-4b93-8401-14d470c0be27", "comment": "Malware payload", "value": "ccdc3f98e5cd81d1687ee83345ddcabbb90a2adb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221956, "uuid": "b7a7d933-9c1a-4e7f-b100-97575aba8da7", "comment": "Malware payload", "value": "88dd02333c84a37385af2e14a627fd48116e38c913059f4a7b49806030d77d8ae3f04ae4faa2d7f575e6a8e02c42130e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221956, "uuid": "21765691-5404-4769-9710-63299f2dd8e3", "value": "3F8312CE31ED01486A7B386470BBF54B50FC5F5B3D73B7288231A570EA114B57A126AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221956, "uuid": "dff3fbed-2462-43ca-bd28-a7cdbb4c09db", "value": "1536:7WswJNfDtI/W4UgUlrZKFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbXYZTa4hpTw:7DwzpIpUhlrZ6O6xoKDShicdBMM1/XPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221956, "uuid": "86b8052f-1d01-41b8-8836-3f6824cfd2a4", "value": 86795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221956, "uuid": "a8dce76c-86ee-4ae9-b1b4-9f914f1610fd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221956, "uuid": "b5958352-b128-4c4a-8349-20832e4bdd0a", "value": "info-200604904.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f6ed1f-a45b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619200008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619200008, "uuid": "dce36c12-e2c1-496b-aa2d-ea1ad585d249", "comment": "Malware payload (Quakbot)", "value": "4b6b48f545adb525da440f0bef4a54a7", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619200008, "uuid": "9553a975-b9c5-4290-828f-69bc8c40ec0f", "comment": "Malware payload (Quakbot)", "value": "1da4972fe41e89b10f9414008151ab53c2b0585e47676aa8f4211e3b1f89f98f", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619200008, "uuid": "c19aea1a-57ed-4d59-93b4-c8da25d9ca52", "comment": "Malware payload (Quakbot)", "value": "3d5893135fb3532f8bfe9ed4aabdb532d2a06884", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619200008, "uuid": "a0ec5a72-0b27-469f-8bb6-e351f0c31a3b", "comment": "Malware payload (Quakbot)", "value": "207aa3c0e3ac6f4883a7fe3efd37592c2ba16e49812f7d75d55b7e0ceb05c9a104b6012a0bccd30bb794121a1d6e8e8d", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619200008, "uuid": "a184ccb8-87ca-4157-9a56-f55d926a419e", "value": "017423BFE28269F4C3258D3ED684A190C295F1E08067732D47DD3515E31326FF95A2EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619200008, "uuid": "d0b0d63f-4621-41fa-a438-48c891eed87e", "value": "6144:ERMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZN7:ERMmEv2Bc/nvm8IKABfsYOmauFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619200008, "uuid": "e6381262-efac-43bb-86e2-0e43ffa25c82", "value": 337382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619200008, "uuid": "8c304b39-98d5-4e55-b3e3-ed8c2daafe18", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619200008, "uuid": "cc2a87c6-c4e5-41a1-82d5-88a5d1fc4adc", "value": "7310182546-04212021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82cc7100-a435-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1619183529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619183529, "uuid": "fff35dd1-d384-42a1-9935-79c0c4807cb2", "comment": "Malware payload (RemcosRAT)", "value": "86a60c76f4734d8e5e664d4296b05d23", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619183529, "uuid": "9b9f4797-c68c-4136-9a75-61cb771454cc", "comment": "Malware payload (RemcosRAT)", "value": "1dc132d54524bfd99e713b47052ec9fc2a59fcbb46d70c732426cf228446e17e", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619183529, "uuid": "13e3d624-71d9-465a-9b6a-cf2c06bfa022", "comment": "Malware payload (RemcosRAT)", "value": "bbd8bfae7c2449915d071899300aeb3de5030464", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619183529, "uuid": "0daa4aed-9b09-4be6-8ac0-201d637bd6d6", "comment": "Malware payload (RemcosRAT)", "value": "393960a4679e61d73de0ff18a9f78768315419e1017b7575f0ba38893344d2bcbd24807ce7b39e1a0e2a826d1a1b8031", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619183529, "uuid": "43d660dc-63b6-4790-9cd6-67f4a81825d0", "value": "7BD49E2AB5D29573F22F267D4D5B52BCCC1ABE112524284637F85C4C8B373917F2A2A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619183529, "uuid": "c72299ea-f1aa-4271-868c-db23a12329df", "value": "8942f12d5b922dce53e97fae6222cadd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619183529, "uuid": "59884480-f01e-4266-9faf-1967b49cf579", "value": "12288:LfRbTNKxQ7kpiWfhWW+S1yLT2l1sQCLVc++Fufk5/e:Lp4ikJZx+Si9c+Rfk5/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619183529, "uuid": "eef3a81b-0993-42d8-8235-eccfcc099801", "value": 626152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619183529, "uuid": "e7a699a3-cfbc-4f79-b467-74758f65d76d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619183529, "uuid": "03eeff0a-82c8-4381-bc26-dcaac5c2910e", "value": "doc07621220210416113300.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b63319-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219523, "uuid": "601167a6-11e6-4627-9e55-55648e65f5ef", "comment": "Malware payload", "value": "91207f16811f9fb4f6d22080a0fec155", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219523, "uuid": "7cfedde8-a89a-4fbd-a3dc-effffae8689b", "comment": "Malware payload", "value": "1e06af08a5ee72c4a77b05e9fb5ca9222dcfe7ee088a53891f1164cafb3aed7a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219523, "uuid": "c3cf371e-1d3b-4ff3-9876-f99e060881ec", "comment": "Malware payload", "value": "c1d38119360ed230249646d9e60d2d7c12052d35", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219523, "uuid": "ce925273-1aec-4022-b14c-dfa19a88b115", "comment": "Malware payload", "value": "90caa19405688a5059a8b6fdff7d0f198b60c21d53d91a7fd1d0541fabed68c4981077f97e859715aab224d074569906", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219523, "uuid": "d4f02e5e-da50-46c2-8dce-739df5e43f16", "value": "C783028BB4D9433ACB3523F658AE5E4426B1A43F040CC7DC65973A78AB53672A57238C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219523, "uuid": "33705463-0d08-4510-bb9a-b88f57238928", "value": "1536:yEwAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvH:yHijtuPmU9j7+XFWtYe14hbOjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219523, "uuid": "148ba447-6bfc-41f9-abd8-cbbd3743ef8b", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219523, "uuid": "9dc47b94-123c-4d7b-88eb-ae017500c776", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219523, "uuid": "4530f0f1-05bf-4c7d-b2b1-a2ca618441c9", "value": "catalog-2131818689.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7791b552-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221306, "uuid": "057454f7-1941-4f0e-94e6-277f1458d190", "comment": "Malware payload", "value": "25efef4257ab491d2428167ae4e4d4ae", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221306, "uuid": "750d0f75-268e-443b-a56d-1cbafa7680ce", "comment": "Malware payload", "value": "1e0bad2f0123dc47d62e3eeeb1133302d4b7a3a6cf7c6bc8e3604b0a2e288d31", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221306, "uuid": "7b0aed46-e92d-44ba-9f38-85f82a96adac", "comment": "Malware payload", "value": "d59b490e369f327e559ea5b7c65ecbfc68335ba5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221306, "uuid": "6d9de985-1b0e-43dd-a619-de5a1ac79dea", "comment": "Malware payload", "value": "73d276adc8e224f13b9bb2fd77a702097f5ca1acf0933457da4226602c68b4df248a2f6d177fc82213a761efb931daf3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221306, "uuid": "962fe5a1-ed22-40d8-b787-4067a9cc22b5", "value": "4B8302079A6158FDF16ABE01273DD8CFA64ECBE1E92519C0F20E7F65D2A3399325440B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221306, "uuid": "ba7c44ca-7e23-49d6-b00e-955ee8b1742e", "value": "1536:gHZbN5m6RtLlLHfAkZ8kISNq7xWgwMQZL197v7UZoctQ2kPo+4mpRlDi1nUSUqxV:0Bm6XLFHfA210wN19T7YptKRNpoUSUqH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221306, "uuid": "dcdfdfc3-9b9c-4786-aa0e-e3428cfdd081", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221306, "uuid": "62c1d6da-2e8d-4cbe-ad63-4bdcb5ac005c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221306, "uuid": "8b931f7c-40d6-4074-aa7b-debcfc5aca68", "value": "info-1607667766.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b3b1078-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218360, "uuid": "7bd4d012-fae1-4748-a337-7de059a56c7c", "comment": "Malware payload", "value": "71137a063171dc7de8f4cb041d6fee23", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218360, "uuid": "4619f7d3-25d3-4879-8a64-b88e45042fde", "comment": "Malware payload", "value": "1e227c4e41b4fa886c1e3d7358f271966d596b837f93daae00b6ac5eec0952e5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218360, "uuid": "a1fd9f2f-e915-47f5-893d-ba9ea7624282", "comment": "Malware payload", "value": "a3985b9212d0c67bedba315f29f81ae402b7ad60", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218360, "uuid": "57aa66d3-ffb9-4b8f-a630-aaca740664b7", "comment": "Malware payload", "value": "20d76690cc562c8b279d94246e3bc4cc899be6f1a52638961212c7506cfe966efb60fe0dc6287eb95f010e4cd26975c8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218360, "uuid": "e7ce17a1-3ab0-49bd-a868-db4db1a88ff8", "value": "5F831276DE87A28EC402723013782FE6472C6B719A6115062670747B2B6B9794CC7FD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218360, "uuid": "e5b810f4-9bb0-41be-b105-496aa8111e06", "value": "1536:yuRWAXdZ2rQD2aCv0yWxaqQ6Rxt5AB/aqPwL3VbCbx:yg2QKDm/Qwt+awaxCbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218360, "uuid": "41f1e1b2-1c27-4f2f-981c-2dff2c1f9627", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218360, "uuid": "370b91c8-1ccd-4a77-80a3-e304ff3b8968", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218360, "uuid": "4ba098e3-2607-4975-8ae1-f2dad8b8b3be", "value": "catalog-1457170739.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47dbcc39-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222085, "uuid": "625f719e-c1cc-4791-8592-1877b8613201", "comment": "Malware payload", "value": "a3184cdaa95d9f5d6ccd060a250e51f3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222085, "uuid": "5a4eca5d-8361-4251-8678-b80c2186388f", "comment": "Malware payload", "value": "1e2a7cc7393f8bd455a3d05c30fa57e6e658c3ee0e7dee036ccddf758f5258a6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222085, "uuid": "db2ae486-7c6a-4a32-afe0-335060f1e46f", "comment": "Malware payload", "value": "c511f0f634465be97be2e2f99aa2ae129fdf8d09", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222085, "uuid": "5356f6c2-b3ea-4552-8e29-155859ca4ca9", "comment": "Malware payload", "value": "92f405f668dd0a04e99d52099f620b4df82abf1ee0e6fd9edc152db943c2defb420858f5d4f74e4963d4a6c76703fcf9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222085, "uuid": "47959895-7487-43c9-b90e-8d4630a81d77", "value": "9F83127F6D2F38ECC515D1A99E3717691B305EA5855C806C12DB389E21ACCC28DB38E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222085, "uuid": "c5384eaf-842e-47ef-b1a9-5206b648ce30", "value": "1536:9NZdYvANUL+q1zmW7iPGLuhCWdHsh1oSFWsfEFhHqLWk:TUJ+xW7WOsZdHAO5hKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222085, "uuid": "37b08921-50a5-4a23-9b42-6e72f6f5fb05", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222085, "uuid": "f4b5a0e3-2af9-43fb-937e-e5a1b8794e69", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222085, "uuid": "dee8d9b0-c30e-4f32-be8a-c6f79a73cf57", "value": "info-2111735524.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d3edcfa-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220269, "uuid": "35fcb462-9210-46c5-8ec7-ac6821daf7c5", "comment": "Malware payload", "value": "c57cfc05dbc224d5db6d75461ffcd2f2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220269, "uuid": "4ac88df1-990e-40c0-b915-9cd008a37457", "comment": "Malware payload", "value": "1e7c1620b90d00df56a3d709274ba713b19646c5c974095aec99ccf371fded32", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220269, "uuid": "aaf50423-9efa-4e2f-884e-0352033263f3", "comment": "Malware payload", "value": "fa08137e8b9ce44e290aee85cf59b6622f611d9c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220269, "uuid": "68de36c4-d098-4800-8e85-8707f8743c49", "comment": "Malware payload", "value": "e46c60ec5c369b75339b886a546e943bad830728b96f594397a71d30ed364b96a6e1d141c4ecf62b87dd50fad47ee098", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220269, "uuid": "c8c5add2-0d16-47d6-aaa0-872a4e376d81", "value": "0983129C30FF0144957A68B8613FE80750FCAFDB2D37B74947308574AA114EAB6279AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220269, "uuid": "c5c749f1-2fec-4cc0-971b-35d850264f2d", "value": "1536:or7l+KI0ejUgUlrZKFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbXYZTa4hpE:q7l+NUhlrZ6O6xoKDShicdBMM1/XPQTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220269, "uuid": "04366d3b-fec7-4346-9960-98f646ad0671", "value": 86793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220269, "uuid": "c2f75801-1161-4026-982a-0ae1d7c0dbd2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220269, "uuid": "878866b9-c0f0-4493-9839-8f9ad13a0117", "value": "info-10480495.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80675400-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219603, "uuid": "47ad0b61-4e35-47da-bc6e-8d9cadbd583b", "comment": "Malware payload", "value": "82f41b765155edb3dec673b69558f7d8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219603, "uuid": "1856ec4d-82db-4961-8f2e-61ec5bbe7f8b", "comment": "Malware payload", "value": "1e8b7ca11f6f9f70c92b5da16939b6eb1f93a482ce51beac0ee8da5ae0bdee99", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219603, "uuid": "b74b9e4a-1af0-42e0-b960-12ae9de7fb40", "comment": "Malware payload", "value": "fd8ee467ebeec1db54b16c7488ca4979129cc832", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219603, "uuid": "1a8084b2-6dca-4cf5-8622-519e35046086", "comment": "Malware payload", "value": "385cd88219eef76b788d43ce4604763d6a9d9004c493006c1ae023711a9b01d1f5432d76dfb887d58dadb3ba99cc623d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219603, "uuid": "460eb468-67cc-4bd5-aecc-aee816e5bc35", "value": "B2831277BA712DFC1922E520E128EF5E29FF2E43B165085DCA7C143751422EF3E942A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219603, "uuid": "5438c14c-1879-4dba-952c-f5db2116fee8", "value": "1536:KeaAK6Vo+9WNqQaiwotTqFUAAWBu3SNZzTJAsB0Ic6DMADMt5zC/IDIz10s:KVAPocWxvtTqFqCNBJAIlcAGIz1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219603, "uuid": "649d7336-f8af-4e6a-a13b-169df4857794", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219603, "uuid": "cf2fc661-68eb-4045-9381-e4d6fd387905", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219603, "uuid": "98e44c87-2d8c-401f-9999-e42a8391ce37", "value": "catalog-231254380.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d3d424-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220018, "uuid": "06db541a-54b2-4342-bcc1-c5fe9ac5a1f5", "comment": "Malware payload", "value": "722dccc78ae8ba2e5ba96d34a63e1bd7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220018, "uuid": "ddffee8a-93b6-40d1-ad4d-5b70a609203a", "comment": "Malware payload", "value": "1e98ad51c4d27938a9e7970f1d81c375a3832ef07d78d2f837cb4959785fe0f8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220018, "uuid": "a01af3f5-0840-4a8d-8fb4-7fedd1feca16", "comment": "Malware payload", "value": "f0bc3a86d3492f5fbedb18abbaa02f5de18d6a8a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220018, "uuid": "24f43b55-1880-46ca-a4e3-8350c1968354", "comment": "Malware payload", "value": "47fd92ccd1cd36b2c2306281b2e7255d69a6003f07e2124da2db53abca17424c30eb0a027083c09aad1f8941025e6f02", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220018, "uuid": "195c9371-77d3-4610-8214-317c5a7d01ef", "value": "10831277BA752DFC5922E930E128EB5E2DFE2B43B164445DC67C143351422EE3ED42A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220018, "uuid": "ae18fe48-73ee-44e8-9c7f-816a760eef71", "value": "1536:qaeaAK6Vo+OWNqQaiwotTqFUAAWBO3SNZzTJAsB0Ic6DMADMt5zC/IDIz109:7VAPobWxvtTqFKCNBJAIlcAGIz1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220018, "uuid": "e16b69e0-a3a0-4337-9ee1-252cd550281a", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220018, "uuid": "f3e42b59-6d40-4059-9e81-a29b77f58ba0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220018, "uuid": "15329417-c3a2-4066-9d25-4b4fdfe71187", "value": "catalog-471655248.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eedeae3-a419-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619171524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619171524, "uuid": "c00c7602-16a2-4b6c-8ee5-fc6059903d16", "comment": "Malware payload (AgentTesla)", "value": "79cea37f2d2e1ba2e024846f7b9efcf3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619171524, "uuid": "9494c135-ed66-42a8-8c0c-cdd424181601", "comment": "Malware payload (AgentTesla)", "value": "1e9bf82ba143cb0a8a9d736a716bd01b108f544173d740c96332ef1263c5cecc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619171524, "uuid": "7bb0e08a-2bf2-4bd6-afe9-96857e1ab064", "comment": "Malware payload (AgentTesla)", "value": "77523ed2ff5ef83161b2f31f2e5082064184a0b0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619171524, "uuid": "e6a174fd-1679-4e7c-93ae-730f4978be1e", "comment": "Malware payload (AgentTesla)", "value": "d0e28bb04f475b9aca2774419c84ff0241b3c489451060c5409b08e119ad5b806c7b76d64fef6be5c361bf4c3877c3a6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619171524, "uuid": "870949b8-0c61-4c89-99a8-ed91edfcc896", "value": "D9C423AE2BF8F55C510AAEBB3A4F9E9D44B08B363331AD53C601988F878058CC7DD559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619171524, "uuid": "3a25bf2e-02f3-44c9-81d4-c039409e847e", "value": "12288:47a5+OLqIP2jn231akv9V5Tljb0nhbr+mVDPOQWD29Coz+EHJz9Mg5aay:4WPaq1VV5Rb0h+xQk2cEHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619171524, "uuid": "1678c61f-b3e0-4d32-9d14-119c995c37b5", "value": 590343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619171524, "uuid": "1d88b8aa-57f8-49b7-8568-6c76f8d016b8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619171524, "uuid": "80bf924d-ae6d-48ff-911d-e0d2f27cc5be", "value": "_1221000880.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8fcf9ba-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220638, "uuid": "0d062b1c-23e5-46dc-a295-577b6a1e4acf", "comment": "Malware payload", "value": "a0ae7fdbb41effb329c83cb6d74b4ed9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220638, "uuid": "0b3c2ebc-2e4b-482d-b6cd-b8e096bb1cef", "comment": "Malware payload", "value": "1ea9a1775151c9eb7077235984a7fb74f0fb91198b1f4269839f8e24c7aa1495", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220638, "uuid": "3b21d9f8-5eef-48fe-ada1-8cf7c69d12fe", "comment": "Malware payload", "value": "b0663dce3b305cb88920271a3306586f5abe1125", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220638, "uuid": "41c7ee1e-39ec-42a5-a279-9e80b3244bf1", "comment": "Malware payload", "value": "4ac40003d6d557c867e97f7cce192acfc5bc2122c6820c566cca8e9bcfe13a352cb1318b23a3080143db639b23c8e44e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220638, "uuid": "ccec97e5-4ac0-4807-9a9e-d0514b63657d", "value": "5A83126EF462586E81AEE0B3913F375825EC52C1F434979BFD2D3D0A98769CC2D0981E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220638, "uuid": "5d03c9d5-bcb2-4731-aebd-49df0d98ade7", "value": "1536:h/VtmQNt5s5t7mgV3eE7JWgtrQZcUT7oqlaHvvbFq9GHocnoe1RqfwSOJrpMEIpf:htAQzS5tSCrIGUT7o/v096oiBkwPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220638, "uuid": "a88c592c-6663-4f65-bbe9-aa295ab83002", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220638, "uuid": "3287bf69-aad8-4a0e-8a50-ef5b64fff85f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220638, "uuid": "b862454a-c86e-4e73-9903-a7d7f3582621", "value": "info-1280160291.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "997eae80-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217927, "uuid": "f994356a-65c3-4bbd-8526-c5c4cc8b268b", "comment": "Malware payload", "value": "eb2d9bb37259abbf3c06a34503618202", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217927, "uuid": "7a3cd8e6-3fb6-4964-b12f-1aa0b2dfcff2", "comment": "Malware payload", "value": "1eba7214027b6ae4a7a87eea0f501dbb89f0d6bb9866cb68cc43dad770b63e17", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217927, "uuid": "a8e78a8a-d139-4d52-8452-907041b0280f", "comment": "Malware payload", "value": "59fbc1d21dc3ec5cb7a2674fbfe671bf4d0a80f7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217927, "uuid": "24d89a83-93b5-40aa-9470-ae55d484c40d", "comment": "Malware payload", "value": "251e895c41b1783eed1dd169425af4e6bf74cffdd85611827d276d3bc16a0238c38c84dff57ebd3f96ac3aae459fcde2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217927, "uuid": "3319aabc-7e21-40f7-9474-17cf066598b9", "value": "EC83028BB4D8433ACB3523F658AE5E4426B1A47F040CC6DC75D73A78AB53672A57238C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217927, "uuid": "86f81fbd-d76d-4dc2-bc36-f50a0a7a9ea5", "value": "1536:HEwAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvT:HHijtuPmU9j7+XFWtYe14hbOjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217927, "uuid": "537d1290-357e-4898-b045-6cef83f54a46", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217927, "uuid": "dfb2470d-193a-4385-bf57-3408f3313555", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217927, "uuid": "f19f7bed-298d-4f9c-9ea4-dc55a13ef54c", "value": "catalog-1240784967.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf1fa5ed-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218017, "uuid": "abf37e3f-7b70-4b3a-9f55-861ef238a80c", "comment": "Malware payload", "value": "0b27c83fc6bd9cae3a9fd535e42b7a27", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218017, "uuid": "8f5219b5-58b4-44b5-9194-c3b0a4e5c34c", "comment": "Malware payload", "value": "1eda0bf27bd64c3c18bb1c1141b769d5cfe0b07fc495dcf8577da2edf12d58b0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218017, "uuid": "b3214a12-1ea7-4379-aa74-303778e35edb", "comment": "Malware payload", "value": "817dcb11a5fb513a108473fb9485c69d25fafd4e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218017, "uuid": "867e4c26-ccdc-4ab1-bf76-7468597f86ba", "comment": "Malware payload", "value": "ab81fbf9474ac836d9ba6d67520b50789b2f04be36377a13c158d25298884b9a319db461ab106d7ebfaace6482a78aed", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218017, "uuid": "233663be-41da-4f74-942f-33da8c634bea", "value": "BA8312B347D9689D7167FC2882647F8F59D95B23AF040C4F8AFE0B6B11974AD3690390", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218017, "uuid": "935aee9c-cab4-4f02-9de8-193b9e40ce55", "value": "1536:yA2fnBKj0MlbCIZi+nTnfZA6l3SNZzTJAsB0Ic6DMADMt5zC/IDIz10O:sBIZiifrCNBJAIlcAGIz1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218017, "uuid": "5fa3409f-c0bb-4ec1-862e-7290e07d5aea", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218017, "uuid": "ce346c03-2f09-4ed7-8884-6648e936c7b0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218017, "uuid": "1025fb0d-4d03-48a7-96e8-17a51f25ccf1", "value": "catalog-1295487410.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd2a3dd-a407-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1619163655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619163655, "uuid": "582ab8e4-7aec-4111-97c3-9991220f79c7", "comment": "Malware payload (AZORult)", "value": "c617d81115d52c52e58c8fb001fc1f56", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619163655, "uuid": "0993e74c-4014-495f-b5de-f5a0ca8bcea2", "comment": "Malware payload (AZORult)", "value": "1ef555bdb2c274a6d0920d7fc6526b8e9fd733fb5942a624cf647b5f33283f17", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619163655, "uuid": "be657075-fefa-447a-8f7a-690a730d3f3e", "comment": "Malware payload (AZORult)", "value": "dc5c219bc06fe61aeaec1b6c89e3a85273dd873a", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619163655, "uuid": "f24ef519-ee9f-4412-8aff-9b01f7c534fa", "comment": "Malware payload (AZORult)", "value": "862971f1e1f17c5f8e8e7cc7a2af8d04d3e9d5cfec19cc9ff9f0389f092e90051e48e3dfc2d5a913ae7a07176e465fd4", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619163655, "uuid": "83971e86-d6c0-41bc-aafc-a8969a94e8f1", "value": "0424F1A63290D8A3DA7107710D7AC6769BE2EC2409E6A2477BD43F4F39367C7590C1E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619163655, "uuid": "31e26800-875a-4619-a27a-c47efd71e6b5", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619163655, "uuid": "18f449ba-05cc-4bd9-810b-f19649679fcd", "value": "3072:GEre7GjyCaFvcmY/FJbiyd5FDkSpgdW89IaQBRJWRRPVVIhhUCDVZ8NoI:GPXXY/DH9kSpgdNuBBOITVaNoI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619163655, "uuid": "00031ab9-e018-45b9-b671-4ee7d78b02de", "value": 228116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619163655, "uuid": "e0d899c3-b14e-45c9-a64e-bdd1434a7806", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619163655, "uuid": "edea38b7-ca21-4889-9aca-a536a007cd75", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f1bb6ae-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217695, "uuid": "8b00117a-113c-4449-846c-8c95ec5ef6a1", "comment": "Malware payload", "value": "bd3f528813870461a8da29f5f90c375e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217695, "uuid": "ea7a90b6-5060-41bb-bcce-62486f8f19e2", "comment": "Malware payload", "value": "1f027ead939cdc168c966b65d26b5156b0f49242b92f16b4d44ab20563d30277", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217695, "uuid": "55c8370b-531d-4d71-be75-a97281d732d8", "comment": "Malware payload", "value": "28420a24fa1865b18239dd5b9266d861652c4102", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217695, "uuid": "680fd594-ccd7-40b0-aa1c-68b57d85ca57", "comment": "Malware payload", "value": "ccb496e20f6ec82f762b99c169152f14663272462fdc50ae48946fc97432dd3d299baea96638ea79a74fae09777caffa", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217695, "uuid": "79f5a713-8c12-45db-a37a-9cc6537c1ec7", "value": "CB8302C5FE771FED8C998D398066ACA41E17CB85D11B2268B02C39F3261D7BD67018E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217695, "uuid": "c6d73e5b-8ca2-4b2d-82a0-f8b2b023451f", "value": "1536:xE+3fNtg2tq2vxQqAvqBuKXxLXUAAWBHTe87VqINbtezgVRxr9AiUbQTKXs8FI+X:xlPjtk2vxQFvaXxLXne8JqmdIbLjFRbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217695, "uuid": "b7db02f8-0795-4a51-aed7-3c6e066eb0af", "value": 86929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217695, "uuid": "515d6b93-4232-4551-8994-77ce1ebb6ddd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217695, "uuid": "4e6e3488-3eec-4a70-ab47-b3c7c90aa4af", "value": "catalog-110691717.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858b4eff-a3f0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619153899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619153899, "uuid": "4692d104-00de-4f3c-ae89-050fcc0e5ed3", "comment": "Malware payload (Dridex)", "value": "599be088d3897daf121ee7b588b219d4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619153899, "uuid": "441910df-10b5-4194-86a7-e2287f783b1d", "comment": "Malware payload (Dridex)", "value": "1f13b0a5384353c13a0a84261ec9d45bcd77fc8547acdb36f118f788317cca64", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619153899, "uuid": "fb9dd41e-c79c-41ea-8275-a5731e5b38f2", "comment": "Malware payload (Dridex)", "value": "55e85c9456e63394beec1c17e159975c5f2bd055", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619153899, "uuid": "f0f49c97-6140-4d6b-bb03-50ad8847bd60", "comment": "Malware payload (Dridex)", "value": "3be01af03d6133c98ceeebf9ea3c0e66f5b8074a888651636c7117a97505fb11fed2d7745024cc0b2fb3a6db321ab980", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619153899, "uuid": "82e4226e-7615-4a6b-bc50-08e7169cdb38", "value": "B183F18A623D900EDABD7D3E921F1525706D7100C8E9F30E6C3E193466504A7B7EEB9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619153899, "uuid": "fe0267ee-1b1e-4eda-87b4-359209fb900a", "value": "1536:38uaH1eGfA0TO71TzuE/En/dDuL7QQ64eyZJViW++poHnvt:s71eG4REwXQQteyZJAW++4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619153899, "uuid": "3fae512d-0329-436d-8a07-c968576925e3", "value": 86045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619153899, "uuid": "b328e3f4-95a3-418e-8c02-f09be08407dc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619153899, "uuid": "a6f2db8e-9066-499a-9a12-871231399e23", "value": "1f13b0a5384353c13a0a84261ec9d45bcd77fc8547acdb36f118f788317cca64.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27bcf816-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219454, "uuid": "9a209c7a-ce77-4fd7-acd9-aad1e7f7ee36", "comment": "Malware payload", "value": "9ffc2f4339c4ec8fbd8538ce8adf9b6c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219454, "uuid": "5e419c58-8a4c-4216-ab2c-40901bd0a3a6", "comment": "Malware payload", "value": "1f3125202ef991c37bc0891289a40d4be565f120e4eb61cc0b3c6352be0f14b2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219454, "uuid": "d84b2eb1-577f-4b7f-a81b-f4c515676438", "comment": "Malware payload", "value": "9d31da17d530c13019d3e3cb5f923b2d68c766e0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219454, "uuid": "0a94d6de-d5d8-4b71-8e3c-943584485088", "comment": "Malware payload", "value": "9072d86272637d3d774dbcda98d56fa767bad1a1ff3654204b89c1af02bd61d10a0047e88bf24a8fc1a0f75bbe161421", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219454, "uuid": "42263fac-877a-487b-a667-e3fb8012de12", "value": "33830276DE8F8289C016B23003787FAA1F686B7146A1141E5AB0747B2F5B9BD4C85FD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219454, "uuid": "979a789e-b297-495a-aa48-82bb60ce7f31", "value": "1536:OEZHCzlWAXdZ2rQD2aCvdyWxaqQ6Rxt5AB/aqPwL3VbCb4:O6Czh2QKmm/Qwt+awaxCb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219454, "uuid": "29de5601-47ba-4718-a51e-19ecaf14de51", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219454, "uuid": "8a5b1e1f-9d85-416e-9b19-e9456aa8e14c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219454, "uuid": "28f42727-a2f8-45ef-8f7b-ed5f991ac97c", "value": "catalog-209946546.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7e7b020-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221092, "uuid": "6b2895b8-fb03-4c8a-a463-fa95991ad16e", "comment": "Malware payload", "value": "ddf8c170f8b16af8883ff12df49d7e34", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221092, "uuid": "4729aa72-a649-40e5-b474-22d5588f4a76", "comment": "Malware payload", "value": "1f34ded1639a809599bf8c683400d2b75d205f44b615c5ccced44c607eb6e59d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221092, "uuid": "87e8cd51-c445-4434-b332-603f15a5c16a", "comment": "Malware payload", "value": "8aac3d596101ffa40d9c56832d5ef9882996a139", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221092, "uuid": "4857255f-6ad3-4ccb-8976-b9b218a99d6f", "comment": "Malware payload", "value": "4ee6d6708f0c622e565c9bac4bc49ecd226a680cbdb1d4936f4d6502340d780a5412cc93c2171b668aa5f27af1134301", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221092, "uuid": "bc2622b4-c46c-434d-88c7-c7a3c45fb124", "value": "668302F02CAE15BA838DA676A07D2643CC9C1FE116586FDB631153282EB1CDF803B675", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221092, "uuid": "892ca72c-16e6-448a-b7b3-345d573156a1", "value": "1536:Kr7l+KIUejUgUlrZ8CWb/bLCDxxp/ERd9QnGlRTH7qrelcW:I7l+tUhlrZ8nfLMZERQnGnTHMeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221092, "uuid": "ac55bdf9-233b-4b9c-86ea-10e8f274882b", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221092, "uuid": "f8603d5c-4fd1-4b77-93c2-0bcf215d7ff3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221092, "uuid": "02fff2e1-9f9b-4c90-a303-145c313de717", "value": "info-1485563950.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad1d60f-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221580, "uuid": "3bfee21a-ab45-4f7f-b709-1f1ee9ef0521", "comment": "Malware payload", "value": "f3116f5607c9f51fb64633c7a76a78e3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221580, "uuid": "fceec5f5-83f8-466c-bcea-ddc28a24fcbc", "comment": "Malware payload", "value": "1f3627ea42fb92ed2ec99befcc4a05ffca1070379902e5d1296642021b9fa938", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221580, "uuid": "15348b0d-7bb9-4750-8249-24f634a1351a", "comment": "Malware payload", "value": "c470d6c26565fbf4b2d03eece1d81fa400bdc28e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221580, "uuid": "23e1022a-2eea-4136-95a6-584299402069", "comment": "Malware payload", "value": "a0e2a7127bd0597a4c85da1f6085fed4ef3f7a0c84f3bb9933e955eb6730300517e2934e9a3c0f65bf3b83bd0e438b63", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221580, "uuid": "2e6572b5-a3ff-4d02-8f67-49928dc96570", "value": "E0831317DC6E14DCC06E46A41CB2291D94709FADC01C8489B1AEBBCF31E8E499EB7DE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221580, "uuid": "c1b00496-f03d-4791-a171-ea7b27aa5e96", "value": "1536:1NZhdaLgblJKa6wSp6yMvBjqqxPGLuhCWdHsh1oSFWsfEFhHqLWu:rZZJt6l3MvBjqq5OsZdHAO5hKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221580, "uuid": "97e3fa91-2ea5-40bc-8cea-f891f43e9182", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221580, "uuid": "25edd047-9936-472a-a502-f6f41cf2c768", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221580, "uuid": "621afe2a-32b4-45c9-b625-25e271f5afa3", "value": "info-1760696650.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd54655b-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221021, "uuid": "2f99ab3a-cabb-46e3-af0a-57e504ba782b", "comment": "Malware payload", "value": "2a2c460e432393dbe4ce3a7d3c695c15", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221021, "uuid": "16fee5f9-2251-4769-9ff1-a2b09da01073", "comment": "Malware payload", "value": "1f387bdc59a2c5b0944a6a3e708126b0e113bf9710d0ac2a0ad026a74bf92706", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221021, "uuid": "2ed3d2f9-8108-4443-9861-de192263cd03", "comment": "Malware payload", "value": "9151be3abeeb175ef0828b4cbbb6143ef268238d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221021, "uuid": "111598f1-d4d2-4aef-a18b-cab04f22690c", "comment": "Malware payload", "value": "8ba66a4d23fe428b441b92d1868b4a888b832bb82fad4b2b21d5a1e0d46dfccca8237aef4c665757120028f16bdf0d8a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221021, "uuid": "016c10d4-0751-41e9-b681-9c9a926b3bee", "value": "1B83124C2C95E29EDB5839A217EC31A86B942333B7F502EACC5E72327512E36F1041A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221021, "uuid": "9613df55-6567-4c09-9eec-44530ff8ebf4", "value": "1536:twJNfD6jITxi78nLkb/Yw3LCq1GeOalTJkv9c/EWd8E//nfYRq1o+VCQHeWnsUWH:twzOEli8ne/L3LCq40VJklMdT//gRL+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221021, "uuid": "015cbf11-3746-45f0-8f31-1b90d764ebea", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221021, "uuid": "f23abbf7-7e4a-4503-8de5-f31a6c7ffd7b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221021, "uuid": "c2a48980-5f90-402d-96bd-d2e7c63118ba", "value": "info-1440268864.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4473cab9-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221221, "uuid": "9e6d84b9-931a-4a41-95b1-2b12beabf12a", "comment": "Malware payload", "value": "7c4e1fecf8cf53335a28c48db33273bc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221221, "uuid": "d889fc83-17b0-453a-8d75-b2489792eb03", "comment": "Malware payload", "value": "1f3ee5b3c48f1fda8a1990e98fef53f1fc3d9670a4b489a78e6d7dc3a7ef4bd0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221221, "uuid": "a4a18b8c-61a6-414a-b955-7a3bad6a66e0", "comment": "Malware payload", "value": "ed7c00c9ed66905ad2e58e431b9f37b2fa88782f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221221, "uuid": "d87ab8c1-06e3-4359-a5a1-324dae310068", "comment": "Malware payload", "value": "175fea2522e4db817cc195443028cf0ec97b516c351b3fb839f048263a8793fa6e4e62f231f3501e440ab919e56b8bb2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221221, "uuid": "f5e492a5-6c5a-4c1d-9941-47bee78c7a81", "value": "D583024B598828FFA255AF10232CD99AAA0FCEF4D9745514F20BFB5CD0B7B29727041B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221221, "uuid": "04f96520-22c1-41e6-b41e-923c9310e0a4", "value": "1536:z6sEDF9MwsqZSCzfAkZ8kISNurvd197v7UZoctQ2kPo+4mpRlDi1nUSUqxuus:z65R6wsqZXzfA21s19T7YptKRNpoUSUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221221, "uuid": "3c71fb41-fa4e-4507-9c41-11201f141e2f", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221221, "uuid": "1b4af871-532e-4bf2-a4f2-3942f5e0d8c0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221221, "uuid": "3d96bc84-9c45-4918-9e07-3f9251780ca4", "value": "info-1562054477.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "692a9829-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221712, "uuid": "9be2bdf4-278b-4d62-ae66-fd6f9fe6cf26", "comment": "Malware payload", "value": "e0c6993512b3adba076f595072d4202d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221712, "uuid": "ab4a81f2-90df-4e6c-a18e-6360a9592d64", "comment": "Malware payload", "value": "1f432948f5d2c61b569bbf01bab6f5c08445174ce13f7948f3a58e618254fa2e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221712, "uuid": "4f3c4dff-6d94-48e2-a6d6-a42277e7dbec", "comment": "Malware payload", "value": "41dca5477238c0c16660b32d795c8554c822868b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221712, "uuid": "f20f88df-69f4-40b4-be4b-34e72dfa600d", "comment": "Malware payload", "value": "84eadb048a29985a1ce8dc12a7bec31f4e7e0eee2596dba0446487f6821a08e5a5bdfc471f7a12d97829538a6ce50080", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221712, "uuid": "cc009bed-34a8-4523-b438-edf7f73be6c8", "value": "8D831207966158FDF16ABF01373EC8CFA64ECBE1E92519C0F20E6F65D2A3399225440B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221712, "uuid": "a84ef22c-a41d-4e9b-95ac-ae856fb92ab5", "value": "1536:XHZbN5m6RtLlLHfAkZ8kISNq7xWgwMQZL197v7UZoctQ2kPo+4mpRlDi1nUSUqxb:XBm6XLFHfA210wN19T7YptKRNpoUSUqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221712, "uuid": "a0a69b89-628f-4934-a620-ce5fa8480608", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221712, "uuid": "1772d1c1-fb18-4b36-b250-cf0134493b29", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221712, "uuid": "8584093e-2c04-403d-99fd-8d65bb88f28c", "value": "info-1834091194.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a292073-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220774, "uuid": "6c058cc3-281c-4542-a1a7-99825212298b", "comment": "Malware payload", "value": "9718d5bfafc89998861516ef27c0e75a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220774, "uuid": "3ea38208-d1dd-4e77-9759-86e6bdf3a810", "comment": "Malware payload", "value": "1f4978d7b2c2f06a9e7b2205a901772134169a19085f918ac6ea52d5fdf95f36", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220774, "uuid": "70dd08d3-8ced-4ad3-8e23-cb4fa1a9c8f3", "comment": "Malware payload", "value": "e3094552c32d7be3578910cb0e061c5371f58135", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220774, "uuid": "048d9bf5-c7c5-4f26-8874-3cafea882d25", "comment": "Malware payload", "value": "2ce649ef39814b35514692305ffc479cf23b49e7b6d9c339612c067ffca5a7c9e318e62cc3e194d37054b2751b463059", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220774, "uuid": "d440dd12-31ae-4ebb-a001-6376c98afda7", "value": "4B8312B7F9776DB6C15CE1E3A63E122824EC81C07475968BFA0A5E0AC95AEDD5204C0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220774, "uuid": "4736287d-8af1-4267-979b-686c16225b54", "value": "1536:vr7l+KI0FlLHfAkZ8kISNq7xWgwMQZcUT7oqlaHvvbFq9GHocnoe1RqfwSOJrpMC:j7l+6FHfA210waUT7o/v096oiBkwPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220774, "uuid": "5aa7b294-7dcb-42be-8fc2-694a3bfb3ec6", "value": 86799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220774, "uuid": "dbae660b-c11d-42c8-bf19-72b06156058e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220774, "uuid": "89b12028-18d0-4777-b93a-229b6b46e32a", "value": "info-1367417717.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85113b6-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219375, "uuid": "583d5150-5f0a-47e1-b6d2-73dc4d49cf6e", "comment": "Malware payload", "value": "e00fb3e51841cd692f59272e7b4f02f5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219375, "uuid": "8e145c49-0374-4699-a2dd-41918f3dc182", "comment": "Malware payload", "value": "1f565695cdb8aaa0a1b944673d6fae363f629a18cc4d8eb324748cdb832eff19", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219375, "uuid": "a51738e8-5e5b-4ef1-95ac-8d3981e44064", "comment": "Malware payload", "value": "2944a0b172f7ee39c2777693fd074493d2260329", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219375, "uuid": "fc109efc-a0cf-4c97-9ac3-f4d89f28217a", "comment": "Malware payload", "value": "c58d30ad4be85e8a28109fef86d1249e29cb45e26f7a5af1749df2cd40957967cd11a2b770a25fcfe2a84cdfaac7a18d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219375, "uuid": "7ad96cfe-93ec-4175-9728-fc2c37da313e", "value": "3B83028BB4D84339CB3523F658AE5E4426B1A47F040CC7DC65D73A786B53672A572388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219375, "uuid": "eb9aac93-01c2-47e1-aa6b-d859de430cc3", "value": "1536:5EwAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvK:5HijtuPmU9j7+XFWtYe14hbOji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219375, "uuid": "1049fcbb-d22e-44b4-a636-88a2365b5f6b", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219375, "uuid": "b65eaeb9-65e7-4a2e-8a59-74fda2ca1c10", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219375, "uuid": "ffc91995-168e-4f97-b6fe-accda64b9db2", "value": "catalog-2047534349.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16451ce8-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218137, "uuid": "d1b9ea45-8ca0-4654-9f2f-cfbebe3e7956", "comment": "Malware payload", "value": "199b0326d0db4f776e8857d148d52027", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218137, "uuid": "9b51734a-87b0-4013-89f7-88a543a3541c", "comment": "Malware payload", "value": "1f6228f45ea09981a19ed0d5243193d45fbf371bfe6e52fa72dc3f351fcb888f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218137, "uuid": "5a68a7f2-cc82-48bc-9f5d-75f9f28ad258", "comment": "Malware payload", "value": "9befe73b1fcb9c453422e560af16aa17b9703d34", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218137, "uuid": "b8005db7-4f28-4dc1-8cf8-b82ca44b1b8b", "comment": "Malware payload", "value": "37779a6ae710dac13b94422b01298c10661fb4f43f1c668b029373ba75366a5be758453dc2b80be65adcef02524a4370", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218137, "uuid": "97c8997b-d436-464c-9fc3-2485d8e19acc", "value": "E48312EBCFEA4D884202BF0673069DBBB454280C6018BA6A7EDD11506F524A0F4B7DED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218137, "uuid": "25f1f9b7-a8ba-47fa-9183-80d5fa026f50", "value": "1536:WNKLWkP7EBmnbRARpNdZ2rQD2FPdo1f+5ff9fuQjMCYNst+IHClPLqkwD0DCuADl:2KLWSFbkpwQKW25NfuQjMCYNBwltD0Di", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218137, "uuid": "132bae1b-79ad-4079-a565-e89b40311ad2", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218137, "uuid": "a6878377-42f1-4a5f-8f8d-4b21e118cc6e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218137, "uuid": "7d166273-cea8-4fcd-8d58-0906e722b6da", "value": "catalog-1345294874.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a7910b6-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218654, "uuid": "df46a844-de95-49b5-8795-a6c6ed02b7b8", "comment": "Malware payload", "value": "0220f64da8a5728d37f12a633e254fdb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218654, "uuid": "11a2fb74-81d6-41ef-aaf4-c5df6ecf693a", "comment": "Malware payload", "value": "1f6a42424d88bfd4528e5dda0384f56cb5846fa8c57524553441b0c206cc815c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218654, "uuid": "641c692e-2c65-4f66-8ef5-677ecfedc28e", "comment": "Malware payload", "value": "6d917e32a20bafa1866f3bd88f5e3d3c3f13bf2f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218654, "uuid": "1db8d154-d6a4-45a4-b28e-79bf0be228a4", "comment": "Malware payload", "value": "0f85567954ac4f8453145c71af952011fe922dd6c81abfe15526c9a4ea1dc8239bbafc1071232665e84329d972d349a5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218654, "uuid": "7f4c1116-419c-49ee-80db-823237fe1025", "value": "218312A306CD544D7117F828C1647F8F99ED8F579F040A0FCABD472F11969BD3590285", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218654, "uuid": "94fa13f8-e365-42f0-828b-521d27f4e6d7", "value": "1536:Nh2fnBKjQUgFsqi+nTnfZA6l3SNZzTJAsB0Ic6DMADMt5zC/IDIz10tK:NoJiifrCNBJAIlcAGIz1gK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218654, "uuid": "f51ce349-a057-4e9b-96a3-964ea4851d1d", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218654, "uuid": "b309e960-e72f-4a55-91bf-fe54a2aef58f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218654, "uuid": "5d52ccc0-3053-402e-91fe-c1f9635e2fe1", "value": "catalog-1655905421.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e212e00d-a3f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619157061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157061, "uuid": "661659e3-99d5-406f-8a71-d5b31dbe0282", "comment": "Malware payload", "value": "66cd8fe6a6e97707cbb2ae97bb7f081a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157061, "uuid": "963af7da-1d4e-48ca-ab62-ffc58b597899", "comment": "Malware payload", "value": "1fac54f05196c65a04f507d7612b1fbb900f68967cda76a73d0d658c7d5b9aaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157061, "uuid": "103cae2b-7e4e-4137-8c4d-7035027baa8f", "comment": "Malware payload", "value": "82511fb53e2131f0f32e358f4daf9ec6081f0eb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157061, "uuid": "36d62c2a-d720-4a3f-a42b-95c6852c2c20", "comment": "Malware payload", "value": "34740152619ebe07871a217a0ecfbd4b7fc3e0c879a21ee647c4780d0a5852cd1506d171b7f4f1ee974a6dfa31cf17f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157061, "uuid": "8a868d34-e211-4256-b614-421b2de4b100", "value": "6175D0AC7650B59FC497CE37CAA41C60EA50B4BB830BD303A46712AD994E69FCF151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157061, "uuid": "dc028949-732f-42d9-bd36-fd79d98f58aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157061, "uuid": "65f4f853-3e54-46ec-bc04-28b97d9f3f55", "value": "24576:tFwIKIFrPhNxRob5s11He7YnK7TAj9sshxDQgNFHGD+3eTt9HM3bW:UUhN/E5qQ09sshxDQce+e2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619157061, "uuid": "ed4ba815-da2c-49c1-8b03-fe641cf3a9d5", "value": 1569792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619157061, "uuid": "c4eddbca-043c-460a-9035-258ec131774e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157061, "uuid": "3db52c94-40bd-49ba-b6cd-fee574a9e574", "value": "VWR REVISED.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a527a7-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218139, "uuid": "4f3074c0-5446-437a-b50b-862c2c0281b5", "comment": "Malware payload", "value": "bb3215a8bb915de349d888b7982b280c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218139, "uuid": "0cff5a8b-7b40-4f30-976b-e790fb75901d", "comment": "Malware payload", "value": "200a7d0e3ecebaef16d6653911369cab8ba01f6bba3e952b04c7b1e18e17c670", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218139, "uuid": "4df436e2-941a-4e4d-af61-6907b357cb33", "comment": "Malware payload", "value": "7280cf3c6fad0978bfc877021ded381afdac1aa2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218139, "uuid": "96e4a0ed-fcdb-4587-b803-94758b952290", "comment": "Malware payload", "value": "a1ded3a4e69101044df2a0d3db948ea279a6c753dbc8dfeb5dd2abe83117104bdf008e53d9a6d9152eb0f83973dcff8f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218139, "uuid": "7f5f9dc0-296a-48ea-8a4a-0a24c38af22a", "value": "EB830276DE8F8289C016B23003787EAA1F286B7146A1141E5BB0747B2F5B9BD4C85FD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218139, "uuid": "ff6cefa0-fadf-480c-a26b-1599f77594ba", "value": "1536:+EtHCzlWAXdZ2rQD2aCvdyWxaqQ6Rxt5AB/aqPwL3VbCbi:+mCzh2QKmm/Qwt+awaxCbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218139, "uuid": "05db7ccc-6c5b-4f1e-8ed0-45652940ab94", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218139, "uuid": "b95bbcf8-d98a-4074-a7df-fba42f34cf72", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218139, "uuid": "4b0817b3-31b8-48c1-850d-8b45ba471e03", "value": "catalog-1346050270.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afb388d-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219567, "uuid": "b8ec8052-8123-4049-b194-9f527d60947b", "comment": "Malware payload", "value": "efacce4c1af56f80beed20b8a4ba5e0e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219567, "uuid": "2c635614-8d74-49af-97aa-8445945f5812", "comment": "Malware payload", "value": "200dff4c9e15844342b56efb793faa5597d90a637362dc06639c2d8fe0f7dc83", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219567, "uuid": "b6981c82-6a5e-40b0-ab0e-85ddd551a495", "comment": "Malware payload", "value": "4a616df86e151223440a814d12daf5abf11e9f68", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219567, "uuid": "e52a6532-9bd8-4ca9-bc29-ffdaa11c57ea", "comment": "Malware payload", "value": "ab0e898c6f66a48661654580fe24bb1ab2d1a1c52ecaebf286b0616a133d87ce5c37874e22bc08ce95f7a389b941348f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219567, "uuid": "e221aead-d3e2-4ac5-8865-e6cb80cbe56f", "value": "4B8302466EF50F982C1DEC2089164CF50E77CF6EC2872239F668247658486BE7A075EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219567, "uuid": "584bda00-9645-499e-a6ad-8ac479bd8bc4", "value": "1536:bL2dSRV1UgF68rh4Khs/9qDUAAWB9Te87VqINbtezgVRxr9AiUrQTKXs8FI+b3:bL20RNrhDagDpe8JqmdIrLjFRb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219567, "uuid": "13f3ccf0-d6db-4acf-a3b7-dc2bbe0f09b6", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219567, "uuid": "dc4c1231-9eb4-483b-8f58-159fe85083c9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219567, "uuid": "e5c84180-cd27-49ff-b65d-e81c7d4af3d9", "value": "catalog-2146375641.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c969a65-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217771, "uuid": "13f98460-2e7b-4cc6-b005-a09a8184a7c3", "comment": "Malware payload", "value": "450d91829abbc64adcbcd18c93ff3f99", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217771, "uuid": "e8096f48-8323-44c3-9f97-d6bacb0644cb", "comment": "Malware payload", "value": "2055d18f471ed133f3903bad2f874b626e9bcab80fc0526575abd4b89b74e72c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217771, "uuid": "86562de1-7305-489a-a356-d93c7de91f84", "comment": "Malware payload", "value": "1bffbbc371ec66af911d0a4da3e001a038da76e8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217771, "uuid": "a27e43a0-fbb1-49ae-9ad3-dc0fc811286b", "comment": "Malware payload", "value": "c4034560891e46d2ae6efb7ecfc2d07d29090f6115c4bc919be9299789af2e64928ae58ca8ae6cb9fd6dbe98ca41572a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217771, "uuid": "df98b2df-4b54-4754-b824-5f0d1397da53", "value": "038302CFB8F5473E47322A77051D0E5956E0352F0500AB9D3AEB35742B65A31E8AB38E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217771, "uuid": "6d92e2b2-1a4d-465b-bca9-7ae55d94be14", "value": "1536:PdKLWkP7EBmsbLlBRpNdZ2rQD2FPdoeVadrj7ZIXFWgKilkAq14HE6M5XL2l92VT:1KLWSibL5pwQK3U9j7+XFWtYe14hbOjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217771, "uuid": "d7264316-5362-44f8-925b-e33b9e6318fb", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217771, "uuid": "9081f2a5-59b9-4173-a56c-b2d69298ab85", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217771, "uuid": "461dfc54-d21b-442d-910f-4b4e149c9f66", "value": "catalog-1158887399.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19bdd9eb-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219431, "uuid": "09f8818e-fd74-41e5-99c6-cd447164c555", "comment": "Malware payload", "value": "2c76b7055306cb6e167b0a66357f6357", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219431, "uuid": "3015687c-dc53-4d32-a540-8454d379e000", "comment": "Malware payload", "value": "206fa91c329c9a17f42d0d17ce9dfa1e82edfb9acd630a80571ac3f667b20ea7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219431, "uuid": "e9c3e163-ffe1-467f-9ec7-d6d7fdcd2511", "comment": "Malware payload", "value": "fa192797aee5591e75e64d97b5874b54fbe64cdd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219431, "uuid": "bd87aa16-9d07-4dfc-94a2-c70865ace74b", "comment": "Malware payload", "value": "78e25d5929f2d2407d70c1789edd5be2ef413270b1158661e2e83c6a8cfae18dca0c676a76667231b6f3880052cc88fe", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219431, "uuid": "9024da8f-a089-4720-9c7f-8c9c36ddb022", "value": "A1830268CB9F8D949005ED0AAB12F8ED75506248706973BBAFAD1124FF478D5B2328F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219431, "uuid": "a7217505-736d-4562-a8c4-1e9d1a4ff7cb", "value": "1536:aA6P7EGmwH1zVQLQDYflSJXvoDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnY:aAY31zVQnIJXaM25NfuQjMCYNBwltD0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219431, "uuid": "9fb4d315-6956-4345-9cb0-b3c70bc22d0c", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219431, "uuid": "e2d613c3-44f9-4a30-9590-de494dce53a2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219431, "uuid": "e44aa497-aa95-4b27-bc63-b8855f4381be", "value": "catalog-2086168996.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1695ebba-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222003, "uuid": "07e2af98-1db1-42be-905f-6be2c7b1301c", "comment": "Malware payload", "value": "e53609b276dd69fadcdf5ccc73ba7415", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222003, "uuid": "2f006276-26d9-4fba-9f05-d7036ce1cacc", "comment": "Malware payload", "value": "208fda0274a99d62898b4bf8c49e84a814a44ba0be0005c839479554d91bdea0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222003, "uuid": "8b595d25-cadd-45c5-aaed-10f90a1f6a9e", "comment": "Malware payload", "value": "a8ed673582b27ef32c8a0eabeb56c6a76b47ba38", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222003, "uuid": "26124e8e-3d16-41bd-84d1-5f5cb1c7e467", "comment": "Malware payload", "value": "e186c0dd7a15a837706c18f8c4964ccc5f2748cbb1daa0aec66d43f731968e489a6ed4dcf5b7cfd092300aa2f8a961e5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222003, "uuid": "06d7c87d-ef5e-4cf6-90ce-51f34c9a21a0", "value": "3983126C1C0AE29FF985FEA357EC31981FC81373E1BA0399495E22327262A3DF5551C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222003, "uuid": "e53dac55-f224-4d69-9776-ac8dbd4e0543", "value": "1536:mNZdYv9b/Yw3LCq1GeOClTJkv9c/EWd8E//nfYRq1o+VCQHeWnsUWuopy8:UUJ/L3LCq4MVJklMdT//gRL+VbARD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222003, "uuid": "5cc9bd38-53a8-4042-82ae-300136ea768b", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222003, "uuid": "a6f4bd1e-6c0f-4c10-a1f0-f36518df2a35", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222003, "uuid": "b5fbcfed-c2e1-4db7-8136-6ba8e3bb056b", "value": "info-2055525378.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0cf3d1-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219735, "uuid": "234970e4-7d45-4a45-92e0-b0441026538d", "comment": "Malware payload", "value": "e219fb0dbe6ba329261105013a0fb546", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219735, "uuid": "555caf97-403e-4441-ac3c-8421f4b17354", "comment": "Malware payload", "value": "20b266a64c0658a3f84e5818853476c1ba49480ad3973797ee0bfb58c77611bd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219735, "uuid": "c0b8c94d-e7fb-4a69-954e-cace49b053e9", "comment": "Malware payload", "value": "c87877fbeb1a9d92088b3270e99a3f959ad84f45", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219735, "uuid": "e0d8ac28-cb99-447b-ac8f-e87726eee33c", "comment": "Malware payload", "value": "18b685d8ff04431d88e2c00087a7bc7769de0e8b3cd20b853eb9e9ef11a31eb185440c541603cc1e393a24fc1746a25d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219735, "uuid": "05ac88bc-3b0a-4fdf-a70d-58cd3de4a4e9", "value": "7683028BB4D8433ACB3523F658AE5E4426B1A47F040CC7DC75D73A786B53672A472388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219735, "uuid": "e95227fa-c840-4aaa-bf06-6284bc6fd82f", "value": "1536:CEwAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvg:CHijtuPmU9j7+XFWtYe14hbOjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219735, "uuid": "8092bbd3-8745-4af3-86de-efc541e372cc", "value": 86930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219735, "uuid": "2c66c913-2ecd-46d2-8446-62bcb8ac303a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219735, "uuid": "f4ab9273-dd0d-457c-8937-72c2b77ff144", "value": "catalog-314555334.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7177a5d6-a471-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1619209270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619209270, "uuid": "296115fd-c7e0-482d-b00b-7f5bc12abc6a", "comment": "Malware payload (AsyncRAT)", "value": "d475aca23350efc91bbcb3f8e0c61902", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619209270, "uuid": "208630e1-227e-4517-836c-6028b452eee8", "comment": "Malware payload (AsyncRAT)", "value": "20cb38b4917cc61ec7c022fe9971e96e8a1ac6a4515e2bd6097552ebff178661", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619209270, "uuid": "8b59d7bc-db73-46fc-b81b-eae43624c40b", "comment": "Malware payload (AsyncRAT)", "value": "d8db39f034bf81e645af848420bb156943249c52", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619209270, "uuid": "12fc042b-a72b-488f-87a4-75f43b05502f", "comment": "Malware payload (AsyncRAT)", "value": "def2159e04354d48e9f540354041ddeeaad8ba77abe00327023964f23055bf89d9c3720e126938c67969b43955e16c37", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619209270, "uuid": "39c1ddd5-e79b-4660-9c0d-f143b185a7fc", "value": "19233B003BE9816BF2BE4F7498F22145867AF1673613D64E2CC441975B13FC69A42AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619209270, "uuid": "d9ea78a1-7e93-4480-9f38-20b546eb50c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619209270, "uuid": "bdca0dd0-d48c-4a6d-b4c6-75eb76bcddb9", "value": "768:gugaNTokqd97WUHgAKpmo2q7R2eO0qCZANNPIGH1t/10bCEDYwVr362t9FH9EFUR:gugaNToTdQT23elSqGH1lCbCEDdVrn3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619209270, "uuid": "eed2bb1d-c9ba-48ba-9b65-634b4a96918b", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619209270, "uuid": "7c58fcbf-e697-4815-a6dc-3a7f0c42a311", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619209270, "uuid": "9a1e9c72-6d6f-4b7b-b9ac-b5d287b56a22", "value": "d475aca23350efc91bbcb3f8e0c61902.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acb27331-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219248, "uuid": "f607bb4e-2f25-4e9a-8a1b-b6b66b2c8c43", "comment": "Malware payload", "value": "688bf3b7374327f87f4fefa39c0b11da", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219248, "uuid": "30d43a5a-2111-4459-875c-9dbfc648ff90", "comment": "Malware payload", "value": "2117d1b0a4d7c3be74d209f08a05338b242b098a9d2f8a8bb27b4ee291396d7e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219248, "uuid": "21712647-6a3a-4898-b913-c3a84b9d4bc4", "comment": "Malware payload", "value": "1cb8e1d68a13c9d3750f2518059758d9d2ab469c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219248, "uuid": "98dd429c-d5c9-4fdf-a4a1-e5aea1cc1ff2", "comment": "Malware payload", "value": "f414db688a06d42037a32dbe94882234c128ed1675794cf68d9302128d400c632db8e145970900362882494ba7adcbd5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219248, "uuid": "ee209e4a-b56e-490d-be13-ba444c8f32df", "value": "738302EC70239AA5637345A6DD7EA0C32B6BCBBC441DB056A82B793649307FFE111531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219248, "uuid": "bb0c4350-11a6-4f3a-bc4e-d0273a5070f5", "value": "1536:fzKTWDE4Qgl8LS4v50FC+p7UjoB8+wXdpUna5ahL2dmTLUVVvK:feKDPKLRvaFjp7uXinakEmEVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219248, "uuid": "ff7ec9b7-ed1f-4511-8c24-661bfce59797", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219248, "uuid": "fe2d86a2-5a86-4f3a-816a-9521198d9c6d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219248, "uuid": "5ff053ea-c4c1-41d0-b535-7c5b2eb79504", "value": "catalog-1957141229.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfb3becf-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220568, "uuid": "f87bd535-ed7e-4bba-9796-f0217c951d1c", "comment": "Malware payload", "value": "7b5df23b11271319e0ada0b3c3374316", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220568, "uuid": "f785626e-ffed-4d2c-a0de-42bc10945cb8", "comment": "Malware payload", "value": "211dd751aa17bfc5a6ca586ec3f22605aaab131873590b1fa18e45e47711f598", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220568, "uuid": "d7a87508-8abd-4de1-bf53-a59140edcec0", "comment": "Malware payload", "value": "13507b81ba0cc51d801e3df141659b0da946f2ea", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220568, "uuid": "61a226eb-2280-425a-94aa-2a445db08450", "comment": "Malware payload", "value": "540179037290c43c7a26d5acf67950b2673ed9245393481a4bfe59386411a1ce21001c885052383b97837b8a1692cccc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220568, "uuid": "1c4747a4-c3f2-46b4-b4c4-0fc320084c35", "value": "8783126C1C0AE29FE985FE9357EC31981FD81373E1BA0399855E22327222B3DF5151C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220568, "uuid": "17475dce-2085-4c59-a1cf-eeef19fa917c", "value": "1536:0NZdYv9b/Yw3LCq1GeOClTJkv9c/EWd8E//nfYRq1o+VCQHeWnsUWuopy9:yUJ/L3LCq4MVJklMdT//gRL+VbARa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220568, "uuid": "02c089cb-8277-483c-b478-b4d3850e3561", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220568, "uuid": "9da76e09-88ae-485b-809d-73bec710149b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220568, "uuid": "6478d36d-1ed6-4148-a273-ee006f32cac3", "value": "info-1246998703.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48e1531d-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219940, "uuid": "2b1b72d8-9c61-453f-b7ad-2c4ee59af3d4", "comment": "Malware payload", "value": "86315686f0c41c3da7343f7e4ddd9a47", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219940, "uuid": "bb98b244-d89a-42cf-b767-a4fe147687b7", "comment": "Malware payload", "value": "2129c9c656725bc30452d0cb16ed1182cc334fb66020bd045702a0c41b81d32c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219940, "uuid": "c18b0287-1fd7-423e-a40a-7cc9dd4c8049", "comment": "Malware payload", "value": "d4feaa92a79413e76bc6361b92896bfca15d015c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219940, "uuid": "92794ebe-570e-4e87-9e62-bfd5794d700d", "comment": "Malware payload", "value": "71cff9e12948451d194449b3e095349829969a953185dd760f249f890360b37ff70675495919ac6be26ad0de40b3fcdc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219940, "uuid": "f7e420c6-f4e0-4dac-a9c7-b7653c63ca5c", "value": "6583028BB4D84339CB3523F658AE5E4426B1A47F040CCBDC75973B78AB53672A572388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219940, "uuid": "7ce8d77c-691b-4b7e-b09c-6fd2ec6a1418", "value": "1536:hEwAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvz:hHijtuPmU9j7+XFWtYe14hbOjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219940, "uuid": "0625aa84-27e3-489f-8e39-a0f1fa2c5159", "value": 86930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219940, "uuid": "d75c5976-91c0-496d-8229-d43ed438a67b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219940, "uuid": "23f2df43-a5b9-4515-ad24-cf89f41e676c", "value": "catalog-425062949.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "531fe012-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220386, "uuid": "0e90ac58-eec3-4ed8-93a9-1ede6235af8c", "comment": "Malware payload", "value": "ee4c13c921346ca9a79b5bbdf9aec06a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220386, "uuid": "5e0ab223-fbe1-4cef-b11f-f62dd101da9a", "comment": "Malware payload", "value": "2141c469ad97961a62bd9160e0d069084df60f6c6f1b400846287e8a5bb37007", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220386, "uuid": "7df962f5-bd0c-4a82-bf4c-fae07c2087dd", "comment": "Malware payload", "value": "17c3f7ac839ba0afc4a981e4a54da550a78181a7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220386, "uuid": "8d31a0fc-6275-4abd-8711-47e385255ffe", "comment": "Malware payload", "value": "142e503d655cc13ec4abae38c458d879f61ad12e7ebe8264d011eb5bf0ca58993286855115426e9e29da229d5f083a51", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220386, "uuid": "d5c08456-a1b0-4c48-9673-481d69806fac", "value": "C4830277369D87FEC14FB05E606FF1BDF055A91E8E2EE614A7B428103837429A410A7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220386, "uuid": "e533bd0a-2120-4d17-8b10-9f775b7cab9d", "value": "1536:JTwJNfD6jITxi7z9ZvjL3+xnxv5ZUSzhhcBrasoi8vQMwdjV46CTNd:1wzOEliRZP3+9xv/UGDmrajvIM6CTP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220386, "uuid": "a3aff65f-4897-4c97-84e4-1dfa3ab333a1", "value": 86799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220386, "uuid": "b69f34a2-8ed4-4ad6-af4a-c15c465cf191", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220386, "uuid": "310eeb2f-079a-4223-beca-030d6470204e", "value": "info-1130775224.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f50722-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217752, "uuid": "36f2fde2-7cf3-4edc-8924-f66e884e2a89", "comment": "Malware payload", "value": "e4bd4467d4e4630a4b16d210a9105726", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217752, "uuid": "522bf756-f964-4bb6-baca-a0b049261d61", "comment": "Malware payload", "value": "2149dea5aeff9d71e6d7fac651e0c59df98b1047f8d45d6a7a069f1bc80094d1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217752, "uuid": "9435fe09-74fa-4740-84f4-1c57fdd7fe24", "comment": "Malware payload", "value": "37dc07ad6deb08a8daf4d1d28dc93e92379b6997", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217752, "uuid": "a9452893-7df3-48c9-bb37-dc58554539a0", "comment": "Malware payload", "value": "c7d75156eafd183b3df61b3dbb0091b828fe67bbb381109781201e8eb2dcd24a14a713c4e8e57a14f69a1f07e4e31f08", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217752, "uuid": "962a8a1c-f85f-4d9d-914f-1aa9c3f250c4", "value": "1D83028BB4D8433ACB3523F658AE5E4426B1A43F040CC6DC75E73B786B53672A572388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217752, "uuid": "62bcab78-30e7-43a2-80c0-3f9d1383ce26", "value": "1536:lEwAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJv0:lHijtuPmU9j7+XFWtYe14hbOj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217752, "uuid": "2f34ba9d-61dd-407d-a9bc-c6c35fdded81", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217752, "uuid": "24f76275-113b-418c-92fa-d4958f17f7ba", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217752, "uuid": "fdb49986-7120-4a4f-aa5f-1ce8ba2821ef", "value": "catalog-1141982077.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a14cce02-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220947, "uuid": "ea6a3faa-d08c-4af9-95bf-ffb8c63c1ecb", "comment": "Malware payload", "value": "baa096ca9231dccd13a63dc24886cc48", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220947, "uuid": "843aa90c-1057-44b2-811f-9e6e11f79101", "comment": "Malware payload", "value": "218e0aa84e1dd404fea15633746a4db25fdee589d97d7b54f83f6d0259810072", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220947, "uuid": "e5451b89-064c-4b8c-b12d-f5ffc3ab38af", "comment": "Malware payload", "value": "905d6b0b31f537d9430a3f034571d44ebf4f858d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220947, "uuid": "782db8e2-7de6-4b3d-ba18-2ef8d97514f7", "comment": "Malware payload", "value": "f76fc3aee1fca2b64ddb86ef96690008862c268e57882de1891d82608f0aab79517f6bb75679b904d72c0c6996b32f00", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220947, "uuid": "4bc39ade-e931-4358-895d-19b2237f6df5", "value": "E283121A99BD1CD9C0AB13F00D73494D4860EF7D411C8449F14AB68F78AEE85DEB7AE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220947, "uuid": "2666a136-cd9d-4d6c-af0e-40d43bd2d0ff", "value": "1536:ut1QVGeGAg5dwSp6yMvBjqqxPGLuhCWdHsh1oSFWsfEFhHqLW/:SAG7A8l3MvBjqq5OsZdHAO5hK0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220947, "uuid": "7cbb65e9-57f0-4967-877f-aafc6314cccb", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220947, "uuid": "3474bcde-543e-4841-9f83-2785ccf2890b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220947, "uuid": "49e86910-e1a0-4795-a9d6-be6af0072783", "value": "info-1395998077.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e615bb26-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220633, "uuid": "4d94e42c-af4c-480b-a041-d3428cfb6941", "comment": "Malware payload", "value": "128214b97f3f2829bf29272a122f7eb6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220633, "uuid": "5c97b6e4-d026-40f7-9c72-a978af3f8b88", "comment": "Malware payload", "value": "219416508deef86d7c4795f6df1baf12621d76c4321deb8eec029b2c5f07ac14", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220633, "uuid": "d11f748a-c093-4c1c-a207-876789396cd8", "comment": "Malware payload", "value": "8da586aa131897c29d7fa4f8ce359e37bd459954", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220633, "uuid": "cd5de3aa-7200-4cab-9f47-be0fdb48a5d4", "comment": "Malware payload", "value": "08db7d93f6134ffd4a943fc06c069147baf16b2b55624c1cbe8a69f52396aa67f409d5b1ccb477f4135b6031d0537057", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220633, "uuid": "248908e5-3d8d-4f41-9fdc-195903348c3c", "value": "8F83024B599828FFE295AF10232CD99AA90FCEF4D9705514F20BFB5CD0B7B29726041B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220633, "uuid": "fc58321b-0029-4216-9102-76236178a794", "value": "1536:Z6sEDF9MwsqZSCzfAkZ8kISNurvd197v7UZoctQ2kPo+4mpRlDi1nUSUqxuu1:Z65R6wsqZXzfA21s19T7YptKRNpoUSU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220633, "uuid": "ab0ad987-401b-421a-bf8c-cf044bc622df", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220633, "uuid": "41cfdf3b-ec1d-423b-a99d-93cee3799d98", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220633, "uuid": "fc1fca1a-01ba-4a3c-ba95-50c34562e267", "value": "info-1279752332.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f687d3f5-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221090, "uuid": "815821b6-2600-4cf2-99b8-4f3e7766fcfa", "comment": "Malware payload", "value": "1dcad0d50e0c11542dc5d58fc4426cdd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221090, "uuid": "937aeea3-c8db-43e0-a5a7-506f284b0daa", "comment": "Malware payload", "value": "21996e41fbe0c271daf4c7fd9ca638707ff6d26e07f41e3bc7fd9b5864dace0a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221090, "uuid": "14f504aa-a73a-427e-aac1-146e91c6400d", "comment": "Malware payload", "value": "8e85b33c2fc88cfae729145f9476351bd3515b28", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221090, "uuid": "4fad7157-d317-44c8-82b1-62f6504f4a4d", "comment": "Malware payload", "value": "5c5c24db4630d086723335ab4e165b7234eb7aa8ca29199e560dca6144e8fdb5624f95524a5d6972a9c861f4b0faafa7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221090, "uuid": "9e75751d-ece2-49e7-a5e5-fed7777fe67e", "value": "D48312B02CAE15BA838D667BA07D2543CC9C1FE026586F9B631113282EB1CDF843B675", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221090, "uuid": "7ee22b05-8743-4253-bd4e-c688c0b63d1e", "value": "1536:nqVr7l+KIUejUgUlrZ8CWb/bLCDxxp/ERd9QnGlRTH7qrelc1:nq97l+tUhlrZ8nfLMZERQnGnTHMe2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221090, "uuid": "d8e84394-fbdf-45e9-8b30-b663a3ad5c45", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221090, "uuid": "97adedf7-fdd1-41fa-9ee0-2f5fc8d938c9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221090, "uuid": "6501f6b9-8689-4d9c-aa01-05075400a2a1", "value": "info-1484519950.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "324c8539-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219902, "uuid": "3896139e-04a1-4c59-af14-62817b1b557c", "comment": "Malware payload", "value": "6a2396ce4634ccaff0284f605f81c28c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219902, "uuid": "b366ea07-b17e-4e8d-b8e6-335663d16e0b", "comment": "Malware payload", "value": "21c5596789913d9c3de0efe06ef566137e1025686a5baf92f06666509fdeb750", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219902, "uuid": "335c3bc7-49b3-419a-a260-da2d39241256", "comment": "Malware payload", "value": "cf3fd444303fe64066332d9d2de7a6de9bf0de28", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219902, "uuid": "b0e41688-9bf3-4350-b533-e844101bee46", "comment": "Malware payload", "value": "2fa20278a963cce3749e2b54dca3ada578861ca701e041f5caadc033657a8f1f7f3d7edcfeed89a92b87f79c4dd9b28e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219902, "uuid": "36fe1e87-8578-48e5-9b4e-b7e2d573d5a4", "value": "4A8302588B9F8D848011ED0EBB22F8AD75106248716973ABAFAD1524FF478D5B6328F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219902, "uuid": "25c9326a-63eb-4d16-b46b-5dc14b00bc1a", "value": "1536:YA6P7EGmwH1zVQLQDYflSJXvoDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrn7:YAY31zVQnIJXaM25NfuQjMCYNBwltD0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219902, "uuid": "360ba4b6-7fd7-450a-bb52-ba7027c70f15", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219902, "uuid": "405d4278-4152-404e-aeaf-39f390220501", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219902, "uuid": "1873af64-20c5-48bc-9700-5c88fc6a3b02", "value": "catalog-402452335.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88daae5d-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219188, "uuid": "077b6334-112f-4880-83b0-f5787f092bb4", "comment": "Malware payload", "value": "52299a1ce9e7cf3f6a2c09f4535608d0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219188, "uuid": "c221c38e-8242-4a2b-8be2-d6313f3dcf5d", "comment": "Malware payload", "value": "21d45af0eef1831e91bd2fb5a7e854fe2c4ca3ed8bdca6748f80123a46c55827", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219188, "uuid": "6a922dc0-2431-498c-87c6-977187e90b64", "comment": "Malware payload", "value": "ccac747b32cadc06ee83456fe06a3cabb2d1bad6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219188, "uuid": "4eae4a2c-801d-43d9-9dfa-0a5358261e30", "comment": "Malware payload", "value": "ef34ff0bdfa12ccd1ce8ca983f5794d4983ddc07269fd46db19da42aae27f8bb195c28b3cc9079353dc456e03139f293", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219188, "uuid": "84611731-b33e-46d3-a7da-41a640e04cf0", "value": "1A830294CB9F8D849015ED0AA722F8ED75506248706973B7AFAE1134EF478D4B2738F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219188, "uuid": "0cc7cb23-651d-4168-abcc-66c665ddb4ce", "value": "1536:pQA6P7EGmwH1zVQLQDYflSJXvoDqf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnm:GAY31zVQnIJXaq25NfuQjMCYNBwltD0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219188, "uuid": "40a55d45-2978-4266-9172-05c2c269b365", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219188, "uuid": "f501734a-2044-4661-b6c2-6cc6f0c55ac7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219188, "uuid": "fa87fd9c-6448-4f9c-a932-a7eda8938a48", "value": "catalog-193043824.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fdb65d4-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219146, "uuid": "7d5582f1-aeda-4631-8dfc-5886bd37be1d", "comment": "Malware payload", "value": "050746841401e12dfff5f4a15ed5530a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219146, "uuid": "ecdfeaf1-82da-43eb-8338-00f7d6bb1a88", "comment": "Malware payload", "value": "21ecc3c9a9779a3d96bfb1b86aa424118aa6e9823e5f3737c27f407ebe04894a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219146, "uuid": "54baee73-9d64-4300-86a8-785b8634a3e0", "comment": "Malware payload", "value": "5bd608d87e7336ad29b2a32154b7fdb33f7dc392", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219146, "uuid": "eb80e097-c116-4196-8e7e-f23154f3c235", "comment": "Malware payload", "value": "7c2623d52208090c3ae8b435a4cac2e0179e9ed0aaf8ad3f04547709a701c40d0a5edf4e7d4afd61cd91298ea54bfd06", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219146, "uuid": "60d15ba2-5b39-41c7-a6a7-cd7aa791e298", "value": "D7830276DE8F8289C016B23103787EAA1F286B7146A1141E5AB0747B2F5B9BD4C85FD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219146, "uuid": "0be5f8ee-8d26-4af0-882b-0ad10ce911bb", "value": "1536:0EpHCzlWAXdZ2rQD2aCvdyWxaqQ6Rxt5AB/aqPwL3VbCbH:0qCzh2QKmm/Qwt+awaxCbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219146, "uuid": "71afbfa6-c50d-47eb-8c8f-ea52bc7361b1", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219146, "uuid": "6cdf543a-4923-4278-a99d-8b14647ccd33", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219146, "uuid": "7213f2fe-329c-43c5-b964-d39608fa79d2", "value": "catalog-1913735487.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f32917d-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218286, "uuid": "bae92584-5645-46b4-b43c-7e78f9cd70f4", "comment": "Malware payload", "value": "2631380668b9d2c57ad989decd931d73", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218286, "uuid": "4a7ba389-1359-4097-8ab6-d23d2bf99c23", "comment": "Malware payload", "value": "21fb31a9ff156a9ed2853cdf9106da0dbe36cdd6eab3c4ad79efc1c120c411e1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218286, "uuid": "72dbfc2b-72d3-4b6d-97ce-cc961a9abe59", "comment": "Malware payload", "value": "8bc8486ef8bce70323471a7658f3309f08111355", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218286, "uuid": "adc90367-4009-4e9c-9454-03acf664688f", "comment": "Malware payload", "value": "793b91bd6c3852b38ba7255f96dca8e6e2144425bd464849a30375401a6063d46531c72ba15586e2cb0fc815f73efdc3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218286, "uuid": "49bd0bae-caa8-4367-b4a5-803ed71bdec3", "value": "5C8312979F9A3B9D2458AC39C57B5CD10A05CE37C157302D22283AF62C1BEBF9B054DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218286, "uuid": "af9d5063-0a2b-4b4b-ba41-2a32013cd945", "value": "1536:pMaAK6VMtJDrlSnna6UAAWBHTe87VqINbtezgVRxr9AiUbQTKXs8FI+bh:pzAPq1Sa6ne8JqmdIbLjFRbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218286, "uuid": "2dd861b9-aa80-47a9-b032-fdc60622e730", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218286, "uuid": "ca11a604-7d49-4146-a8de-3af62d4199c5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218286, "uuid": "3f89377a-8411-4db1-941a-961906985aa3", "value": "catalog-1425219898.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38730685-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218194, "uuid": "26adc9d9-8d48-4348-93cb-1febaa16a08e", "comment": "Malware payload", "value": "5de14a77f6adeb9787974b14dc08a16e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218194, "uuid": "92b08643-a047-4d76-91c2-375c2b473cbe", "comment": "Malware payload", "value": "220d4f4741ac6deadd99d7079c2017f8e1b03c3783581a4941cac7b78f992a5c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218194, "uuid": "2d85d5a9-5882-403c-bf87-7be96fac5692", "comment": "Malware payload", "value": "69ed2b4212d65facdab8acf53fce19eac2a62abd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218194, "uuid": "565082b7-641f-40d6-95ff-22764767d99a", "comment": "Malware payload", "value": "b45fe1f912f2dbb22026c637c312808ab43ed15129280769ce9978660137e0bc7091f693f9dd92129a9d6d3d67639c1e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218194, "uuid": "b6962312-a11b-40e1-9319-881ad8fec03f", "value": "C68312EC70238A66637345A6DD7E90D32B5ACBBC441DB056A82B79364A307FFE111531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218194, "uuid": "27fb6be9-10ad-479a-a873-fd267dfd7605", "value": "1536:BzKTWDE4Qgl8LS4v50FC+p7UjoB8+wXdpUna5ahL2dmTLUVVvI:BeKDPKLRvaFjp7uXinakEmEVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218194, "uuid": "c053875e-377e-4043-b3c5-1f932b07f8a5", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218194, "uuid": "7d3814a0-1b39-4273-9a2a-1cfebc0aee67", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218194, "uuid": "303f0325-f0b7-45d8-944b-0bbdd888f371", "value": "catalog-1390690094.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f14f52d8-a484-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217645, "uuid": "1e0c6fe7-3309-4173-946d-25a8ffb6ef75", "comment": "Malware payload", "value": "eb0edf5f2aa2ebeeaff88c1ff1ca66e2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217645, "uuid": "8cacd972-28d0-4a61-87f7-28564a2e217c", "comment": "Malware payload", "value": "223564dfe6499d4bb4cd531e4c74a0676ef27ecd4f6d21d22826302b1c2022e8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217645, "uuid": "654aa961-f530-49bf-93a8-f19c8ae38bf6", "comment": "Malware payload", "value": "ee4e67b546ed780d0a5a07d87e217a4019df9bd6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217645, "uuid": "5ef0404a-52d5-4abf-834b-ac58bbec5989", "comment": "Malware payload", "value": "7a4a71267de7e125a890a37343a995066941d970bf1e970e2c72dcaed7e9a607f6a73e07e49776b1881cfdda845cd1c5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217645, "uuid": "4c7dff16-5006-4d8a-b38f-024079c046a2", "value": "658302958BDE8814C4009D0C7E39BDA57560692CB00EF3A6BECF0B50BB5349A91F2AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217645, "uuid": "c396e60c-805c-469a-81e5-c8e88972f392", "value": "1536:ZLYnBKjsMlbCIv4DhQ72ZTaNqhJXvoDLf+5ff9fuQjMCYNst+IHCkPLqkwD0DCuZ:ZLYZIvU7JXaL25NfuQjMCYNBw0tD0DCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217645, "uuid": "822a6751-a6bb-4f15-95a2-2014b9113176", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217645, "uuid": "f6018186-ed73-477d-b6d4-101b9bdd606d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217645, "uuid": "0f60a1ce-df93-4653-9796-a45c21c96c87", "value": "catalog-1085033989.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7151bb8-a437-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619184530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619184530, "uuid": "d8796c4d-c572-4a36-b841-0739b1a1c9f9", "comment": "Malware payload (AgentTesla)", "value": "d88de3d7fcd91be5c7c9557b4719a513", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619184530, "uuid": "6c693310-d5d1-4230-89dd-d373f7de318b", "comment": "Malware payload (AgentTesla)", "value": "2250b3aaef0b934cf664252e8e371a113a011d464ac0f53f1f955d57fb92e931", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619184530, "uuid": "4a7b8e9a-b546-4b78-8aef-c31d805ba96d", "comment": "Malware payload (AgentTesla)", "value": "54cb89542a65d519b7a930ea70700f5f99cf6f28", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619184530, "uuid": "5dc6a430-7b49-4f02-b226-aba851568224", "comment": "Malware payload (AgentTesla)", "value": "fb680c758fda839655b4391d55b7d770e9477fadaab2276d6ae8986ae635b16f9e51374d68d977f473f3f639cf5965e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619184530, "uuid": "cf24753f-4bf0-4580-95e6-96dd8c400a8b", "value": "D0C433D5F48214E31A100EFDA10A3B685CA1622D127CF57677F66B62BF6A0C16CE36CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619184530, "uuid": "5b933b26-cd04-4f57-abed-b130e2e8da48", "value": "12288:Kv01l8eIDt7eOO0IERltOsH1XMGSYADzIpwZ:KC8k0IERltFVXMaAP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619184530, "uuid": "93f9079f-4b0f-4aed-9130-25822e7b9cd0", "value": 551686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619184530, "uuid": "aa39520e-82e3-4479-81f8-576960641497", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619184530, "uuid": "6263b501-4c0e-4715-83ea-d6d699d9b73d", "value": "ORDER-PO-S.L 45675675.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f0a253-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220070, "uuid": "b183c9e9-bf24-406b-bcb3-b23e3a6dd33b", "comment": "Malware payload", "value": "01ca1213546411fc45bbd5879bfcd37b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220070, "uuid": "2b14fc28-6740-40dc-8d74-333ab3cd7966", "comment": "Malware payload", "value": "2257fe6f9037db7ee39a3469267523149d21b6bb771d4fdacf5e622c7b659eb4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220070, "uuid": "c9fe39df-aa94-4340-ba09-bb98cde6521a", "comment": "Malware payload", "value": "0690a3ddd7dd6898ee24c9673035563c687b9dd8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220070, "uuid": "b5bf63b8-c701-4d78-b641-3145b6e92d54", "comment": "Malware payload", "value": "2fa1f37e71d5c54ae63245eaaef6eac039cf77284dc327de0dba368f80c06bc0802bacd462ba8c8475a5b858115ca4ac", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220070, "uuid": "9f945516-7dd4-4bd3-9aba-94357380f930", "value": "6A8312EAF953157A42FE7262767F7D402FBC35F49E3122B682A9501790B07E9C8C421C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220070, "uuid": "067f25ee-56f3-4b1c-be8f-851737b0d9f9", "value": "1536:3AQKTWDK4QlztdZ2rQD2aCM1ZQUcDwiFALqCJI3+xOtGkwdO2eDiFXZ:Q/KDMzQQKG1ZQUcD1FALAOxeh4ONqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220070, "uuid": "3bc121c3-70a8-4092-aeed-b79ded6c3c90", "value": 86929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220070, "uuid": "d75947f5-4184-45ab-8787-dadcc582d1d3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220070, "uuid": "c4c5c7f7-e73f-4490-a375-3f4f08cea89a", "value": "catalog-501844451.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb6abd1-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219139, "uuid": "cf8f4b1d-7d75-4685-8ed9-3c66e7370ddb", "comment": "Malware payload", "value": "4dcf6fd238e944041967ec862e119c3e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219139, "uuid": "7883da64-a35f-4c3d-b733-caa53e747449", "comment": "Malware payload", "value": "2260d91e6d75b4e0654f81b7698270d03cc17c00795446fbc0e72ef88d6c4503", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219139, "uuid": "18c7b035-71d7-407a-b930-375334c22457", "comment": "Malware payload", "value": "b7538adf6d43cf421422e45a924fbd8295b47b3b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219139, "uuid": "fe7f13b6-235c-4c51-89c7-abc608472cab", "comment": "Malware payload", "value": "cb53fc74cee2eb2f17e081e466cebec044755c008d1ea8d4a50e5ac4eda924d366902bade4b58b190f5d1dc6cfabfe42", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219139, "uuid": "af56ac3a-e579-48fc-b3fa-50ce16bf0aa7", "value": "A08312EBCFEA5D984202BF0673065CBBB454280C6118BABA7EDD11502F524A0F4B7DED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219139, "uuid": "b04e77bb-f726-4abe-ae23-2fdaf1cc0f36", "value": "1536:m0KLWkP7EBmnbRARpNdZ2rQD2FPdo1f+5ff9fuQjMCYNst+IHClPLqkwD0DCuADE:LKLWSFbkpwQKW25NfuQjMCYNBwltD0Db", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219139, "uuid": "eaef2e0a-2cd4-481a-ad97-752788902d75", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219139, "uuid": "9a2968d8-5610-4d89-8690-293b97f4c4ce", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219139, "uuid": "32cbadb9-01a0-4d7a-b1a4-e4126dea18af", "value": "catalog-1910696555.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5d7a18-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219570, "uuid": "9dc23d6c-8aad-4720-90b1-4049cd952303", "comment": "Malware payload", "value": "15a41558a2a1d85ba5125325efc51068", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219570, "uuid": "882ce281-9aa5-438f-ac9c-838bab614d96", "comment": "Malware payload", "value": "2287a392ed0962008e8274f0acdf9473404e4defd2157ae85d696f1fd8a73ad3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219570, "uuid": "16360a26-96ca-48e1-9149-43eba5ec6c16", "comment": "Malware payload", "value": "a9779e324e598db735fc94cd04574d9aab33c3a7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219570, "uuid": "4fb17d00-3946-4eca-8318-ecce2d94e0bc", "comment": "Malware payload", "value": "780fad432b6c86325e19faddbb44bded74809d83f6ae694e1743e2dad995c01ba199e1fcadb68f47237a6991e88d0f87", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219570, "uuid": "a6d37707-4542-4aeb-9251-210ac68bf8a0", "value": "BB8312E5CB9F8EA8C0405D0C7F21B8BAB910334CB169A6F6EEDC09656B5205475B3CF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219570, "uuid": "66cb6734-1e22-4f71-8b24-a0e05cfc37f5", "value": "1536:MfL8FCyWvSfkyguvqBuKXxH8JXvKDqf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADh:eLMWSkyguvaXxH8JXoq25NfuQjMCYNB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219570, "uuid": "e9d5d48c-93c0-48d0-a2c3-3652d55d558f", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219570, "uuid": "f34aebad-99ae-42d2-9963-68ae9eb10067", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219570, "uuid": "d59572cb-3c3b-4109-a0f5-0191f1248057", "value": "catalog-2146853328.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef6cae6-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218393, "uuid": "5d0c0a37-e0ae-4269-b2d1-c28e7f6594f7", "comment": "Malware payload", "value": "5a5f13e8996cad3c0963f64bc3764f07", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218393, "uuid": "1784522d-198a-4ec2-915e-f5b19e2aa063", "comment": "Malware payload", "value": "22987a975bd79bb2df0cd3ebd007f8216dc2b6725fe1bd3c1d9cb3f7ca7140e1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218393, "uuid": "17296ab3-e8d7-47b5-a6ac-df0b51fa2932", "comment": "Malware payload", "value": "18e6e06fda094a45f53aa1475f6ca6ed5576e5c6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218393, "uuid": "38bd36a4-bcac-411a-9903-870fa5b99125", "comment": "Malware payload", "value": "eb7e777567fcac6e48848429f8811c1b6bc756683c8b5a4954a49248ed62956202aab4248a0d4879727c13ff81d191db", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218393, "uuid": "da68bbe6-2f07-4f63-aac2-860a98592b63", "value": "228302E925423ABFC8FD951D306F3D402EACB2E56D2211E7E207D93770F5A9894D0718", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218393, "uuid": "b740f9fc-c322-427b-8695-9713c53f266b", "value": "1536:sF5u1k94TfvqBuKXxLG1ZQUcDwiFALqCJI3+xOtGkwdO2eDiFXE:sF5fsvaXxLG1ZQUcD1FALAOxeh4ONqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218393, "uuid": "df8db08f-0690-4f9a-b9fb-30293a144a6d", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218393, "uuid": "1bb0da35-f203-4f08-825c-a6b503c80403", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218393, "uuid": "36d4b742-95ff-4b35-aef7-38736830cf28", "value": "catalog-1481538315.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a4763e-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219553, "uuid": "1ec4fca3-19cd-46fb-a42c-36b4ac851373", "comment": "Malware payload", "value": "39eba8a92fab573d67f4c5d85921af4d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219553, "uuid": "cf3b4c43-800a-4ffd-96e0-3e8907e8f377", "comment": "Malware payload", "value": "22a163e2acde99c5533d78d08cdd4ce6b68ab702df717df2d8793f7f91d502cc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219553, "uuid": "ebb454bb-589c-4fcb-8033-b24e0df0f5b6", "comment": "Malware payload", "value": "57c11a52827a2443176bfd3d606ba80fb2b9ac0f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219553, "uuid": "c4aa3830-d8c3-4616-9760-f0f656415e90", "comment": "Malware payload", "value": "025a5629638114e90ad9b6713e4eeddd7aee493a3c7a4eae4bf4f43d784c76c9b6cc2b77dd0a32d5b51d4f94f017841a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219553, "uuid": "70ff19a5-bf37-4456-8135-635b64e7ff36", "value": "7A8312E4C78E0CD4C1558E0D3B26F8A8B901311C3128B5E7FAAD58B56B534E8A2B3DF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219553, "uuid": "1a5553f8-f7fc-42ab-9c8e-0c2843707e58", "value": "1536:LEvf1lwz7up/vqBuKXxP8JXvKDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnk:LCcvuBvaXxP8JXoM25NfuQjMCYNBwltg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219553, "uuid": "d99f77a8-d365-455d-9998-69d15cf76340", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219553, "uuid": "95efc3f7-dd1d-4cb4-8794-f5039e41d75c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219553, "uuid": "2f52e6fb-d505-456b-85e0-12da51d50aad", "value": "catalog-2141774057.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf71c3df-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219306, "uuid": "8d314163-46e0-4c1b-a444-11c540e97ec9", "comment": "Malware payload", "value": "762d35576f1216a93e868c839f7bbcd3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219306, "uuid": "b4679693-7607-4499-8ccd-1770abea7e7a", "comment": "Malware payload", "value": "22a2daa704dc2e80a30eddc93ea250ebb49a626cbf06eaf9a5a2e3f471077f5c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219306, "uuid": "33af85e5-68f9-4ba1-845a-6f8b9a6c56e0", "comment": "Malware payload", "value": "86c97fbf35a5a0d41089fc3c6faf41085b1f5afb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219306, "uuid": "c5f6c48b-9a31-4c8d-b562-371aa80ede7e", "comment": "Malware payload", "value": "f715f34d48588cd5a1af854944bff5f2ea33972b86fe99eb408dcc8b9648d9af61315653bfef5e6fc0ed6076b6d74245", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219306, "uuid": "2d84bf28-fa1e-4b42-bccc-4156851a7e67", "value": "A68312EBCFEA5D984202BF0673065CBBB45428086118BA7A7EDD11506F524E0F4B7DED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219306, "uuid": "6c88e346-947b-4f77-8902-ab738b8df0a2", "value": "1536:tIKLWkP7EBmnbRARpNdZ2rQD2FPdo1f+5ff9fuQjMCYNst+IHClPLqkwD0DCuADh:2KLWSFbkpwQKW25NfuQjMCYNBwltD0D2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219306, "uuid": "950f8b68-f114-4bd4-9dce-11549e71fb96", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219306, "uuid": "dead7f56-1883-4b60-b6e2-5d9d8c12a4b2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219306, "uuid": "e3689812-7c47-424f-a5df-42c2e363839c", "value": "catalog-2005711240.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056b5f0e-a3f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1619157120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157120, "uuid": "b2c2277c-3640-471f-8e41-1e8cf7d379bb", "comment": "Malware payload (Formbook)", "value": "dd578ad5241ddec85e93d5222e2ba66f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157120, "uuid": "7bdcca7e-deb6-4cfd-a9e1-9152789f6d1d", "comment": "Malware payload (Formbook)", "value": "22a55428924660414d27fb24fad8b1ab4319141dee2dad855d03a091f1d7c2ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157120, "uuid": "d8ffb333-a597-4af5-98ad-8fc496a4d2e3", "comment": "Malware payload (Formbook)", "value": "814d1535a35d7a75b65af57aa7e168cda2ca0159", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157120, "uuid": "88fedeab-aa1f-45b1-a2e3-0530a89f549a", "comment": "Malware payload (Formbook)", "value": "7de114f0307dd51d8620b027a885e13f29a83a88ecf0a67fc44672036bcd97891046dbe68610acd5824874111d659000", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157120, "uuid": "b54a559e-d9e2-4d1b-b02e-90bacc22d57d", "value": "D6A4BF01236CADF6E94E147005C1FD295EACA8713F3F86C7DBC69A4F8429DC1A175B4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157120, "uuid": "5b72154d-a019-4190-b438-e43ddb7bb5ac", "value": "4b4074f530e77eecd5d6e67689351461", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157120, "uuid": "0992460b-6867-4b6b-a600-9c81d1c2562a", "value": "12288:gfjjSCwfvrjATyF2J3ieWFOlc226cMvfZEAuBCpiJt3OxI9uWI:gfjuXvrjATyF20F4c2l/CBCWd9uf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619157120, "uuid": "d8e5b131-6070-420e-80a5-3d5559907e3c", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619157120, "uuid": "90930c35-a8b0-40fb-8808-c20cc2377229", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157120, "uuid": "1302613f-c2f9-48d5-aaf6-9417827ddd00", "value": "PO17439.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c7c542-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218829, "uuid": "c18203e3-dc19-4851-97f9-2af619041de9", "comment": "Malware payload", "value": "2529b6e5a28ef7e811d70f38cb5be906", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218829, "uuid": "6bd213d9-4d84-4901-9c07-e89670fab24a", "comment": "Malware payload", "value": "22a8b2fc2dd20743d8bcf1e021b2d361d7d66f861250992c2782d9c67b87a802", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218829, "uuid": "70b07fc0-9e33-48f5-9fdf-e082e6d9f016", "comment": "Malware payload", "value": "a680a0ca5555cb74788cfc5249ee5eeb4162bc66", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218829, "uuid": "72ec359f-9c27-4cc9-aedf-6695ffb5a019", "comment": "Malware payload", "value": "edfb2e9a0d486d1fd5933835c7835a72b7d6be1c4554972a933832d3559e5fadc3f6046f87d529d92460711e977f5974", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218829, "uuid": "2ade0419-8321-43f3-b9db-3038173bf681", "value": "F3830127FAC725A28046E9F25B363B292A4379D9745425968FBC0380F63615F2DAC1D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218829, "uuid": "c88ff8d7-e7c5-4cda-84aa-08ee213a413e", "value": "1536:dqmy0pi0wOQMP4gCQZiwotTCWxxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZiZtp:Ry0pgOQMPEvtTCWzJ9a03fjwe1moYpoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218829, "uuid": "b8a14423-de89-4760-b1db-4ddd4cb953c7", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218829, "uuid": "6cc1cb2c-d1b6-454c-9d2f-d7a0941dcc38", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218829, "uuid": "d8875172-7008-4df1-aa68-e7969535093f", "value": "catalog-1729878609.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd0be08-a3f5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619156218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619156218, "uuid": "d744620f-ba8f-4b3d-8ca8-f1139a11d0dc", "comment": "Malware payload (AgentTesla)", "value": "7b6cecf774d570ce9487e3ef5fda1b0e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619156218, "uuid": "6989f00d-03a1-4de0-932d-7e34aa0db7d1", "comment": "Malware payload (AgentTesla)", "value": "22bdef5cc6ea5cf826d7c62a2c1d293f40e1da26507e9de59f76c76588aeb426", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619156218, "uuid": "dbfa2632-5011-4a60-a3b7-89dd9dad52d2", "comment": "Malware payload (AgentTesla)", "value": "96f2e99f28689eb59fc1d33bcefe34c023a88e29", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619156218, "uuid": "0cefb6af-9e56-409d-9d42-c9c3e4371fc3", "comment": "Malware payload (AgentTesla)", "value": "6d00378437f8abb84b4adb180f0c1b2036e34a75794cd7c090c7a7639ba673c6298852ef91fc47ecab4dd1539fb1ee6f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619156218, "uuid": "2a8b6978-c9ba-4654-bd3e-23e9aefabcf1", "value": "A863E108C0C72228CA1A72FA922149D4D7FD590C55E8E78F3EC190F818E7A576B9737D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619156218, "uuid": "bf85c2f5-1c70-402c-b489-af4b31050cc1", "value": "1536:RfRi+0nIcjELc7Bj6/MIiQjSEjyhCRUhrT6E+7ief6:RfL0n94MIiQOEjyhCRUhrT6X6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619156218, "uuid": "cb829fd7-8f6b-4da5-9eac-fa812df46e3a", "value": 73012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619156218, "uuid": "52dd5c0a-6278-406e-a93e-796a5dc6c073", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619156218, "uuid": "53a62db7-7e8c-4282-92ee-cf99955a9817", "value": "EGSIV@_INEN_0.0_8_20210422.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e4690a-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221109, "uuid": "eb8df43c-d7cf-48c0-9705-dc305b16b636", "comment": "Malware payload", "value": "ac58ad633f51ff63de92113c705a43d8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221109, "uuid": "b20791a8-756d-41af-81df-e18bcde7dbbb", "comment": "Malware payload", "value": "22d58196dcfa0104168ab8107c1cac80e79b8e8a3ca78bdc8079b670dcc14c33", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221109, "uuid": "61b87719-ef33-4dc5-a0c4-26dda672b2b9", "comment": "Malware payload", "value": "7a2f2f5b2a76cfabd87e0c094b328647e1ac4574", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221109, "uuid": "807e2f68-074c-4cff-ab24-14c8873d835b", "comment": "Malware payload", "value": "1756121551abe10b1961dc342a472baf17d03d0a848e286b486e96c14395424f66678b6c9064ac223aa1657eeda4f5b4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221109, "uuid": "7a18141a-1ade-4d12-a836-65b8c7cbcb9e", "value": "3383024B699828FFE255AF10232DD98AA90FCAF4D9705514F20FFB5CD0B7B29726041B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221109, "uuid": "1f4287ae-35c7-40fe-8f83-e6f831a73403", "value": "1536:H6sEDF9MwsqZSCzfAkZ8kISNurvd197v7UZoctQ2kPo+4mpRlDi1nUSUqxuu+:H65R6wsqZXzfA21s19T7YptKRNpoUSUB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221109, "uuid": "92315162-259d-4eea-bef2-5cc0eaf515bc", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221109, "uuid": "73be99b3-25ec-4413-8082-96e78338ecfa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221109, "uuid": "fba65091-e729-48d6-9e2e-9d3f72c73b1d", "value": "info-1495368288.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340f5cfb-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218616, "uuid": "df15fe43-ddc1-44f0-a7e2-515f7df37301", "comment": "Malware payload", "value": "fac545a1f56082e380a5da98d1951952", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218616, "uuid": "da30fd81-062b-44b4-9e9c-909fbb02c3e7", "comment": "Malware payload", "value": "22d6302f4b7ce5226a00fde2663184ffbe32af2c8fec1ade66d301bbccafb51c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218616, "uuid": "83c92bf1-cafd-4f01-94ea-e1a058b20a68", "comment": "Malware payload", "value": "2b831ac0cd6d61f28c37d33503794d240803cc7f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218616, "uuid": "09c44ec9-7369-4477-bcff-5befb9fd127c", "comment": "Malware payload", "value": "8b714111f053f07b2cc07dabdad97ca9149973823b03aeb85d2255fefe80e227ac7ffd5ffdf8b952a4fdf6d49d94306c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218616, "uuid": "f36942e4-cfec-4c12-b3a0-2752a6451bc1", "value": "A6830268CB9F8D948005ED0ABB12F8ED75506248716973BBAFAD1124FF478D5A2338F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218616, "uuid": "54ee1765-598f-4d71-a69b-0a28f43dab59", "value": "1536:BA6P7EGmwH1zVQLQDYflSJXvoDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnz:BAY31zVQnIJXaM25NfuQjMCYNBwltD00", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218616, "uuid": "60ce58d7-22c4-4712-b233-c26b74342bb3", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218616, "uuid": "d1559521-f038-4311-bc13-95efb227008d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218616, "uuid": "6145e95d-ba99-4342-a78c-05435a508fcf", "value": "catalog-1633634927.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f385dc1-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220514, "uuid": "78a2813b-519e-4ffc-82e5-0e782d08be5a", "comment": "Malware payload", "value": "138cac7bb34fc6894904b5636da32c83", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220514, "uuid": "b2c5dc83-eaa6-4241-9f6c-7a1968b59783", "comment": "Malware payload", "value": "2306eaa7b74b22287300c6ad33ab911ab5e161656ea7e4a01729bc3e7da20a98", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220514, "uuid": "b010a306-2963-4947-a225-399f8aeeca37", "comment": "Malware payload", "value": "3e7f648082a45fa2e2635b9c9d1a62aa94d44654", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220514, "uuid": "5e0f85bb-d7db-4fc6-9cd7-c848d237f3b0", "comment": "Malware payload", "value": "0a779e26cdc3b873c5cf3cae2f621c40783e188c38dead4cfb4d67de6e539e270ad0f8f0e2e816d599d843df1732a309", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220514, "uuid": "87ed9c94-9c71-4568-acc1-c7f7ed6557a7", "value": "3483124D14FE8005D1BFDCB5B27FAE4512FC8F9BDDBAC2084B9899329021AC25E9255F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220514, "uuid": "8e2bec8f-07ac-4787-b582-50cbb9ce4316", "value": "1536:VdW7cmfQFxV/L+qSGKyuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbXYZTa4hpk:VdmozVj+yEO6xoKDShicdBMM1/XPQTxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220514, "uuid": "0b6927c5-5da2-42e6-9e1c-c1ad5951f2dd", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220514, "uuid": "e342ecc7-f6b6-48c2-b92b-48a744f1cf7f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220514, "uuid": "df627230-71d1-4d0b-8a05-53e4abbe7199", "value": "info-1217029450.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab4e74c6-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222252, "uuid": "3f43e57c-15ac-49b1-8c01-a629fdb7ae33", "comment": "Malware payload", "value": "98a1b3fce49bf2018a8ea1bdb5c62d9f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222252, "uuid": "976f0b0d-d740-4373-8239-5950afee63b5", "comment": "Malware payload", "value": "232299779280919f8095b600199ea95fdb6fab6126fedde6cf904912ca6ea2ae", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222252, "uuid": "83bc6951-67be-4c00-8b30-8f47734aecd8", "comment": "Malware payload", "value": "d06f0e828be9aa8fed20707bd444e4fdb7c2165c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222252, "uuid": "197cd642-1278-484e-b7cc-8c3c123f51eb", "comment": "Malware payload", "value": "77673c0a2e290d75a163d460bcbc754af233f0a6e03518a387d8d11e182fc38fcef0c1e98314c5b406eedff16ae7483f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222252, "uuid": "ef069b8a-3e97-437a-888b-6cfdf7613806", "value": "22830277F076A95E829CD0B1941E3A1839F875C3E436978EFD1E3A17C426DCDA91082E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222252, "uuid": "93fc5265-b6ee-4334-b770-a523ad042e32", "value": "1536:vMJs4DkjRjDC+ramyNIPjLxx7mgV3e27JWgtrQZcUT7oqlaHvvbFq9GHocnoe1Rd:v2LoNfPrG+vxxSCxIGUT7o/v096oiBkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222252, "uuid": "da1c3c4c-d9a7-4604-bd4c-ba9d83b30803", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222252, "uuid": "76e72ca5-64bc-4baa-8350-dc0056e01aac", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222252, "uuid": "8be895d0-d4bf-436b-ac81-df5c3a20e1f2", "value": "info-287084984.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053c10c5-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218108, "uuid": "c1b54bc3-2d4b-4e63-8e9c-852a1abf313b", "comment": "Malware payload", "value": "b8752b859a7e8e9b63ca50ab519beeaf", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218108, "uuid": "e77479f7-bc32-4125-973a-09f16849864e", "comment": "Malware payload", "value": "23487929c067cc535555e90e25449a3ad3ea5ca28a9ca3e00fd4729d1ee998d9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218108, "uuid": "5f91aeab-8e66-4cde-a91b-f93c0b889fe0", "comment": "Malware payload", "value": "0be3465c601647c8c90cb3c39e935e597ed654b7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218108, "uuid": "203b94da-0325-41d8-b531-9ec115e87f97", "comment": "Malware payload", "value": "fff267b9237250b077d51a1f64cbf62be9014cdc16ba8b343b99c9fccae1a6c516264e9119857742f101c52ea265893d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218108, "uuid": "fe528108-42a7-4b92-bfdc-5209e8e440d8", "value": "C78312E4C79E0CD1C0558E0D3B26F8A8B911711C3118B5E7FA9D54B96B534E8A2B3DF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218108, "uuid": "c22f69c9-4f1e-41ff-bc3c-11b86760e252", "value": "1536:wf1lwz7up/vqBuKXxP8JXvKDqf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrny:ycvuBvaXxP8JXoq25NfuQjMCYNBwltDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218108, "uuid": "5d4a691e-3ac6-44ab-86cb-a47732f49e31", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218108, "uuid": "3e6ccbcd-a39a-46db-a1e4-8e34f2ba510c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218108, "uuid": "8fa1f710-25bb-4986-a4e7-6b175917a305", "value": "catalog-1332172666.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebf41d26-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220643, "uuid": "c74db87c-6b18-44b9-8cd9-9f1872217cd3", "comment": "Malware payload", "value": "8556d89205fef27465eaa8cd589a70f7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220643, "uuid": "05f07705-4032-4f89-94c8-558fe4ec7752", "comment": "Malware payload", "value": "234b604746859a6730edd4d8df889fca47c4fb7e83e97dea741097d6c9a3d484", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220643, "uuid": "dcbff589-c59c-4f04-8ed1-b8e4d709a705", "comment": "Malware payload", "value": "8efb022ab809910cbdc5ccd23578e02e5ad5180f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220643, "uuid": "ef7a85d9-1108-406b-a9be-0fa949b0f51f", "comment": "Malware payload", "value": "22437aa6a1cdb8c39701f97c8b8ff64ad57558402bf18587653028411a435066b45a7eb771a01f9eb1b6d29ee03d74cc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220643, "uuid": "2cd3de2c-7c11-4290-8c36-96530a7787f1", "value": "3083024B599828FFE255AF10232CD98AAA0FCEF4D9715514F20BFB5CD0B7B29726041B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220643, "uuid": "bef9a892-20ec-4d6d-aa7e-c56b7cd5a908", "value": "1536:M6sEDF9MwsqZSCzfAkZ8kISNurvd197v7UZoctQ2kPo+4mpRlDi1nUSUqxuu+:M65R6wsqZXzfA21s19T7YptKRNpoUSUZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220643, "uuid": "0067436e-8a67-46f5-ac72-f2d4ed0657ec", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220643, "uuid": "a46fba77-32ff-4170-99b4-6887d272aa1d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220643, "uuid": "1ec124df-ac0c-495c-85ab-f7d55c5f9207", "value": "info-1280635189.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd69a1a-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218685, "uuid": "9a8e72a9-2645-4e0d-976f-17e47f04d082", "comment": "Malware payload", "value": "084f668782d0a92961bcb453ab882c89", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218685, "uuid": "263a5fc5-5a76-44ad-a67f-2ee63bf9f111", "comment": "Malware payload", "value": "234c7b11cec45efc4dbd042ac06b9415932bfb4ab0fec7b2d18a54c416ec17b8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218685, "uuid": "92100951-e5a7-4c3f-84b9-374b55f3476c", "comment": "Malware payload", "value": "756b0500976adddeed9eac924cdc624e7b218991", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218685, "uuid": "ecddbd57-c075-4d93-a0da-e4d5663940cf", "comment": "Malware payload", "value": "343b5b008b77eaddd4a0a3e1fe398095750c1b3433e62b61608f88f707410f61c784c295d54a7b50b2cd35bafe68e22a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218685, "uuid": "4a2f23ce-874f-4930-b70c-d03f2442aee9", "value": "CC830273FDAA23C85819D8A1E06A7DF4046FC8AA505333A8557D3972104E7BE5B019AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218685, "uuid": "ed1b00ce-7db5-41bd-b872-76dc77c2b543", "value": "1536:Ag2gk7xHK1qQaiwotTqFUAAWB9Te87VqINbtezgVRxr9AiUrQTKXs8FI+b0:ecpvtTqFpe8JqmdIrLjFRb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218685, "uuid": "9052ae4d-da12-48bf-94d7-6f9506097060", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218685, "uuid": "7ecd37b7-00c2-4de3-b9ba-5f1b6dbc7679", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218685, "uuid": "621076df-d88e-4ae1-abbc-53c385b1b021", "value": "catalog-1666975235.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f3bff6-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220693, "uuid": "0ec7c8a9-3109-4ca4-930a-2b8d0a09aa94", "comment": "Malware payload", "value": "30c9eb696f33153c455d057ae7a1948c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220693, "uuid": "a8395293-0112-440d-9695-13a10e53b3b4", "comment": "Malware payload", "value": "234e907b844071188dc527097f6c3331a499b2cd7dd2cfe40c04cdada8650732", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220693, "uuid": "f225cdbf-729b-4305-9d97-ec5c86e46dbe", "comment": "Malware payload", "value": "46d77f1df27b2e3648a8e617c2fa5ab60db1bbcf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220693, "uuid": "778cf055-a22a-49a7-95a3-d59a20594da1", "comment": "Malware payload", "value": "0791339d3ae927b894bf3ab73c5c46ffb819caa6d453b82bc900a18917aedf0a2a08b784793a6afd550bcbf8b77cdd9c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220693, "uuid": "b4c16494-d503-45c0-8dc4-4871c623975a", "value": "9D830215A4FC86A780F3159229307BC78AC0EB9B5849C043B1348E27E4E6BB6457BF5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220693, "uuid": "d7ccad5f-c7b5-4814-ab0b-22927c94fd74", "value": "1536:9Gt1QVGeGug5dwSp6yMvBjqqxM5Y2VXw1QFsrGq9ZMlmZQTQdi:96AG7u8l3MvBjqqqXw6Af5di", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220693, "uuid": "54de00c0-e430-4f7e-8ca6-b0bdcd6f3df7", "value": 86794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220693, "uuid": "7712f557-7d01-45bc-87ed-d952d3554788", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220693, "uuid": "55b9c515-5563-40e4-a444-de1b808f9ee5", "value": "info-131241551.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb8c659-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218876, "uuid": "86c9f2b5-7662-4d01-91fc-9a8b8d739d29", "comment": "Malware payload", "value": "357f158ca524ac252d467215119e7126", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218876, "uuid": "2bfd488e-f3d0-43ff-9bcd-b70c3bfde103", "comment": "Malware payload", "value": "23737df02aaccb48d3ac991f9187dc6390ae3c4ce6fc5326acaeda66ab9f159f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218876, "uuid": "4b21faac-381b-476f-ab9d-a011b693468d", "comment": "Malware payload", "value": "ded8de76ee0eb5044677385c59a38a93709e9453", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218876, "uuid": "2c4c2dec-20d3-445a-987b-83bdb8d0936d", "comment": "Malware payload", "value": "1560bb7359d0ad2463eb12da8035bdeaec4cb1529328e902936ab5ad7f9add7f285d247a5a610505cb88d3b861e66c5c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218876, "uuid": "f9e675ee-1462-4831-b234-a97a905c7b8c", "value": "E7830276DE8F8289C016B23103787EAA1F286B7146A1141E5BB0747B2F5B9BD4C85FD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218876, "uuid": "6d53d212-677d-4d45-b2bb-7fa8f92414b2", "value": "1536:wE9HCzlWAXdZ2rQD2aCvdyWxaqQ6Rxt5AB/aqPwL3VbCbi:wWCzh2QKmm/Qwt+awaxCbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218876, "uuid": "a644eec7-dae2-4122-bf25-d34798b66c58", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218876, "uuid": "36d4c8a2-e63f-4ac9-9ba7-ae71ad35d0a9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218876, "uuid": "c3fd356a-88a6-4757-b124-c89f588f27dd", "value": "catalog-1759592530.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa2b4b9-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219682, "uuid": "fba90b44-b900-40d7-a055-daf356ab2986", "comment": "Malware payload", "value": "29a79642042231710c53a7516eff77c7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219682, "uuid": "db7d65ff-3220-48ba-8383-24d08c0669c7", "comment": "Malware payload", "value": "2385cb43391c93aff40e3914f0893e718022e7992dcdcea8d16ae8f8c8a2c517", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219682, "uuid": "d7dd9563-cc7f-4b34-84ba-05201f62979a", "comment": "Malware payload", "value": "6a3ef3c08999558bd50dcb4072fb65d3fe112a73", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219682, "uuid": "3f6d0dba-9235-413d-b2b8-9eca3132dbe5", "comment": "Malware payload", "value": "5bbfeb2c49ceb663a2b31e769fb33d7c0658cd236bcaf3c2d9e175b5bf8a1119efa299ca5700e9c003fcd03b4a85a628", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219682, "uuid": "9b471d86-3977-4c8b-9a93-317a029a64d0", "value": "3A8302EC7A1BC686E371835EDA3EA8C133479DA9C01DE0A2780F7F6B54216FF9524160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219682, "uuid": "0da79f0c-02be-42e9-a89e-35bc5fac67ff", "value": "1536:ff1lwsMJDrdAZQ72ZTYzqcIkUjoB8+wXdpUna5ahL2dmTLUVVvS:ncbt26IkuXinakEmEV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219682, "uuid": "53a75668-f973-4476-94dc-55bafb3d3681", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219682, "uuid": "37ae4558-b57d-4fa7-9d7f-edcfbef07178", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219682, "uuid": "3b46bc8e-f766-49b3-bf00-20cd824d7396", "value": "catalog-281805377.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986d668d-a42d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619180130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619180130, "uuid": "9cefd04c-6b48-4fab-ae8b-c58a86ba6f8e", "comment": "Malware payload (AgentTesla)", "value": "93d85baa63638e2681203b8946c219ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619180130, "uuid": "9a9af7e1-5cc2-4a9a-9277-32903c06acc6", "comment": "Malware payload (AgentTesla)", "value": "238d453de55ec6ba592271ebdc0f6866138888048b7200f061dc3ba39c6a868f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619180130, "uuid": "f889cfcd-68ef-42dc-8a0a-5f759dfa0feb", "comment": "Malware payload (AgentTesla)", "value": "aa81419d4841435c1250628ddca9742fa14ac593", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619180130, "uuid": "5827dfc2-259b-4364-8c02-8acd2dfd959c", "comment": "Malware payload (AgentTesla)", "value": "97c5933a2fabef49207ccc1bbfc15fd3ee76870e36283ecf2bc2232787fdd19e060fdf9f55d3dda937f15db7df6f571d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619180130, "uuid": "e2bd2383-76cb-4d9e-872a-f2f41f6fc5b9", "value": "92E4F0727608EFE8E83E973E1024451003F6ED1DE392E90A7DA8389B75B77431573A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619180130, "uuid": "f738b373-0ff0-48d9-acba-2a65ca9fc2ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619180130, "uuid": "09875a9c-d750-4178-bd98-db4fa5a6630c", "value": "12288:BFeM/tE6zKkm5cSv0/9RU9wbztjBm4dT9dCEymV8YCEAmD:3zrFRbbzVg41V8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619180130, "uuid": "1674b304-8dba-4a9d-aafd-fe78f51d1beb", "value": 690688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619180130, "uuid": "febfd737-4a0c-4b39-a02e-68c8e1a8e653", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619180130, "uuid": "912d34c8-7b8c-484d-a83f-9625dec1a099", "value": "93d85baa63638e2681203b8946c219ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8245c9b1-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222183, "uuid": "d7e7e8f3-e68c-4df6-905b-85b9826c20c7", "comment": "Malware payload", "value": "4df611f630b72882c4f3036d7ae264f9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222183, "uuid": "f430722e-5f7a-41ca-bb7c-b8458c495e47", "comment": "Malware payload", "value": "23ae3213af11892b0554d84bfb8f498177a7e74380ea85f94f9255b78dc4ba65", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222183, "uuid": "43f87a71-a5f2-4876-9529-53b466db8ca6", "comment": "Malware payload", "value": "bef7eede695e1634dfd7f3caa2e623ee46fe156d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222183, "uuid": "53034fe8-e1b0-4597-aad2-af938f2a7335", "comment": "Malware payload", "value": "dca68c53bc82d9fcc1f105cf2e9274a629081068aab036d93ca6f6aff95caf371647b588eb78f51a27587509476c0f2c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222183, "uuid": "e962d467-d1dd-4fc1-b232-5ddb85ffe845", "value": "728312B7F9776DB6C15CE1E3A53E122834EC81C07475968BFA0A5E0AC95AEDD9200C0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222183, "uuid": "00c1552c-3450-455f-a67d-125ee500f1d4", "value": "1536:bAr7l+KI0FlLHfAkZ8kISNq7xWgwMQZcUT7oqlaHvvbFq9GHocnoe1RqfwSOJrp6:bS7l+6FHfA210waUT7o/v096oiBkwPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222183, "uuid": "6727b46f-97fb-4a88-9e7c-e67c2f9f3396", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222183, "uuid": "71fde675-2b8f-474b-8c00-7e3ac6cba8d1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222183, "uuid": "cc31680f-3524-4953-8f3e-d7089896623e", "value": "info-237511009.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82325e01-a44b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619192977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619192977, "uuid": "26b181ab-6905-4be6-b011-11b0dfc1a989", "comment": "Malware payload (AgentTesla)", "value": "4fe912176d9074d5dc586a2df85e7a88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619192977, "uuid": "bd382495-ac3d-45b5-854f-f8adb6e0487b", "comment": "Malware payload (AgentTesla)", "value": "23bcb16327c9ae968c000f24802a00423304ecbfffabada373f84460872215d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619192977, "uuid": "1ae7413d-24d5-4e84-a4e5-b59e90e1bb51", "comment": "Malware payload (AgentTesla)", "value": "ddff639cb7c22d212b418dfef183d6ded3a273a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619192977, "uuid": "cafbdbc2-fe81-4e06-acf3-ebe4f478fdfe", "comment": "Malware payload (AgentTesla)", "value": "1c24cfc2fb20efe102f4f1f58eaecf8f3ad661dae6c5c98c36f14f346ccea488aadea1411527102cb83aa8dc180317a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619192977, "uuid": "1d57beef-8024-408f-84db-ce174271e1f9", "value": "8AF433818FF13A129E2A0F1712DA6B35A070DAEC3098D9565CB7D50A16DFE0778AD339", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619192977, "uuid": "7bca6b4e-58a6-420c-b191-d1153d3ff8e0", "value": "12288:meEYcI4ERgpfHMwGy2RLUyJ/BYLoRSOtlrJ/zQNjSAOp1mOAeDy0Y+:cPTERsMwTJyvSWlrRkc11mOAe4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619192977, "uuid": "35c95f58-6a5a-471d-b5c0-20df452bc9d8", "value": 729350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619192977, "uuid": "304e5fdf-0535-4560-8f9b-d4afaf792118", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619192977, "uuid": "7b4ba304-a775-4cbb-a8d0-d6a8e675c573", "value": "HTC-13051989.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9cef39-a484-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217347, "uuid": "77756b77-c02b-4d6a-b775-40f2e6cb3597", "comment": "Malware payload", "value": "bdd825b56a07f70ffc54f4597dc488dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217347, "uuid": "4bc61eed-4246-4dfd-8b31-46f90f763e80", "comment": "Malware payload", "value": "23d0b93b348c1e36866b160b91cda397a8457a0667c77f5bc5da6fcfe17303f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217347, "uuid": "04f769ef-4e77-4980-a15d-dae2de1b9a5e", "comment": "Malware payload", "value": "3c4f3b5fbca5d9b4dc02ab5031227f0beb6676c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217347, "uuid": "ee7a740c-7e8e-4dd6-b806-7443a039db37", "comment": "Malware payload", "value": "e77db257d7dd418ecde289d83b4213d4e4813767d9914fa0e4d5de47160acf615171b9d53f7bcf9a4ea01a7f20e3b603", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217347, "uuid": "6aa80904-5c0b-4675-a8bd-c73963b8b8fb", "value": "698302588B9F8D849011ED0ABB22F8ED75506248716973ABAFAD1134FF478D5B2338F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217347, "uuid": "515585b6-164b-4d0b-a109-b1505b5f1eea", "value": "1536:DA6P7EGmwH1zVQLQDYflSJXvoDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnL:DAY31zVQnIJXaM25NfuQjMCYNBwltD0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217347, "uuid": "7fdd4f68-6b75-45d3-b5e2-4173fd297864", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217347, "uuid": "5564b32b-6111-4647-956f-cbd30ca8af78", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217347, "uuid": "67f60ab1-9830-4ece-88db-07ad1734c02a", "value": "catalog-1001550754.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "205ce2f2-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221590, "uuid": "5e00cc1f-8a54-44dc-b169-eb23c643df5a", "comment": "Malware payload", "value": "c3729c3b2c08c4346faa58431e81f356", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221590, "uuid": "80eb8687-cdf4-4674-b716-de50f01ecb53", "comment": "Malware payload", "value": "23d8546648073ec3eeeab73f85400ad6d99332a51f0941a96b2fc4fcae0e8029", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221590, "uuid": "2f6dd7cc-789c-44a7-a581-aaecd5e6e447", "comment": "Malware payload", "value": "88363be2dd1375eabbad7273684a39eda9410d4a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221590, "uuid": "6b4d890f-770a-40fb-9aeb-b68d95295abd", "comment": "Malware payload", "value": "4beadb806b2f48c47524ba437ad209610f83cd2d1b6485e0340db116b2eaadc5c998ecbdb2870526e42c0ad3e8b7a997", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221590, "uuid": "c39e06c4-eb64-475f-a17b-5aa82b22e468", "value": "3D8312A1A87CA15F638FEB73D0777757E88009E5512C1E9B534221393DB8DEF8827229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221590, "uuid": "5c3b8456-6411-4c4d-9c91-b38b1d3b6df0", "value": "1536:ftaLgbb9ZvjL3+xnxv5ZUS8CWb/bLCDxxp/ERd9QnGlRTH7qrelcd:fZ1ZP3+9xv/UHnfLMZERQnGnTHMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221590, "uuid": "dcd0aa97-76ed-4694-8616-36ed90da38af", "value": 86799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221590, "uuid": "72f11f66-5d32-4ee4-a477-3baf47778d27", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221590, "uuid": "36faa6bf-a106-4b84-b313-e8c2ba38a342", "value": "info-1764004104.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da3cbd14-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221042, "uuid": "60fca4f1-869f-4965-8939-acfa072a237b", "comment": "Malware payload", "value": "3ad923d8df5cf73a16f2220c4c94c6d9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221042, "uuid": "abd98eb4-bbaf-4261-bcf8-4b1928b0ca21", "comment": "Malware payload", "value": "23e4de49145d28f19074869799db30acb025f47c45b316bc2c92a4e11d6bcd1f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221042, "uuid": "9edca0aa-cc10-4508-b666-85a5f6b1a593", "comment": "Malware payload", "value": "bf5f5b210b4578fb3ad8f206da244e838f0520e3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221042, "uuid": "54fa7d67-77e8-4a06-8197-c74161194da4", "comment": "Malware payload", "value": "96d211fda3024f91411f633c308d31554e588197f20d9766c28a4253fc1a39a926b13efebb3c7b6f15ea2bc0e66d6fac", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221042, "uuid": "335d8d3b-67bc-495b-aa6f-e3ff143aef18", "value": "FA8302E6AC77CC1D818ED2F1403F6E146AF464C5A4B8E386E9177E49DC66DC91D0882F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221042, "uuid": "5bfa2048-70bb-403b-9536-cf91db029f6f", "value": "1536:1xKzlSo7mgV3eG17lbkCOUT7oqlaHvvbFq9GHocnoe1RqfwSOJrpMEIpz2PJ:1xKzlSoSCn12COUT7o/v096oiBkwPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221042, "uuid": "ec8a85c3-803a-431f-ae45-9502e22f1884", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221042, "uuid": "3a8255ab-4249-4da4-ab86-53798fdb1d53", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221042, "uuid": "2ebdffad-ab34-449f-8b9f-44d0ff5cad58", "value": "info-1451334075.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28edf51f-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218597, "uuid": "93717a9a-b1a2-4490-9ec3-d0c7fdeceef6", "comment": "Malware payload", "value": "4d41dbcccfba37dbc38b405ea25725b8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218597, "uuid": "65fbaafb-00c3-4f95-8f5b-8d94df617be9", "comment": "Malware payload", "value": "23fec027c2f6e4cf19578a69091698db7ac5760be0684bff1491983640f2ba03", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218597, "uuid": "7a0558a7-192a-49c2-b9e8-6013e3ecb143", "comment": "Malware payload", "value": "4e3ef5756968f8a8f90b7a51c8678f8ca890ce19", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218597, "uuid": "8bdbf23b-ae94-484d-b2e5-2e2546f9d400", "comment": "Malware payload", "value": "b1c5ea293ef9d315f60c9fbce78263f3d08ec1adf500d9be6cfa514b805235ac9be74d22519f7ca0a6e34263d0ea7368", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218597, "uuid": "fe9aca21-668a-4127-bd27-1f5f72d1b136", "value": "778312EC74238A66637345E6DD7E90C32B6B8BBC441DB056A82B79364A307FFE121531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218597, "uuid": "90352035-57f8-4da5-b344-fc56ffb63270", "value": "1536:OzKTWDE4Qgl8LS4v50FC+p7UjoB8+wXdpUna5ahL2dmTLUVVvU:OeKDPKLRvaFjp7uXinakEmEVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218597, "uuid": "fa3b11c5-22e8-43ae-ba4f-a1bb98c43583", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218597, "uuid": "3ea2f5ba-dd9d-4f6c-b9f4-3a2cdb20b564", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218597, "uuid": "e3831a1e-48fd-4584-836e-41cbf20c8bc3", "value": "catalog-1623315134.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3758db3a-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219051, "uuid": "083c299e-05b8-470a-9560-7ebaf5d00951", "comment": "Malware payload", "value": "9eabb0064d8df5a94bd860d243ca2f8b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219051, "uuid": "20d36524-734f-4658-8b8c-cdb6f913be33", "comment": "Malware payload", "value": "2401c99869b10ce10de4d20ed904a7a7e65b91011d7c0ee200b9b3f9bcbf367b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219051, "uuid": "f3122677-e58e-442f-8c42-ed12d58f0415", "comment": "Malware payload", "value": "c58ae6b6af824eac9cf4912185cd29f738b054fa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219051, "uuid": "6d7ead7e-df24-4fa5-b352-e695354061c7", "comment": "Malware payload", "value": "0a63b9a81ea950be601135bf42a09b581a243bcadbc5de1f3ead1dda97e26d8b16cc842cd7db9fdd2a513f2180457747", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219051, "uuid": "3fb753eb-97dc-4c79-a653-902665cfd0bf", "value": "3483121F7B8B79328057E7718F351A0DA393FAED240C7159EE9F47A4FB2600A68681D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219051, "uuid": "0fae2e8f-e48a-42a5-a145-1c4b441e6a95", "value": "1536:3Rn2h1Uf0IzwZQ72ZTYzqcIxxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZiZtc:3R2hszG6IzJ9a03fjwe1moYpo4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219051, "uuid": "3418487c-d9d3-4dfa-81af-e891bc57b038", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219051, "uuid": "0213962d-64de-4c09-9afd-b18beefe7cb4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219051, "uuid": "e3ae5174-f4be-4c5c-962f-d98482457998", "value": "catalog-185998920.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc816406-a484-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217664, "uuid": "f4d32f7b-e86a-483d-b98a-355bd2d72283", "comment": "Malware payload", "value": "f8fe7a2ceb7dd5ca534a2977b52ba50a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217664, "uuid": "a87431bd-7b4f-46e1-9dc5-8f1f5f20bd9e", "comment": "Malware payload", "value": "2402c245309b4f2845d18034c89e415fdc8a2698969add4a65d0f3fdeefe58fa", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217664, "uuid": "fb0aecb3-2404-4bfc-87fb-31f8c6aac0f7", "comment": "Malware payload", "value": "7c608069314cdd1f2e6fb41657cfa191dfb382d8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217664, "uuid": "751b1a0b-1664-4249-93ad-1b6b6d3b7495", "comment": "Malware payload", "value": "115d9cd92cae5a983440ddf3410c6b42696ffd36cf53fc008af10484178a95b321df2b43f186e1615e1e7d02f336d817", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217664, "uuid": "4a7c4ccb-ee4e-469e-b1e6-0a05ded12b38", "value": "DD83028BB4D8433ACB3523F658AE5E4426B1A47F040CC6DC75D73B78AB53672A572388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217664, "uuid": "9cd69f54-32aa-488c-b73d-c32fbf1c544b", "value": "1536:NEwAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvW:NHijtuPmU9j7+XFWtYe14hbOjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217664, "uuid": "99eec1d2-aefa-41bf-b78b-67e5532848cb", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217664, "uuid": "02881724-2f3d-40ec-bc65-50a0c9ec3534", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217664, "uuid": "13fecc46-16a8-47d8-a5ed-70583cd893ba", "value": "catalog-1093063680.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ad3dee-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1619218867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218867, "uuid": "b8463f3f-5f25-4064-bcd1-9f151420650f", "comment": "Malware payload (ArkeiStealer)", "value": "8b9eb5754ca999bd54b6cf3f1a528808", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218867, "uuid": "cc114aab-17b7-4ca6-8630-771736c902e3", "comment": "Malware payload (ArkeiStealer)", "value": "2484d40bb7e1ee95471fd715dc6a3c498ee4c1c994cf14faf2670b02039b5a95", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218867, "uuid": "5c808991-5a67-4175-8d04-cad362c2baf5", "comment": "Malware payload (ArkeiStealer)", "value": "79735a584cd723a5db1bb8a6600341b7560d1bba", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218867, "uuid": "2a2b13af-87fd-4c97-a274-b9dca7b25bfb", "comment": "Malware payload (ArkeiStealer)", "value": "a65652765e77318843364d32ca27f586953fb52d51d6eb6074fcaec21dd5311413b9ae5442345157eac53305c56d17b8", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218867, "uuid": "395d6e8d-f282-4997-b337-ca81ac571d47", "value": "6CD4DF017590C03BD466397245A3C77CD66BBCA0E72112CB67897ABE5F373E1AB2134A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218867, "uuid": "6ab8cd78-635f-40b5-a9cb-44b38b1d50fa", "value": "d06c3d6e0356b48f39acacda4709c9c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218867, "uuid": "2b15fcb6-4e21-4a7d-81b4-2e393305a07c", "value": "12288:bcR8+QUYIr2+BI5v3AsUeetiFysjkaTnJsWVXg:bcm+pYIrN+5v3A9eTAsgaTJPVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218867, "uuid": "b215877a-afe2-4a02-9b92-a554d8048924", "value": 639488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218867, "uuid": "ffc79c1f-7dbf-4713-a155-95725ead293b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218867, "uuid": "afdc12be-3d4b-43f6-9b04-392153bbfd8c", "value": "8b9eb5754ca999bd54b6cf3f1a528808.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b6c1a2-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218701, "uuid": "80b7ce3e-4da0-412e-8e95-73b161063757", "comment": "Malware payload", "value": "5d858c4ef82472d1bbccd027cdc1de8c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218701, "uuid": "f7a2409a-02b4-4e69-835f-9ed12ea01816", "comment": "Malware payload", "value": "24998d68fce876f01e5194df5a90ce89c1d0d0a546578a00c8f9f6b09da7f212", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218701, "uuid": "a0f03338-b25d-482c-a8e7-f57eaa99de0c", "comment": "Malware payload", "value": "260000f8869675a3b04454a145d3e7cf733132c7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218701, "uuid": "c7537acc-d74c-4a80-a912-5419bdee25c5", "comment": "Malware payload", "value": "746581061173801c9929e46096b12f566b0249b837f5d491374ef5d6204b0a3a7674cbf3dc07f8651617118b1fdcfcba", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218701, "uuid": "e6e1058e-3198-4185-9574-15a5f6951fb5", "value": "848302D58BDE8814D4009E0C7E39BCA57560692C700EF2E6BECF0B50BB5349AD1F2A75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218701, "uuid": "c448ce59-e4d6-49db-b613-f0ea25f258a6", "value": "1536:7LYnBKjsMlbCIv4DhQ72ZTaNqhJXvoDLf+5ff9fuQjMCYNst+IHCkPLqkwD0DCuu:7LYZIvU7JXaL25NfuQjMCYNBw0tD0DCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218701, "uuid": "8f5665ef-6172-471a-a674-aafe1c804951", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218701, "uuid": "6688f234-0dcf-46aa-8d93-b14d7de0ae74", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218701, "uuid": "c6a62b02-3704-42c6-a179-2ec3073c1361", "value": "catalog-1671382872.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e6327b-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220599, "uuid": "12793d68-69d6-4f45-8788-90582cbedf9f", "comment": "Malware payload", "value": "0a2f2c4ca01e1ce477f22be6f29f21d2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220599, "uuid": "e500a0d4-126b-46e6-8b51-8136727d40f6", "comment": "Malware payload", "value": "24bd16a7fd1ad1dba0b6c2c4b5d58226dc60e3ab1446281846828de57bc8664c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220599, "uuid": "c0d40d00-d847-41c1-a384-f284c8350e50", "comment": "Malware payload", "value": "9620f5da2eb96a23469e252849d9a853a0c13f7c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220599, "uuid": "5a3dd464-ca54-4a10-ba68-95d9e3be885d", "comment": "Malware payload", "value": "337ff8a8759fdf7fbddc90d1bad014aa8741e7de1bc1541b222bc4f980799fa39a5871d36982d11bb8151881676e0c02", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220599, "uuid": "c6fbb820-3820-4fc7-8aaa-b974729ed1dd", "value": "B983120B996168FDE16ABF01273DD4CFA64ECBE1D9350AC1F20E6F65D2A3359225440B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220599, "uuid": "9f36eb0c-a5a3-45f2-97bd-38bf796331b5", "value": "1536:MHZbN5m6RtLlLHfAkZ8kISNq7xWgwMQZ2197v7UZoctQ2kPo+4mpRlDi1nUSUqxP:4Bm6XLFHfA210wI19T7YptKRNpoUSUqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220599, "uuid": "e5cecf23-c928-4e86-b42d-27ce8636e474", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220599, "uuid": "8860199d-835d-419c-9cc0-fd3c33679f90", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220599, "uuid": "f0e2eed1-93b9-42bb-b361-779da0e5f3f6", "value": "info-1266029829.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b60d0a1-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218977, "uuid": "162131b4-fb62-4755-ac05-0fff2fe45485", "comment": "Malware payload", "value": "b0213636ad0048111839880cab124605", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218977, "uuid": "1955ab29-d0b5-40e8-8f28-de36d0755fa0", "comment": "Malware payload", "value": "24c85d7306bcae12bf979de4910cf32ae0e23f2a04bc3db255da7de3eb7ed884", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218977, "uuid": "2725754d-5177-4fee-beef-77e614026a8e", "comment": "Malware payload", "value": "b14eccb86350a3143d795b9a0680b5ff1418a416", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218977, "uuid": "dd6ec6d5-39cc-4d6d-be36-6d0cec45d3a0", "comment": "Malware payload", "value": "20a30011eb7831bfad8cf67b15e6f48ecc3f1222665eb841a20a46632c8d3c38970238f4b7042c1143cc3ef935cd804c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218977, "uuid": "c798a2fb-521f-46cd-aa4b-0d12b1eaf9d8", "value": "508312CFB8E5073E47322A77051D0E5956E0352F0500AB9D3AEB35342F65A31E8AB38E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218977, "uuid": "810115a1-fa35-48c9-b112-d41ae759fc1d", "value": "1536:LdKLWkP7EBmsbLlBRpNdZ2rQD2FPdoeVadrj7ZIXFWgKilkAq14HE6M5XL2l92Vt:RKLWSibL5pwQK3U9j7+XFWtYe14hbOjB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218977, "uuid": "70fcfdd5-8078-450e-b24f-38ad89205a46", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218977, "uuid": "0aa2de3b-ee01-4858-bd4f-e068e0ff9c2e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218977, "uuid": "cc9930d9-2764-4bc6-85cd-db647bdece74", "value": "catalog-1821782060.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a6c4fc-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217790, "uuid": "9090f926-1136-4050-a7e8-474c30aa091e", "comment": "Malware payload", "value": "9df7bba14f28f6becb25a343e5eb0124", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217790, "uuid": "055394ef-2e5a-4d54-92bd-bf3ca7209dec", "comment": "Malware payload", "value": "24d7037970767dd3e71dcab943ab08a68314749be90bc0d9fc93290dd8d3c07b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217790, "uuid": "4c91ab19-bd8f-44c8-9aec-1af9ceacdd43", "comment": "Malware payload", "value": "f0c5a561ded38967a74c3a7d799704347d50de16", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217790, "uuid": "bd7738eb-cbb7-41d5-a133-5fb9d528fa46", "comment": "Malware payload", "value": "3d6f388d52af086ca66daf4547fafbe790cd7954b213ea8de174e18972fbd6f7246b576b64930ece1dc1ba558dbd8967", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217790, "uuid": "0c93cfda-b9a1-4ecf-961e-c41c65080afa", "value": "818302EC74238AA6637341AADD7DA0C33B6A8BBC402CF056A82A793649307FFD111531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217790, "uuid": "2b725c6c-fe64-4d20-8f59-89179949b56b", "value": "1536:LuzKTWDE4Qgl8LS4v50FC+p7UjoB8+wXdpUna5ahL2dmTLUVVvl:ieKDPKLRvaFjp7uXinakEmEV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217790, "uuid": "e379571a-3d13-44fb-a0b3-89e9e0f9de9f", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217790, "uuid": "1bad9ef3-c7fa-4583-acc0-2aa59435424f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217790, "uuid": "bb6ea70b-2157-4988-a689-20305b8db4fd", "value": "catalog-1167969656.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c02f71-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221674, "uuid": "9aabbc34-290a-4de7-9fda-20147b69e4f1", "comment": "Malware payload", "value": "9cfa0573365e7b5a8122000c1dc1a874", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221674, "uuid": "1e91f181-61a5-42fd-9379-4580eeededf7", "comment": "Malware payload", "value": "2533de7e3f49c00cb8faa7bc8661de814d65a6305531491f76685836bde341e7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221674, "uuid": "94535ded-23ee-4afb-af56-d6ec201a27ea", "comment": "Malware payload", "value": "0ef1dabeeba30bcfa85b90e6af5caad64035b912", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221674, "uuid": "41121425-4bbc-4fe6-8c15-1f0ab1df3fd4", "comment": "Malware payload", "value": "154f8403df38e1d99fd067f96338d5c5c2d6d669be5ea5e1d4745ce96f0251610a4ae83b38448e7df0f74bfa51082c5e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221674, "uuid": "de125595-42d6-4d72-8e34-c24a9f1cd0d5", "value": "56831273382E86AF904FF5AA50AFF47DF155F92D8C1DD611A3A42A20383246AD415EBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221674, "uuid": "e175e747-97bb-4c8e-a3d3-f252a5a49376", "value": "1536:NpxKz4ATZvjL3+xnxv5ZUSzhhcBrasoi8vQMwdjV46CTE:NpxKz4AZP3+9xv/UGDmrajvIM6CTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221674, "uuid": "fb7c4f89-7814-4768-8339-abb7376a6e4a", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221674, "uuid": "c2b7ecfe-f8a3-4ca3-bdea-bb5dc210cfc1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221674, "uuid": "f1498b69-d153-4055-ad89-f0ebe98d00f2", "value": "info-1810252850.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f1cd7ed-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218125, "uuid": "bd9e750e-b52a-44a9-bd81-241fe8b5299f", "comment": "Malware payload", "value": "629055cee79ecbcd1478b20bf764702f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218125, "uuid": "ada55894-5882-4c54-8787-d543bdb91ee0", "comment": "Malware payload", "value": "25340ab119483c043045661924554b75e4a5b389c1f39c40e01a6c6778f33dbb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218125, "uuid": "5f72e539-3d11-4350-ad79-6b2989360cdf", "comment": "Malware payload", "value": "ebbea8b220f7169f715fe9575d560eb996582b0a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218125, "uuid": "64ff083b-c8c6-4c9d-a620-dc2ef9c7c454", "comment": "Malware payload", "value": "032c641fcd2eb1384e7181a4428b6e9502a4147ba48d2e077f34f4efd249c8e22630af2d45bbb350aae553806d1324d2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218125, "uuid": "2bc08912-b582-4d99-bfcb-dd56811c7e33", "value": "2D830227FB8725A68046E9F39B373B1D6A4239D9345435A68FBC0380F63614F1DAC1D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218125, "uuid": "1b6959ff-d38b-4c00-be55-db5dc59afd2d", "value": "1536:PHmy0pi0wOQMF4gCQZiwotTCWBxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZiZtS:Oy0pgOQMFEvtTCWjJ9a03fjwe1moYpoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218125, "uuid": "fa1af94c-406d-4068-9bf5-cfc58c5ed395", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218125, "uuid": "082bb530-89f3-48c7-a7c4-5e7355f844dc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218125, "uuid": "35d74547-09f7-4cf5-a644-1edc4ab93b36", "value": "catalog-1340578091.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f930949c-a43a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619185876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619185876, "uuid": "aee365ab-dffe-44af-97f7-c2349bc3d2e2", "comment": "Malware payload (AgentTesla)", "value": "f57a1593bb3e8414e09f08f0d15f5cae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619185876, "uuid": "7d2d226f-7797-474b-882a-0c820c1c42eb", "comment": "Malware payload (AgentTesla)", "value": "2597f0b9067cc685e4d27603e504b350288fe847d08d49ff764aaba1d0460ce4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619185876, "uuid": "f34caba5-230c-48ca-8104-3ea5fbf8817c", "comment": "Malware payload (AgentTesla)", "value": "95da3f11097a882fc48773fa0baf6ef4901f9b19", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619185876, "uuid": "96f3d0e6-beab-4ae2-8ddc-b26b69ea8cdd", "comment": "Malware payload (AgentTesla)", "value": "2d4efccd64f5423e2454e29cc9d33f5fe7ee0cb357feaaf7baaa8a222aca69187cf3f247056ad2b87fbd5fa9ccf89a9a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619185876, "uuid": "408e94c7-e295-45e6-9495-e364aac54a8f", "value": "760523EAE2D09F1DDACAC5D68F9C2221337378C626E5110618447C78A8FDE5AD67DE0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619185876, "uuid": "e1cd7404-3b43-49bd-9d31-af7a43a7b1b8", "value": "24576:htdjzfqV+t6fRuLvO3vFo3CSZLUAIun077g+2y:htpiu6ZuLvkFLyLIU0/gO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619185876, "uuid": "00c9476f-0abf-41f1-9e73-da1f5ce41cde", "value": 817308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619185876, "uuid": "6539d053-b055-46c3-8ff4-85e1b0279963", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619185876, "uuid": "59e4e3f3-0ee8-4c22-a832-21b4a84d33f3", "value": "CNFO-9191.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2d2acf8-a484-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217621, "uuid": "940e42ab-55ae-46e7-a842-30291ea73541", "comment": "Malware payload", "value": "d45987541b10178c707c8c51c2edd6c3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217621, "uuid": "76300cf5-5d52-4cbb-90ed-00ddeac5635b", "comment": "Malware payload", "value": "25c66cbb28cf5ac0ca50798bd0074a096aa3a8e6ff6ff9c50539b88610c08f44", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217621, "uuid": "21b98416-88d5-4cee-93e4-1925cfc29926", "comment": "Malware payload", "value": "fa1541a9b9d06563c155376e299c5f5d32464687", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217621, "uuid": "521d8ec1-aabd-4e1d-bc5c-59b49e2e4a31", "comment": "Malware payload", "value": "66baaf67a00be087e8c8f7601b963b4e9d9ebba0edd95ce29da2a6c8e83c4a26df8fde3e5b9b1998a098437505ffa3ba", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217621, "uuid": "48d46ff3-4373-45fc-8dfa-be4cacf1c845", "value": "85831277DE8BA18EC102723013782FEA4B2C2B72596115061670747B2B2F9794CC7BE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217621, "uuid": "b706674c-27e6-4106-a8fd-caf4dc22d1b2", "value": "1536:vXuRWAXdZ2rQD2aCv0yWxaqQ6Rxt5AB/aqPwL3VbCbf:vg2QKDm/Qwt+awaxCbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217621, "uuid": "d84211b0-270b-4d9f-90d3-aaaf03b163a5", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217621, "uuid": "47dcf0b3-39e4-44a6-aa04-4c5fa174b760", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217621, "uuid": "fe2c1a13-5cf2-44a6-8fcf-b4d7ceea51c5", "value": "catalog-1066082954.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5d31dcb-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218485, "uuid": "108f35e3-eb5d-4fa9-9a9b-2f6f3ea836ae", "comment": "Malware payload", "value": "64d6da99252a48bd01a2d165568109dc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218485, "uuid": "5265d0d7-e61a-4d6c-9dc1-f184907ceb14", "comment": "Malware payload", "value": "25d2f5ca37a651cb2861b4476820259fd1817e871b05be6d03ecee889ce12e37", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218485, "uuid": "cd08b1a1-a257-45d3-824b-97f41619e9c5", "comment": "Malware payload", "value": "b6b24d494e2d930709fd71bed3db34caa3003ce9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218485, "uuid": "f90bc2ef-ef76-4350-8f22-7e7b0d485533", "comment": "Malware payload", "value": "94a51ac3dab4aed8b03177a9e2f6e05c3cfe4c073a1724755b68c23e0ad780d77210f757ee5999546432103dcd637a57", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218485, "uuid": "fbe809bf-b156-47e9-9654-d2775017a8f6", "value": "1383028BB4D8433ACB3523F658AE5E4426B1A47F040CC7DC75D73A78AB53672A572388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218485, "uuid": "e8739d14-b62e-42cf-a120-492db429b2fc", "value": "1536:tEwAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvh:tHijtuPmU9j7+XFWtYe14hbOj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218485, "uuid": "234dd035-1f7a-4b81-9a18-2eaf3c0fd4ec", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218485, "uuid": "e1851965-9b78-4d52-ae31-79c8b1672fbc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218485, "uuid": "dc9645d6-7c37-4b7c-8211-96abb791f51e", "value": "catalog-1529125625.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "739e942f-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218293, "uuid": "faf7bdc4-1950-442b-aa34-00f3be42e4d0", "comment": "Malware payload", "value": "732ea9fa93d26cee9346f3963ed61679", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218293, "uuid": "ad65c622-00a3-4f12-9de7-006d9cfea87e", "comment": "Malware payload", "value": "260e0208832b9d3ab8da71bc6bb1d1c46cd9d408d7542842b3c54a0742f975a3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218293, "uuid": "43212615-e0b5-44b9-b0cc-4b78d961ced4", "comment": "Malware payload", "value": "5a21e8653e0edc0bc81595debf88c63643bb8b9a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218293, "uuid": "0eb45c4a-c2fc-48bc-b935-9df637235650", "comment": "Malware payload", "value": "4d5b466ed38ac4a2d419aff601484d0be83ecc7d4e36d24338e5a511ed650ae91292d1a539bf3e1af9e1f600f0cb4c13", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218293, "uuid": "20804c34-3d9c-4c2c-b543-61e89f9bc0f8", "value": "438302E4CB5F0C98C1859E0E3A27FCA8B915710C712862F6FA5D59A527534DCA2B2CF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218293, "uuid": "cb93d6ff-9605-4b44-bab7-eb2cdf644259", "value": "1536:4uf1lwsMJDr0vqBuKXxP8JXvKDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnnp:JcbkvaXxP8JXoM25NfuQjMCYNBwltD0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218293, "uuid": "c2bd8e17-b792-475a-9548-258a268912b1", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218293, "uuid": "be27bc46-e6a1-4680-b34c-4920c73de3c6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218293, "uuid": "02c29f1d-f2d5-475d-bfc8-ccc8f96b50fc", "value": "catalog-1429627241.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd6e0a6b-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221531, "uuid": "d2f351f3-c8e7-4b06-98f8-0aca37dbc91f", "comment": "Malware payload", "value": "4c6bd4c8d4de0dd7c98128315808d263", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221531, "uuid": "def6fb3d-5908-4851-ac74-ef066594a109", "comment": "Malware payload", "value": "264305133d3ef2ab9347a5724332ef70dbf1619a30276e2e5f731dd967784b3f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221531, "uuid": "5267e9d4-de8a-4047-b0c5-14042eea28ff", "comment": "Malware payload", "value": "b467fb4289e65e76fa1cb14694cbb4d7409a6a68", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221531, "uuid": "71e31844-1526-4bc2-b3e1-303a20cc6fae", "comment": "Malware payload", "value": "12cd567501bce6f4539e4dc1fe07d295ffddd5f14c3404dd5b49556943f89383a2ba5f51ef54515460c6412d6185aff3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221531, "uuid": "caf1e1b9-d09d-4b1c-99f2-838af3d338ef", "value": "1F83124D35EDC041E17F7D6093AAAD5901B86F4BEFFB9164CA6961329801863FA0368E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221531, "uuid": "5a87afbf-af0b-40f6-9683-62e7c5aec464", "value": "1536:2EwJNfD6jITxi7UnLkb/Yw3LCq1GeOuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzS:2EwzOEliUne/L3LCq4kO6xoKDShicdBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221531, "uuid": "83d6aa06-c09e-47d1-88db-8a086e9c779e", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221531, "uuid": "9464360b-df6a-4353-a6bf-9527f8843975", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221531, "uuid": "2b1f9f84-6113-4119-8700-fe1abc42f9b4", "value": "info-1736392838.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d0be27-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220580, "uuid": "ba7b1f48-98a2-475d-bb41-7eb630e35076", "comment": "Malware payload", "value": "e2c3b45102ccf9ffe8e3ae1555813787", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220580, "uuid": "84b0e492-dd3f-438f-96b6-abbb8fe6faf2", "comment": "Malware payload", "value": "2646a2dabb284aae96907ac35ac192297ba3cf1264d92df632589dd841bb4368", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220580, "uuid": "fd47deab-51df-4de3-9005-f7de90bea4e2", "comment": "Malware payload", "value": "1dbbbbe0503642d871b98e5d021cc392d8ac57db", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220580, "uuid": "497b2078-c0a8-4e8e-a9a0-5848b79641bc", "comment": "Malware payload", "value": "ce510e0b064781b260328390ff366f2f207da3a6351fd156e248c81e4496341f9972566ce2f35dc8607dd003e55128ce", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220580, "uuid": "84b0fbbb-162a-4428-82f0-0bc78e56dddf", "value": "74831277F076E96E829CD0B1A01E3A1839F875C3A435978EFD1D3A17C426DCDA91182E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220580, "uuid": "409e81a8-febb-4fed-aefe-abfd6ea3bbea", "value": "1536:CJs4DkjRjDC+ramyNIPjLxx7mgV3e27JWgtrQZcUT7oqlaHvvbFq9GHocnoe1Rqg:sLoNfPrG+vxxSCxIGUT7o/v096oiBkwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220580, "uuid": "fff100e5-2d2c-4231-bbf2-f82d938a904c", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220580, "uuid": "c3a6a7d2-097c-4f19-9c04-8c14ca88ee7f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220580, "uuid": "f88382a9-3575-4658-986e-217a19bfdb27", "value": "info-1254682351.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e05845e-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218364, "uuid": "76d8b637-d33b-4188-ac76-521dca025eb2", "comment": "Malware payload", "value": "071d97d29b51014855182b8c63da3d5e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218364, "uuid": "1cbe7f19-bbb3-4406-87f3-5f8f9995a79f", "comment": "Malware payload", "value": "265aa01a21ecb2d1ec7b67930608c7972cb3f1be137f2c57a755ef85d0353331", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218364, "uuid": "7b09b1cc-6103-4a6f-afd2-f26f67da0072", "comment": "Malware payload", "value": "fefe21efbedeece3e0c2e145521ff1518f832555", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218364, "uuid": "675ba6ff-6fae-4267-a758-6a717f4882ec", "comment": "Malware payload", "value": "4e98112956cd0a49e16b02b36fd3835d2565d2f0eda8ed1ac94f93f0beca4bc1a5e81e06703ddc1a446b8283a5322692", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218364, "uuid": "6cc16ebe-826f-453b-9b93-468ed74c440e", "value": "B4830217FB8626618056EDF25B3A3B2E6A8379DD795471A64FBC03C0F53614E1CE81C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218364, "uuid": "b43f2e6e-ecca-42ff-bceb-3c1ce364baf3", "value": "1536:Xqmy0pi0wcMlbCUN4gCQZiwotTCWxxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZW:ry0pgGUNEvtTCWzJ9a03fjwe1moYpoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218364, "uuid": "8607c9d4-c913-40ff-9b41-110cacd52d05", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218364, "uuid": "bc81a5f0-f6db-4c63-aed9-80f2ec9c8d3c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218364, "uuid": "38b096e6-a662-4254-bdce-a38a58bca556", "value": "catalog-1459503467.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70ebeca4-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220007, "uuid": "b9ffadad-e7af-4309-945a-a5788a5b4d2f", "comment": "Malware payload", "value": "db3ba290d80e856ec4973d5b2d1fd852", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220007, "uuid": "2d469798-7e0b-4d5b-83bb-9bc8953b7396", "comment": "Malware payload", "value": "2660de81c4e728fd0e1050cd9d0dc8b8e1c4609284985bbdec79451a1432bfb9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220007, "uuid": "d313a100-b545-42d9-be4e-5d5a228652a1", "comment": "Malware payload", "value": "7d632c8d3037a46ba1124cf5d1ef7f5b9e7974da", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220007, "uuid": "a8ea34d1-5f6f-41ab-b90e-fb17161cd8b4", "comment": "Malware payload", "value": "f0db4ea50f91c6f5831ddb45eab894efecb642284bc1f9e35860f6589a20b1fe6ef5ef0fb0ef95c0a057fe9c7564afaf", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220007, "uuid": "9f14abf0-d874-4174-bb29-d8dc04368bac", "value": "EE8312EC70238A65637341A6DD7E90C32B5B8BBC441DB056A82B797649307FFE121531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220007, "uuid": "e76615b3-3640-4ecb-a846-e8d5b6e73f63", "value": "1536:azKTWDE4Qgl8LS4v50FC+p7UjoB8+wXdpUna5ahL2dmTLUVVvr:aeKDPKLRvaFjp7uXinakEmEVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220007, "uuid": "afeffc7e-7921-4723-8d37-226a406475d8", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220007, "uuid": "60e1aa89-69a9-458a-8647-13ad72ddcdeb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220007, "uuid": "81b16e20-39b5-40b4-b8a0-23672fe69a7b", "value": "catalog-461561378.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d62d7e7-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217880, "uuid": "306fc6ae-229a-4b18-887c-181ed289204a", "comment": "Malware payload", "value": "6aaeeb607745cfc80762c4b3de63a815", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217880, "uuid": "af2a34d2-13c4-4495-a13e-c49702834a96", "comment": "Malware payload", "value": "2678e822932130be91ca7033f4f1bd0653bcda2b0b6470d247e96df9fccbfdca", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217880, "uuid": "1885a0a0-f31e-498f-95c3-da0f087e72d3", "comment": "Malware payload", "value": "aec8c05fc50b3752f52b44c4189cce218dd8af1d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217880, "uuid": "57a5f2d4-b1ca-453a-886e-bc47ea0b91a3", "comment": "Malware payload", "value": "5469e3b1583144b53300d27fd4d1d9bf59d058c6a5d54c31c8ec4647034f846400a10f27d7f84a13a2878dbdfba7797e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217880, "uuid": "760d8934-cc1f-40b3-95cc-3529b6768313", "value": "2F83123BB6622DEC5812E612A1659FAD25FF5E47B6144C5ECA7C142340863FE3ED03E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217880, "uuid": "e072c5c7-693b-43db-912f-0acdcb1e45ee", "value": "1536:5zAS5f/KHErqQaiwotTqFUAAWBO3SNZzTJAsB0Ic6DMADMt5zC/IDIz10F:BASlmEXvtTqFKCNBJAIlcAGIz1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217880, "uuid": "1aa4abe4-903c-466a-a313-d09ac10e769e", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217880, "uuid": "a42b72ee-6388-4487-bd46-a785a9d46c6b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217880, "uuid": "03267993-ea38-4470-b599-a2311c3dec1d", "value": "catalog-1217504980.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec0e8dd-a42c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619179577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619179577, "uuid": "c66c3ae3-d95b-43e7-96c2-9812e469c24b", "comment": "Malware payload", "value": "dfa21a29e18c0d727dcee7feeb4b9cb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619179577, "uuid": "f66d3727-f474-49dd-ad0b-c545f790f824", "comment": "Malware payload", "value": "267c37f15594e1b55c509e743784ba4e05a7f2d5aa554a55a9357d1fc45b74f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619179577, "uuid": "9552ac52-c874-4ce0-ae59-d6b297b97cf6", "comment": "Malware payload", "value": "78e12cc8a57f8a918c5b126173c90d591fb714d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619179577, "uuid": "bbd709cf-1c30-454b-8156-082950203b23", "comment": "Malware payload", "value": "5731f9293c05233875346101236e6068020fe9acc4397b1cdecdde438d09f13939169f32cfbdfd0ebd31f5ad320a5962", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619179577, "uuid": "c37adc66-b321-4997-ad14-46ca8f1868e0", "value": "2F55E1E1B780C471E4735639983A9AA3A437B61D9D28890D7BC1BF1F7D723424027E9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619179577, "uuid": "28e292a5-90ac-434f-b85f-a1f21b0ac088", "value": "027ea80e8125c6dda271246922d4c3b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619179577, "uuid": "efebba27-1c81-43a9-a157-d91885e71c8d", "value": "24576:5Jlh9bDN+ApFWrZW2CWYyj4u/WfIPNjn5xHd2wtt6xYKbc:5JGATWVL/rdpVjn7Hd2w362KY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619179577, "uuid": "6668b882-afc0-4c12-bd0d-dce96fcaf147", "value": 1348493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619179577, "uuid": "a2e9d20e-b21e-4a39-a38f-260185bfb802", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619179577, "uuid": "8be54dbb-7818-4be8-a810-a3da1915d2f7", "value": "1RIA_IT_Formazione di Base Compliance_IT.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6925df-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218788, "uuid": "00f6bad5-4570-4869-b8cb-065b0b588df6", "comment": "Malware payload", "value": "5d78a1def2f2db607a23e5e9e2cdf0be", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218788, "uuid": "0be9876a-37cd-46b6-b7b5-976f870f5b5b", "comment": "Malware payload", "value": "26a30bc4471da6d3a1e0b9ed3cefa202d478d3f79d98b57c53da5bb4b4274a32", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218788, "uuid": "546d7c2e-19c8-4254-9862-5925dfacd5c0", "comment": "Malware payload", "value": "0900f72b6e57156e052e1b7f743d193c9d716e8b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218788, "uuid": "198c81d4-3008-4120-b298-b55bdac2f76a", "comment": "Malware payload", "value": "626df5691d40e41f0b5dcb2e1e3b946f06b48d5dedbf0a5a3245c1fafbfe001cbf20a229430c43dafa8ae337353415b6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218788, "uuid": "1d085399-f7e5-4248-b2c5-bc69588c0547", "value": "7183121F7B8B75328057E7718F352A0DB393FAED240C6159EF9E47A4FB2600A68681C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218788, "uuid": "11384e90-02b6-42df-a2b4-caef7fea0fbb", "value": "1536:DRn2h1Uf0IzwZQ72ZTYzqcIxxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZiZtT:DR2hszG6IzJ9a03fjwe1moYpov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218788, "uuid": "41c02bdf-bc4d-4166-a201-3fd2494d4041", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218788, "uuid": "62887a43-5a47-40e2-aef6-dd5a7ec491e8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218788, "uuid": "7ac0e6ac-c9fa-47a2-8483-7f2d433a2ff3", "value": "catalog-1711703650.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "898c6767-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221766, "uuid": "de0dad5a-3b9b-404c-8557-da45a99e8107", "comment": "Malware payload", "value": "a65dff4f1335b7f9e8119933c548842f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221766, "uuid": "b3967b9c-9e71-4992-9f9a-0a373df4d4d9", "comment": "Malware payload", "value": "26aa27905f90dbf69637f4c4eecdeac28192fca73c6622582131db269dae8ced", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221766, "uuid": "e83c8ef7-a7c1-44f5-b5ac-5197be361f64", "comment": "Malware payload", "value": "0b78636f24610dcefc4b5c514dfd6b906d069884", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221766, "uuid": "c34d9ea7-de86-4173-b89a-564b86a2e1dd", "comment": "Malware payload", "value": "2bf4b8272deee2f7e7899ea9220442957b217f8465ec08a3cfe2bbefda851377427821f04cde76cd68ae9681cb621f05", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221766, "uuid": "6593bd74-4b42-4375-8de8-8196844beb2d", "value": "1383124D35EDC040E17F7960936AAD5901B86F47EFFF9164CA6961329801863FA4364E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221766, "uuid": "8431bfce-1c0e-483a-bf91-ba6e8cdb6fec", "value": "1536:5EwJNfD6jITxi7UnLkb/Yw3LCq1GeOuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nza:5EwzOEliUne/L3LCq4kO6xoKDShicdBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221766, "uuid": "7a4fd4e8-c4d1-4c59-a38f-40ca1fe63fb7", "value": 86795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221766, "uuid": "a83697fa-285a-458a-8b7e-9f466bb67068", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221766, "uuid": "3c6bae1c-6da5-4367-bb7d-f390a444918b", "value": "info-186852815.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c9db2f-a475-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1619211074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619211074, "uuid": "59fd7799-982a-48c1-b876-4671136ae55e", "comment": "Malware payload (RedLineStealer)", "value": "f69debc97cd0cdeab46551aa1c11ab26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619211074, "uuid": "2ec0254f-29b1-495d-846f-47c028926003", "comment": "Malware payload (RedLineStealer)", "value": "26c5b3072bbb4f20692b96aaa6ca2b4b2324b83cf73abcadbb3914030e5caef1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619211074, "uuid": "22a94b51-b4fa-4753-a9b4-ae45c2508550", "comment": "Malware payload (RedLineStealer)", "value": "0c143eced846fb637323404d1a157b62b567531d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619211074, "uuid": "646565b6-a016-4145-8b35-6b499e177e62", "comment": "Malware payload (RedLineStealer)", "value": "d9b407044031206b4553f10a948a6aef48d60bfa4da22fffe34b98aa7fe8c9ff625451bb5194a05eaa0fa39e45c91714", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619211074, "uuid": "3e9da417-8e4d-4c6a-b336-78f6f5d0d4ce", "value": "0BA2FA6077E89739E5FE2FB825B14224C672FA614D02D71F8C9401C26A17FC09E7A7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619211074, "uuid": "81d23b53-20f9-48a7-bc28-773f7c85a66f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619211074, "uuid": "326f3b46-7de3-43c8-a4d6-cd0acc7be83f", "value": "384:TOVYaitdSQumunxPq3IINorem20+ZedsOF1a243sgpJV0vSEOG4:yWZdjf4jnJMeFm8g50v0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619211074, "uuid": "501d9272-ae86-4e06-b817-2913d45f6ce8", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619211074, "uuid": "1e9e6ab4-d728-4780-9550-2b14ae48ac67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619211074, "uuid": "f3ae71ce-99b9-4b68-97a0-5a1356bc31c3", "value": "F69DEBC97CD0CDEAB46551AA1C11AB26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a75ba4-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218211, "uuid": "06231c10-46d5-42ab-95c1-f0d0a8033938", "comment": "Malware payload", "value": "3e11cc5770d122646de6c7c8fc3925a7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218211, "uuid": "bd42c441-171c-40bb-8067-e637598e3d08", "comment": "Malware payload", "value": "2780822aa04b62c1ce5554e647be3f542e47e5e5908f73aa748a3d425003705f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218211, "uuid": "9b999392-472a-45c2-b054-88b6eb722584", "comment": "Malware payload", "value": "e885365f165df505c7bfc2cef8137e2b7c22308a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218211, "uuid": "42322264-bbea-485b-a500-61cbb3300b54", "comment": "Malware payload", "value": "cda2b625bf00361b2cb14881225f7f5b6f55aeff06aa359eceaaed261222d16cd0b6e580abf8bda9ed24b8cb77cc4c86", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218211, "uuid": "0cee9995-2749-4ba3-bb90-53343e9b3d6a", "value": "AF8312FCB92BD3DDAD7084DDD86DB1E706AE49989049B1925C0F3F222060BFEE815139", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218211, "uuid": "a4085c21-8719-4b1c-a2da-eff3757d3c9e", "value": "1536:guams3cgHHyQZiwotTC3pjHjoB8+wXdpUna5aha2dmTLUVVv9:l+3pwvtTC3pjDXinakpmEVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218211, "uuid": "44f79bda-6990-42bb-af37-22d00e98d947", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218211, "uuid": "5f795dd9-e11e-4837-805b-2045d53eef53", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218211, "uuid": "fee5add3-cc1a-4057-a04d-e02650fa8cab", "value": "catalog-1395399934.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c4dbb1-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220396, "uuid": "143444eb-8aa1-4181-bc15-0ad59d6f9914", "comment": "Malware payload", "value": "58db0c3f3a70e92da62d16c18fcedf1e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220396, "uuid": "29c979fa-776e-4165-b812-148d8d8706f0", "comment": "Malware payload", "value": "27ba5515c836ebcfa4cd6878dc1dce900f2ffdd22faf5aeabe6f5e3eb545d466", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220396, "uuid": "dce0c764-ece4-4eb6-9630-7416ce696d05", "comment": "Malware payload", "value": "1fdfe2a0e0db9d5d30356406b957bcb0db661fbf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220396, "uuid": "b8d226d5-f7a2-456f-9ee4-b20ea117e9af", "comment": "Malware payload", "value": "76393b5760af8070731322a724a336db38d1a04e4b02ca73e3ba04e8328bdd00a1e07deefbd70890e48703176c832ce2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220396, "uuid": "6a561b9b-f542-44e4-9b21-d779d3f9148b", "value": "D983124D14FEC004D1BFDDB5B27FAE4512FC8F9B9EBAC2044B9899329021AC25E6255F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220396, "uuid": "ee557a5a-b8a1-438d-bec0-eb7f30079821", "value": "1536:mdW7cmfQFxV/L+qSGKyuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbXYZTa4hpK:mdmozVj+yEO6xoKDShicdBMM1/XPQTxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220396, "uuid": "9e7b0c34-4458-4d0a-b578-4c55b4c3a3ff", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220396, "uuid": "75c8287c-2d40-490c-b26d-315d213669af", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220396, "uuid": "ddf8c684-4ee8-4930-861a-2263b6564778", "value": "info-1135997319.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe5224e-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220944, "uuid": "73e6e00a-1965-40a8-8901-b801a293ad51", "comment": "Malware payload", "value": "fa1cd3ff6a472af6524155ea81428916", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220944, "uuid": "7ff25b08-20ca-4fa8-a50b-cfe934574e37", "comment": "Malware payload", "value": "27bc3b3bd1b8aca7b724f8676c223d528dd0c1347cfa0262e4134d949fa5cb77", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220944, "uuid": "13c54fbf-c879-4864-a81a-8e87e6e053d9", "comment": "Malware payload", "value": "b2b1f13fa5620aa6f7bfce1a4eb615ea59f99820", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220944, "uuid": "6e60013c-02f2-4165-a9db-83fc6357aac3", "comment": "Malware payload", "value": "0e3fc2d5120a5051a6ac1b793ba917cda6cc0c45292250e8a8acf5e9d0550466f08b37bd57585271667878370e6d9c26", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220944, "uuid": "d8ff9f95-6b80-4642-a05a-e5e7de073d9c", "value": "A38302078A6158FDF16ABF01273DD4CFA64ECBE1E93559C0F20E7B65D2A3399225440B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220944, "uuid": "433e1796-935f-45e2-a66c-a870d3ddcc53", "value": "1536:KHZbN5m6RtLlLHfAkZ8kISNq7xWgwMQZL197v7UZoctQ2kPo+4mpRlDi1nUSUqx+:OBm6XLFHfA210wN19T7YptKRNpoUSUqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220944, "uuid": "d7516f97-355a-467d-8c18-d0b3c191caa8", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220944, "uuid": "cb6a5fdf-e621-4fed-a625-3980a104f75a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220944, "uuid": "5a3eb0bb-579a-47c5-9663-ab52ef2bf4a9", "value": "info-1393816452.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda890bb-a467-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619205157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619205157, "uuid": "cf84f8ee-cbc4-4b96-b7ed-ccfeeaf22828", "comment": "Malware payload (Dridex)", "value": "5b5aa9413b3c64b0830acd05bf7acdec", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619205157, "uuid": "ffd0b001-461e-4f9b-a23e-795ed1c3fa21", "comment": "Malware payload (Dridex)", "value": "27bffe9a3a4dbfc8dcbaf1d06dc2d4b3bec9c2a41f490949529bf63456ccec09", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619205157, "uuid": "c74835b8-dedc-4c97-8db2-7c3e46aa096d", "comment": "Malware payload (Dridex)", "value": "e82f632d5681374a42b62ed3e2b41799a8d7b372", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619205157, "uuid": "6ad43b29-aec3-4c5d-b324-ef54e8e17946", "comment": "Malware payload (Dridex)", "value": "b5af8591b957e22c19555a7111087b12f18ffe6a1959a4a8a1d13650835972d6473177db9f22a99cad3fc51b8b22dc76", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619205157, "uuid": "39d7afa9-7330-4f55-974c-596e179c44a7", "value": "A2F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619205157, "uuid": "ff31b3f8-1f8d-4ebb-bba4-965f732b3087", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619205157, "uuid": "1a356032-de5b-4392-afba-9bc0dbc22251", "value": "3072:Alpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Alo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619205157, "uuid": "2f2830e6-96d0-4929-abd0-468d9ce24bea", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619205157, "uuid": "2af95530-d906-4ab5-9fa9-7b9b388179b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619205157, "uuid": "fed631b7-c8da-446c-9f74-2035eabbb2aa", "value": "5b5aa9413b3c64b0830acd05bf7acdec.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e08d869f-a3f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619157058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157058, "uuid": "d6931219-698c-4f50-a79d-bd9d17d93d4d", "comment": "Malware payload", "value": "733c89aa229fb94f174f7188004a8702", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157058, "uuid": "4b20c14e-0d73-4a0b-ad90-a329355e6a47", "comment": "Malware payload", "value": "28259293c18700e907453e008b3541934a9471904ed63153568c1191104ac6a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157058, "uuid": "3e96c545-4d37-4fea-8cd4-2c88eca69fbb", "comment": "Malware payload", "value": "66b6be028963ca2fa55ed53a036bfc1525c8cd30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157058, "uuid": "80ce3d0c-895c-423b-becc-fe9ac1267a08", "comment": "Malware payload", "value": "46bdc4474a2b8338fd5eba20dbb1d5dae239324a49ef0900ad18ab9470f1f9423e5c1b8b26f090cc8f14635090bcc38c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157058, "uuid": "29016bdd-5387-4401-9352-303623b335c8", "value": "2B75D0AC7650B6DFC497CD77C9682C20E660B47B470BE203A49712AD9D4EA9BCF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157058, "uuid": "f44b2ae3-7349-46fd-b131-4759566fbf4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157058, "uuid": "ec38ddca-030d-4d50-a8e4-ecc32c427ae7", "value": "49152:qXv+BX1K3DaQTmD9LnAl8yIJS2rFwehi8:qUXmDqpccdFwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619157058, "uuid": "3a0de82a-a2d8-46b5-b2f2-4d2e2e686cf3", "value": 1589760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619157058, "uuid": "c8cffcce-934f-4012-96db-e83fd457eda6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157058, "uuid": "e06d9a97-8f38-4266-99ec-132e49966e0e", "value": "VWR CI 160421.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad21333-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220023, "uuid": "a3a303ac-8c0b-4242-84a9-63d52bf6c1c0", "comment": "Malware payload", "value": "b55f88fcaa9a19583588df471d9d19ab", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220023, "uuid": "3ca8eb8e-f0d8-4e76-9d31-6282fb8b6bb2", "comment": "Malware payload", "value": "283fd38838597c8685051fcaedf52bd01f071cd713a779ff74a30010acf5124a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220023, "uuid": "dade100e-9fe1-4191-bf31-d3e9ae17a5b5", "comment": "Malware payload", "value": "6941746eee9202c2c45fcb39dc64a3fc97ccb632", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220023, "uuid": "2cbb2cb4-45c8-4a8d-b19f-f8a5d33cd2ef", "comment": "Malware payload", "value": "e9955ca3a1a3514895486093c0cb7c0204015d105e007882a62c32c0c08f90b9a288b167fd81cea58858c6ccd36b8813", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220023, "uuid": "c17ed7c8-e34b-4535-bdd3-47df68cc9a40", "value": "1A8312A306CD685D711BF828C1647F8F99ED8F579F041A0FCAFD472B11969BC3950285", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220023, "uuid": "65b7ad2c-067d-431a-8e1f-707d5e9e812c", "value": "1536:r2fnBKjQUgFsqi+nTnfZA6l3SNZzTJAsB0Ic6DMADMt5zC/IDIz10X:+JiifrCNBJAIlcAGIz12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220023, "uuid": "4ed217da-e6e6-48c1-92a0-dfb684d01121", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220023, "uuid": "f8904632-c58c-469a-bee5-58038b59558e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220023, "uuid": "ca592fd6-d582-4a6d-ab21-dba39c739b87", "value": "catalog-472665291.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dee0b76-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220324, "uuid": "06eb7f79-6856-4e6e-8339-fb78bf782799", "comment": "Malware payload", "value": "993c1355d74a43bbf657eef6dedb71ed", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220324, "uuid": "1c5ff398-9a3b-42e0-af32-657c338a1ef5", "comment": "Malware payload", "value": "285592df25d24f693d1df7fae1688c2fc89efd5e01f76b1ada6806f66d275e9d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220324, "uuid": "a876d953-bac3-411f-b3ca-ba4d64e99629", "comment": "Malware payload", "value": "623f703ae574826f2eafed9e3504d166b54fee2f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220324, "uuid": "f85eea59-a747-44c9-b6cf-0a27172138c5", "comment": "Malware payload", "value": "0b06cddfb109f0943266b3a88b3a5fa5381bc79c38ba121d049b50b358b15f7af216ffc9ecf2d86d90faa937daa398d3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220324, "uuid": "fd46d7a0-1fb3-4530-8d41-8298d1ee7dbb", "value": "6283024B598828FFE295AF10233CD99AAA0FCAF4D9705514F20BE75CD0B7B29726041B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220324, "uuid": "44db27fd-b270-4017-9001-da8cb63184d2", "value": "1536:Pz6sEDF9MwsqZSCzfAkZ8kISNurvd197v7UZoctQ2kPo+4mpRlDi1nUSUqxuun:Pz65R6wsqZXzfA21s19T7YptKRNpoUSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220324, "uuid": "4696f075-0c0f-4530-b010-5bfa3b5cc55f", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220324, "uuid": "2d93ce9e-e9f7-4afe-9e06-86a693453fbd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220324, "uuid": "9cb51c78-5367-459f-adca-09597d128c17", "value": "info-108641691.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1638f53f-a3f3-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619155001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619155001, "uuid": "9f11d5b3-31ec-4dc6-925b-d214647837e7", "comment": "Malware payload (AgentTesla)", "value": "4763996114dbf73835b299b7f8926ab5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619155001, "uuid": "a3744004-4471-4eab-a6bf-bd97d5de9b65", "comment": "Malware payload (AgentTesla)", "value": "28666c472d0613f66df792b2251b8b2e0411dde5f5268730fde2cfbca1e04206", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619155001, "uuid": "e6a4c552-4232-4d11-901c-5ba0737ffd35", "comment": "Malware payload (AgentTesla)", "value": "50812a858c3868c163c3819e17cef13a825acb5f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619155001, "uuid": "a6de2c15-e7f6-4900-b5a4-cc3c90baa412", "comment": "Malware payload (AgentTesla)", "value": "ed9e52d758f2931ae3b35e40e0e664e866ff03c0dea1b6a54c2d75e966eb35e99d070b27b48a808637d5c21a9debaa20", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619155001, "uuid": "92feb284-4620-46fc-811b-47744bdf8ba4", "value": "8F357C9D3250B1EFC85BC876DAA81D64EB6174BB831BD203905316ED9E0DA9BCF144F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619155001, "uuid": "d4c2b262-8e9d-4384-b29e-1f6acab25036", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619155001, "uuid": "7d6aabe5-8c03-492c-8be9-081f21176e21", "value": "24576:kY6VmVDO5jlBpjrDnAx2LFSGLSRb1ykkav25l4:kY2mVi5JPDAx2x1Gvge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619155001, "uuid": "5b4566db-77c2-418d-8e88-0d63fdc53487", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619155001, "uuid": "d06f61ac-d7d5-47f7-b3fc-c7adc1b36138", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619155001, "uuid": "2632127e-a9e2-419b-8d80-d407d98ab8b5", "value": "PROFORMA INV.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f87680b-a44d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619193698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619193698, "uuid": "7fbc58c9-e7fe-4c55-9212-535c8a6a431b", "comment": "Malware payload (AgentTesla)", "value": "8e95276f86fc98a28899685a32d6ebe6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619193698, "uuid": "6b246f10-3ad8-4674-b1dc-19775e0ce7af", "comment": "Malware payload (AgentTesla)", "value": "2873b7d2f5bdd896729bf4f5935c500ceb2cf132b8266d6a67d816e7496a35b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619193698, "uuid": "ce5eb347-b469-4cc2-ba45-c2cd4dad9f0b", "comment": "Malware payload (AgentTesla)", "value": "569b59e1cc67126eeaf527087442009ec9ae542e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619193698, "uuid": "eabd4c65-477c-4fa1-99c4-233b161e8c01", "comment": "Malware payload (AgentTesla)", "value": "8e25d5e522ad77bb129aade5ce7fada180757aa2fa8df08bed6fcc74a43db2e8235f4a632635ca52f38531e4d147019a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619193698, "uuid": "0c2f5b75-29ed-48bd-879d-fbd423fb7a28", "value": "1A1501343288855BF43F87FDD85B950013B5ADAEB593E35D6DA2F2D908B338201A6C5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619193698, "uuid": "126c0d63-11c9-409d-9625-0a38393cace1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619193698, "uuid": "6f698933-1e83-4c68-a96d-37b16b0f7973", "value": "24576:qWc/bkK6u0aZP7tULeRcFa/1pH9XIfo5E:lc/oK6P6BRckLD5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619193698, "uuid": "8eca010d-14dd-4316-b70d-219cb5b602ce", "value": 910848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619193698, "uuid": "11500b3e-5068-4e0e-a7e8-f2080fcb1cba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619193698, "uuid": "38043f41-662b-400a-8a55-6073a9a49064", "value": "Payu Remittance.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b46ba75-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222064, "uuid": "d1da2425-179f-41db-95bf-664ab4126385", "comment": "Malware payload", "value": "73becaac06311a8cf1b13c469791bb5c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222064, "uuid": "9e78a52e-ae63-407a-9b15-e6347f89eb85", "comment": "Malware payload", "value": "2881aad3a71b1f4e1d1e85da2161b90fdef19a1e937525e258bf6c519e777cab", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222064, "uuid": "3c83c196-7787-4805-863e-f2fd2ca1165d", "comment": "Malware payload", "value": "7ca11285c72a39e7cb95f10b00c10f21429b040c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222064, "uuid": "a1ac3c53-8ddc-4701-812f-27c6b009ad62", "comment": "Malware payload", "value": "a0887e6e6a911f65b2155ffc1faf53d6342fe348c09dfed2d997dc4bf863441cbaa792469f554d27257b27be05f1d9d0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222064, "uuid": "42006cc9-a569-4f9d-902a-fb04f3070afd", "value": "F2830215A0FC879780E305A26A307AC78AC0E797584CC043B1349E27A4F6B79857BF5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222064, "uuid": "e85c5805-9c2b-43e4-9b7d-dbfce0a842b6", "value": "1536:Dt1QVGeGug5dwSp6yMvBjqqxM5Y2VXw1QFsrGq9ZMlmZQTQdD:3AG7u8l3MvBjqqqXw6Af5dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222064, "uuid": "894cc669-52ba-4b12-bdec-614b6e8789a9", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222064, "uuid": "d7f408e3-4f88-45b8-b44f-c12916b541c8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222064, "uuid": "2378fca8-1863-4fb0-b631-d18bb860de64", "value": "info-2103546118.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35fbc42e-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221196, "uuid": "2ece7665-a684-45fa-ab5a-85ff5376a925", "comment": "Malware payload", "value": "b75412edd29d49d5452ad683a0af23b2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221196, "uuid": "cf31d74a-755e-45de-921a-044798c8ecb8", "comment": "Malware payload", "value": "2895322b60b64ca8f8474ad2cf586a54334cda202e5e66360b2e2479c09c47da", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221196, "uuid": "d8a61d94-2a73-4966-b78c-47df3b0e0ca0", "comment": "Malware payload", "value": "fd9bd5e57d0da49dccd74fedb3d777ab65cb9004", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221196, "uuid": "cb041255-20d6-45b0-8119-03c924d9e82a", "comment": "Malware payload", "value": "f2c5b778871c84527e90af39b963af00781480e149f532b3eb5b6cc1efdd9211c2706e5e9f520fd1f43e8b65a8f69814", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221196, "uuid": "63811153-a533-4fe9-9409-ce0bb179b51f", "value": "7383026EF462586E81AEE0B2513F275825EC52C1B434DB9BFE2D3D0A98779CD2C0581E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221196, "uuid": "7fd0fbca-ba25-4447-b22e-718adb37e31d", "value": "1536:U/VtmQNt5s5t7mgV3eE7JWgtrQZcUT7oqlaHvvbFq9GHocnoe1RqfwSOJrpMEIpH:UtAQzS5tSCrIGUT7o/v096oiBkwPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221196, "uuid": "295e71f8-31e8-4e99-993f-65ca572cd603", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221196, "uuid": "28e669e0-4d22-48ac-8202-f537c62b9cc2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221196, "uuid": "c7578bc9-17b3-4f17-af78-12740be7e3b8", "value": "info-1551692926.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c43af8-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217767, "uuid": "57118b15-c535-41f2-927a-ae77a0c5b003", "comment": "Malware payload", "value": "249bdd2f7325fd32e061687e2695af5d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217767, "uuid": "8eb39f84-800d-43c1-acc7-37636d90c97a", "comment": "Malware payload", "value": "289d600b23c7a634ae90d0cbe1a01c309b342f2a5d28c9e7cc1a9d6938f593aa", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217767, "uuid": "8a2104fd-24c8-4478-8cd0-db2c96987142", "comment": "Malware payload", "value": "151548848c4a32e580305a1229514aab2c5cb413", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217767, "uuid": "a91a8ba1-f6dc-4767-9680-3c72770ed1af", "comment": "Malware payload", "value": "393f0618d1e66cc67a553a75845f83c85ca5c7fa5aa1b7235128bc89f3a309c0ad9ec6bb724afd198201fe8eb9885729", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217767, "uuid": "1d02c6b1-fa79-4783-92e7-fd7e6fa9ba8b", "value": "FA8302FAF953157A42FE7262767B7D401EBC36F49E3122B682A9601790B07E9C8C421C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217767, "uuid": "beb768d1-b455-4a5d-a4f6-a4a36a8cdddc", "value": "1536:BAQKTWDK4QlztdZ2rQD2aCM1ZQUcDdiFALqCJI3+xOtGkwde2eDiFXo:a/KDMzQQKG1ZQUcDcFALAOxeh4eNq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217767, "uuid": "c55a82b6-6ca0-455e-a6a6-8e9d4a198d14", "value": 86930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217767, "uuid": "48fde1f8-4939-4964-abd2-987323191bff", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217767, "uuid": "1c2b54e9-034b-4ec8-b15d-4dbb7a3fc348", "value": "catalog-1150570543.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f5c974-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221839, "uuid": "9edf0663-6860-4bfd-9e87-6c1372301bed", "comment": "Malware payload", "value": "bb4bd9c9f5d52cbc74d77f19fd449c37", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221839, "uuid": "2474d659-199e-43a7-96cb-37e88d0618da", "comment": "Malware payload", "value": "289dc1a7b6116be4c5833cb1dbb723c4abcf32cb05c38a36367af9d5aee45a22", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221839, "uuid": "1b9bc76d-8de8-4f68-bf64-2d2846cd322c", "comment": "Malware payload", "value": "99c7331428999ca015ead8e35bd0f0c9b2464e09", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221839, "uuid": "440d2c51-3769-43e9-a5e9-edffba7cdd81", "comment": "Malware payload", "value": "31b0b0c8f0b07374b0b8f0c9690399db39102e17b81b4b0d28a304204bd22f14efc97670dd2233b5a3f4e17542fd8071", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221839, "uuid": "8fbda49f-eaff-4c8b-b5c0-06484b93e4b3", "value": "F683127818666E4DCA5ABAE162FC32983ECA04333076439F6959F433B247F74E1741B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221839, "uuid": "e48319df-9f25-4090-8a65-8c3fcd27e6b1", "value": "1536:orZSmsPvSp6yM8zmWtNlTJkv9c/EWd8E//nfYRq1o+VCQHeWnsUWuopy8:oNSmo63MxWtNVJklMdT//gRL+VbARL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221839, "uuid": "dcb96f5a-00e1-49a1-bf66-df872214d7a9", "value": 86799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221839, "uuid": "3d745c76-5213-4de3-99f4-964747cab11a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221839, "uuid": "afa3daea-ba78-44d3-8a8b-b4b463812d07", "value": "info-1922214223.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98361898-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219643, "uuid": "a1e76619-12c1-4df9-9e3a-f5ecdd5c38fd", "comment": "Malware payload", "value": "47ab7ac3e2de8b338f8d427c202bb683", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219643, "uuid": "c99b38f3-6b93-4a4b-aec2-0a82cae9435c", "comment": "Malware payload", "value": "28a2c3024c0562c61a866ec690e241376ec8b90e70db6548e343cdddf711fdde", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219643, "uuid": "a4239966-303c-49a5-81c3-4f23df2062ed", "comment": "Malware payload", "value": "ac8c7272ded205ffd947224a81206c0522a1f684", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219643, "uuid": "705fbec0-fa0c-492d-906b-30f9f818f2e0", "comment": "Malware payload", "value": "07fc53c18fc0ace5ec9f314e187c0ea33398df7f280b2aa0d21ce20c4130aceaa124b1d94caff257ffd62c6e58ef0fe3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219643, "uuid": "9179a8c6-9861-4b27-b847-5370ec14601e", "value": "63830232FCBA2BCC5C1DD820D0666DF4096FCD9A959333B859682D32208D67D6B419EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219643, "uuid": "7de91ab5-c1a1-4790-8dfd-ed70905def9d", "value": "1536:Eg2sNyMfHfrqQaiwotTqFUAAWB9Te87VqINbtezgVRxr9AiUrQTKXs8FI+bo:qM3XvtTqFpe8JqmdIrLjFRbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219643, "uuid": "2ef79ca6-927e-4880-90c1-c83a4b347d83", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219643, "uuid": "d0191a38-e41b-4ba4-b666-8702a6f61d28", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219643, "uuid": "a8b773d8-682a-46f2-840a-36eb62ffb76d", "value": "catalog-257990750.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58649b2c-a3dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1619145663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619145663, "uuid": "f1248d5e-1f1f-43c2-8e00-72355921ddb7", "comment": "Malware payload (RedLineStealer)", "value": "c2c930e906a6d02e3ecce5bbbacea85e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619145663, "uuid": "d9014826-33da-4f61-9593-083e21cd41cb", "comment": "Malware payload (RedLineStealer)", "value": "28b819fc5c3de475ff470c2e0943cf080e8eeb3360b0ad444ffe158aee26d424", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619145663, "uuid": "87c99165-4da4-4017-9523-9a0cb96dfaae", "comment": "Malware payload (RedLineStealer)", "value": "98267254d477cd63bdc164bb7daba87bf359fca1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619145663, "uuid": "146ec57d-a216-4001-911e-4ff9cfb4375a", "comment": "Malware payload (RedLineStealer)", "value": "e45f4ae0ebeab10af0b3c4ce4304ca578bc994f511a16ad94e731aa863f9d8494769086dabcf7be963fcd229213fe469", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619145663, "uuid": "2f50bfc2-1a84-4e82-9776-3134468afeb3", "value": "4E924B2527ECC335D6DE2BF998F183548671E0528503EB178CD885C66EDB7854EA33E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619145663, "uuid": "3a5152df-3537-4a58-8a38-c2091b2b6fce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619145663, "uuid": "0206a7d7-f504-4ad0-be56-ddad559149ba", "value": "384:7g6YaiTvP0MlicQWJWJNVNUborAJLbyNyXa28tzLPZsA1SEXr:UjPvPplijANbCnPJ1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619145663, "uuid": "10d1f7cc-f4ee-479d-adaf-bee60f4e7218", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619145663, "uuid": "7d17507b-4f6f-4aa9-8418-82fdc543d185", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619145663, "uuid": "343a3803-36d3-4fe2-9fea-57ab8bf65080", "value": "c2c930e906a6d02e3ecce5bbbacea85e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d0e751-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220317, "uuid": "7e9591be-74eb-4231-8351-587f5a3701e9", "comment": "Malware payload", "value": "3f393af911725d9b5990f77ce09603e8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220317, "uuid": "4d64a5a7-f25f-45aa-b1a6-be74a3688560", "comment": "Malware payload", "value": "28c623d226879486894e5ef2ed499d529a7616b333a54d3116b7c75f61ae9a1b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220317, "uuid": "5c6a516c-cdd5-4013-8f50-d2f8bbc30341", "comment": "Malware payload", "value": "47869859f4be5dfacac34b80b5d610215af7741b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220317, "uuid": "30c71cb7-7b14-4bff-bcdc-833191d42cf1", "comment": "Malware payload", "value": "2b2e3e21f3b30159ecdbbb447900c5c813a01da6301cc0c414c2f7e18f8762712d515ce81b508d4ce36019c15a908f87", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220317, "uuid": "a180f652-aaeb-45db-a561-f7a8c62c3a90", "value": "8A8302AD1826BF0D9B09E9E262DC37AC7E840073B1F093DF401E607271A6FB568611B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220317, "uuid": "0b4591ea-71cf-4499-bb75-9da79871cb6a", "value": "1536:7qKtaLgbGL+q1zmW7PlTJkv9c/EWd8E//nfYRq1o+VCQHeWnsUWuopya:7qKZi+xW7PVJklMdT//gRL+VbARJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220317, "uuid": "bb9afbd9-6358-437c-913b-9f10d3b16891", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220317, "uuid": "a1a0dceb-662e-499b-8ccf-54d876325ee6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220317, "uuid": "96fbc20d-cd80-40b3-b1fe-ce398c112551", "value": "info-1081181301.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6c70f8-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221801, "uuid": "898d6808-4246-40c7-a8a1-84ae463b061a", "comment": "Malware payload", "value": "fb901e5743d934f9260374d915f476bb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221801, "uuid": "87d6f9c6-55e6-4d56-8f08-6fcb2646113c", "comment": "Malware payload", "value": "28cd15e7f1498288dfe5af5ebea6087fc43fa3597538147380cd03b38a894b3e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221801, "uuid": "0389fb5a-c101-4de2-8d74-c3c9a0d60ee1", "comment": "Malware payload", "value": "feae20343969693d0272e3d9d0db005ea460ed15", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221801, "uuid": "ec89f13d-5242-4d29-9bd2-bdfbcb6ec80f", "comment": "Malware payload", "value": "2d336634a5ed55796c760379ac832cbe1d7ae008f70502d4619fcb89f956d74f69cc016adaadea8f2c605df91279078c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221801, "uuid": "530227e9-68d6-4a7e-b15a-035782d8fd9b", "value": "3283029C34FF0144957A68B8613FE80750FCAFDB2D37B74947208574AA114DAB6239AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221801, "uuid": "b20bfb4d-9b67-4e31-8c66-39025ffbdaeb", "value": "1536:dr7l+KI0ejUgUlrZKFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbXYZTa4hpU:17l+NUhlrZ6O6xoKDShicdBMM1/XPQT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221801, "uuid": "af768c5a-e891-43b0-ae93-40f9e37bec38", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221801, "uuid": "18abc101-9044-4b5e-bece-d245563ca125", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221801, "uuid": "43e9a663-8227-485f-befc-eb2c78c765b6", "value": "info-1891758830.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5252b0-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220326, "uuid": "5d6d3920-4b66-44ab-b4b4-570d6a248abc", "comment": "Malware payload", "value": "3c1441e9e28b55d4b8ee444d97e8a85a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220326, "uuid": "77d12373-dbfa-44a2-9059-1106aa0a7176", "comment": "Malware payload", "value": "28cf0716e3804d2441ca383d2eb337fd9d2d985799c9fe74d05d4fb277ea683e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220326, "uuid": "ef57c7bc-f501-4c46-8c48-5d589ecc75a2", "comment": "Malware payload", "value": "cada297792fd77809f056a8b30d87043e4a70b24", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220326, "uuid": "7f94c249-18c7-4f71-9a3c-cb87ebe0f8ad", "comment": "Malware payload", "value": "69cb67683150decb72f2894f567d97a00a16d850fb2c3df61c71218fd64fe9171db65abceb61787690985da531f7daec", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220326, "uuid": "99a9e085-bfe6-4045-8284-fff758868d03", "value": "298312A1A8BCA15F638EDB73D0777757E88009E5512C1E9B534221383DB8DEF8827239", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220326, "uuid": "757e622c-b04f-4d1d-9f98-325e7ee282fd", "value": "1536:xtaLgbb9ZvjL3+xnxv5ZUS8CWb/bLCDxxp/ERd9QnGlRTH7qrelco:xZ1ZP3+9xv/UHnfLMZERQnGnTHMev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220326, "uuid": "5cf3f39b-86e2-4d9d-818c-7591d61e7c5b", "value": 86799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220326, "uuid": "8f327169-0528-40f4-ba66-db56ca70fecd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220326, "uuid": "ad7cbb7c-50b8-4e12-9d0f-fa20dba017ad", "value": "info-1087210875.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d14290a-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219410, "uuid": "a6156ae7-f94d-4ce1-99e7-07817444c743", "comment": "Malware payload", "value": "6947154c09bdd456edd829f01280486b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219410, "uuid": "0058fb08-db06-4223-a6ec-e6b91395858f", "comment": "Malware payload", "value": "28d6c9863c7c63e32b9d08915ad1a07911522ffd58a3a8a41c178b6409cac592", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219410, "uuid": "f755cdbf-24c9-4741-8a91-04c10cac07bc", "comment": "Malware payload", "value": "776c8ea5167a50a0b4a621e97b3afe5ecc2fcc6f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219410, "uuid": "abb7376c-e0e7-4f15-ae82-796322c2d0ca", "comment": "Malware payload", "value": "7916e9ddf96905fede5761d494e41c0a1fa15a829c0aaf0cf56daa938368b2a4543137ad68b8bca8b3fa99ddd957734f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219410, "uuid": "1ff6e51a-a583-488e-a789-722845d261dd", "value": "8183028BB4D84339CB3523F658AE1E4422B1A47F140CC6DC75D73B786B53672A572388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219410, "uuid": "b51f8b74-9836-4acf-889a-82b61c85796f", "value": "1536:dEwAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvn:dHijtuPmU9j7+XFWtYe14hbOjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219410, "uuid": "ad5ead25-9a77-4854-bba2-b18b99a03fb7", "value": 86930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219410, "uuid": "19d7d6c0-5c22-4b39-a4b6-f08e5ee282e6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219410, "uuid": "6b0b0359-ae9e-4977-8cd5-6bbb41b3ddf8", "value": "catalog-207635530.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a49e36d9-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219664, "uuid": "5c0cb042-70f5-4538-9d0f-b930741bab52", "comment": "Malware payload", "value": "6601535d01238e2d652ee605d22c8f9f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219664, "uuid": "f50c788a-b80b-438d-97ef-759cd9b58d46", "comment": "Malware payload", "value": "28f2511e06e6945244e1474e9454d1b7e38350682cab99e0c22a65d50d12f5c8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219664, "uuid": "1f7f59dc-c778-4161-b2a8-97492f0d50cc", "comment": "Malware payload", "value": "50abe91ec80ec01295a3548c4b718d7b3416327d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219664, "uuid": "0a08866f-d3ad-4b9f-be27-bac2d2e74731", "comment": "Malware payload", "value": "30210b72994811ef832a30c3e327d0d32f9c0496854b520086685d49726f80ff9b673943ee320a352ef32173a3bd5af4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219664, "uuid": "98f5ad24-c3b0-424f-9b83-4c00e0f6fc97", "value": "5A8302E965423ABFC8FD950D206F3D402EACB2E56E3211E7D207D93770F9AA894D0718", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219664, "uuid": "cd4b45d8-a3ac-4656-84be-44fffd8ad51d", "value": "1536:ZrF5u1k94TfvqBuKXxLG1ZQUcDwiFALqCJI3+xOtGkwdO2eDiFXhk:ZrF5fsvaXxLG1ZQUcD1FALAOxeh4ONq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219664, "uuid": "4602b94e-f52e-462f-a935-301d4583f5c8", "value": 86930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219664, "uuid": "33ada9bb-d1b9-4203-88e5-aba997a80d4a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219664, "uuid": "e1a43db9-4d03-469a-a1c5-405106b0e6a7", "value": "catalog-269947405.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7453ad2-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218058, "uuid": "6c8d9b15-f53e-4107-b57f-c61cfd4574d1", "comment": "Malware payload", "value": "5fbd285a309b315903ee8479018a736a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218058, "uuid": "62f3791c-8303-4cf7-a53b-e0614987272c", "comment": "Malware payload", "value": "28f2eb23862e066cb598502941f112a47ec9c44f444bc68c23ee7030257e7018", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218058, "uuid": "9424a552-170e-47f6-b96f-468868db715e", "comment": "Malware payload", "value": "24d9ef12ecee4a25418dfcfe9423e2314f4c696c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218058, "uuid": "f4efc298-a49d-4cf2-8de3-1a0d44b6e8d5", "comment": "Malware payload", "value": "339db07a8405224341381363e493f24499e6cfb110b23a79afab153621a6548f424265c7d2774098cfac15cd1702629d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218058, "uuid": "9586270b-08de-46e8-8dee-237c8758c7b6", "value": "648302CB74E9433E8F3517B658AE1E046271A43F4008CADC75DB3BB86B466B26573389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218058, "uuid": "b658cbc9-56e9-4546-85e4-1730a9c83692", "value": "1536:ulAfNtg2tf2vCapQ72ZTaNqeo6Vadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJv/:sijtt2v7aU9j7+XFWtYe14hbOj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218058, "uuid": "3e0c36bd-d4b0-46e2-8df6-b89e68b14418", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218058, "uuid": "ee75e1ad-cf3f-4f75-9c45-8356c5c8cca7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218058, "uuid": "73ffebb6-124a-4e76-9381-c5fe5453f754", "value": "catalog-1318441473.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0250af9e-a490-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222398, "uuid": "9360f594-548c-498a-a744-4b4b4b4c6928", "comment": "Malware payload", "value": "ba388ee0d7f04037598d436ea0d98a8f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222398, "uuid": "4f4c7be2-dd5b-43cf-9283-40915cbadd76", "comment": "Malware payload", "value": "28fa97eb39ff88a7f785a7b67ef43e13c230d84cbb68485f84db0410b245cded", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222398, "uuid": "93dace28-9311-4283-b47a-579e4f4f9f1b", "comment": "Malware payload", "value": "e9ce5236b8d99052ea21ce14cb98ba52b2e81bfa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222398, "uuid": "d7e4d2b6-7c21-412c-9510-f191d0c8523c", "comment": "Malware payload", "value": "5ace6d0a4207eca924a6d4a3a2edd7c1b864f4c8d88fba920dc014b498dea2e172f8d4dc9f4d1042a2d18cc777646621", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222398, "uuid": "2b2a6404-b35a-4186-9fd4-97e7b0e5f9d5", "value": "C0831216A9BD1CD9C0AB13F00D73094D4860EF7D411C8449F11AAA8F789EE85DEF7AE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222398, "uuid": "6d080837-8504-42ed-9810-986928749b5f", "value": "1536:VWt1QVGeGAg5dwSp6yMvBjqqxPGLuhCWdHsh1oSFWsfEFhHqLWb:VKAG7A8l3MvBjqq5OsZdHAO5hK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222398, "uuid": "6810b667-3b53-49d5-9d97-52af18076c56", "value": 86794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222398, "uuid": "bc54f87b-17a2-4a08-8187-00823f244a6e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222398, "uuid": "bef3a887-77f8-4d1a-b82a-b2c417bd4f9a", "value": "info-364442200.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a671fd-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219127, "uuid": "f4c179e1-d915-43e1-b030-6c6054be7278", "comment": "Malware payload", "value": "c044bb1ed614608fafcfe5bc4ef7ab38", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219127, "uuid": "b54ae5a0-55a3-49ae-a82d-c7c40653c440", "comment": "Malware payload", "value": "291c05b4ffb2d433c713e46dd171f58be266065eaf9b7c14b8144fe95bc90c60", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219127, "uuid": "7dc205b4-ccb1-40a4-a595-6507c21ed0d9", "comment": "Malware payload", "value": "96e94e93b151c3bb78434dc68dc272668c62f44b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219127, "uuid": "d858927a-9278-477a-98c8-b333f5f5f9f2", "comment": "Malware payload", "value": "9ff9aac441c34a68976cf13fee2594e9a8997eda4269ee30987afc9fe6dbf0a7651f10a74ee150347120770208900c55", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219127, "uuid": "e879e6f7-a12a-4e19-9874-2c385b3c0b54", "value": "1D83028BB4E8433ACB3523F658AE5E4426B1A47F040CC7DC75D73A786B53672A572388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219127, "uuid": "dec280c1-80b5-4ea7-abcd-8a4b6bc36956", "value": "1536:0EwAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvp:0HijtuPmU9j7+XFWtYe14hbOjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219127, "uuid": "1a1cdfa1-affb-4998-bfec-aacfd445795b", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219127, "uuid": "64363599-888d-4695-b953-812881edef71", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219127, "uuid": "18cd9c6b-8ec3-46a3-b2fd-73c9b1ba9c1a", "value": "catalog-1904322407.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8594f18-a44a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619192639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619192639, "uuid": "17c54eb0-952f-451a-8226-b6317129c1b1", "comment": "Malware payload (AgentTesla)", "value": "abf31f2e4d263bc2b931d261cd209f76", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619192639, "uuid": "21699b31-c24e-48c9-a791-e226c78037d6", "comment": "Malware payload (AgentTesla)", "value": "2927fbe785dad3b49f6b98b3547e06da44d10305ca09ad71117386338b3aa349", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619192639, "uuid": "3be5dcda-020d-4c2f-b836-7ec548fbc91c", "comment": "Malware payload (AgentTesla)", "value": "e4caee322987e5d4fdb8f5c6e287676c6918448c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619192639, "uuid": "b7ec0ffb-0fe3-4fbd-bbbd-ded44ddeb012", "comment": "Malware payload (AgentTesla)", "value": "7a944f44ece047d5337124a01d998cb9ac9f8fca78dc2946782fdae6b598dfa86d38466629ab67c14f6db7a317b70b44", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619192639, "uuid": "d4c5dcb2-2af2-4766-a9cb-ac00679686c0", "value": "7CE423E11D96D1D6B105ECF14AB799CAC33EE30251888CC6F7922B4F3BD8D1E5218D8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619192639, "uuid": "6e9f512b-d5bf-48bc-a4ab-af19ed57dfec", "value": "12288:MIRAX47Z9+NiYzCgUfvKW+j7HlSeU6u1Mlu+NDRWXrQGxciM:N+NigJUfiVjxaMl0xuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619192639, "uuid": "065e3127-9ec6-4b50-87c6-6406346f37b9", "value": 673376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619192639, "uuid": "49dcee7b-cf2d-4442-8c4c-4cfbd46766de", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619192639, "uuid": "ec82ec68-69bc-4221-8d3c-1896b0f9a1b3", "value": "z0ivtAYVHkXS7z0.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "108151f4-a437-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619184197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619184197, "uuid": "34dcdf00-8a99-4ecf-b162-4b4b6403e61c", "comment": "Malware payload", "value": "c8d11698be3e7d7afb081a8b854277ad", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619184197, "uuid": "d50db7f6-3bf9-4349-9ed4-d542b7bcb779", "comment": "Malware payload", "value": "293999682d1a0f595980f2b3b84a985b4322633fd5a4f6ae944e42fd010f27cd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619184197, "uuid": "bc4d2dd5-9b8d-4869-8eeb-d4b1431bea37", "comment": "Malware payload", "value": "20f35d56d2d9b0b5133370da6eb5d4d6ab5c35e2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619184197, "uuid": "5dd7bd0e-0132-4bc9-869a-cb52e943eb06", "comment": "Malware payload", "value": "5009425e9eb140ba698912bf126dcf0e386f820240611b1004a4754cfaa8df009ca41317a96d784014c8fdca03c01bad", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619184197, "uuid": "f3bb06f7-231f-4a03-9755-808d152b644b", "value": "EDF31263A29BC361F7EF660D93392EDBA16488528C0FC5421F128DD297AB2E6CCC1475", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619184197, "uuid": "4dc38b09-470e-4099-a550-a51eb3cdc12c", "value": "3072:ahoQrMp3qpXGVsF3WnJDb7VjoElMzh6VAIzMHm2:dTp3quU3WJDmj8AIz0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619184197, "uuid": "2f0bb4cb-6b33-42f3-aeb2-79fccf701d8a", "value": 159159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619184197, "uuid": "a3962315-a27e-4626-bc0f-0a0193dc913a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619184197, "uuid": "74f8a54c-376c-4902-b74d-085b49603dc6", "value": "_SWIFT_ACK MT103-90640HF5-6GV3-J-87F4-9BQ1110-9BA100.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a53ebe0-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219486, "uuid": "dbf89e12-e26b-41c2-b0fc-9f10dc95093d", "comment": "Malware payload", "value": "427056e46372455903463c09d4b37efe", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219486, "uuid": "e6ca2059-0793-45c9-8b9f-2d1e5aad78b6", "comment": "Malware payload", "value": "293c24dda0f2a345d0a7a79dae0488f42c24b1fd64eb3f1f08966bf554fd3def", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219486, "uuid": "882bb5df-9188-4022-9f2d-c76cb54d2519", "comment": "Malware payload", "value": "ec96673a04e4ac4088445c53fc693bfb8f3e0be2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219486, "uuid": "fb131960-08ea-4106-9cc4-f93cfb09f11f", "comment": "Malware payload", "value": "f19089d732130057be39ce382f16ba583e79bf1252967bf1700d0c014757f4fe1fdd4bcc8c18f3fd1dd0ba6966303026", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219486, "uuid": "daa98bea-a6c5-420c-a65b-1c5f4fc1de6d", "value": "DD8312EC70238A66637345A6DD7D90C32B6B8BBC441DB056A82B79364A307FFE111531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219486, "uuid": "a1677222-3b8b-4488-a564-c8f3a7c8a396", "value": "1536:EzKTWDE4Qgl8LS4v50FC+p7UjoB8+wXdpUna5ahL2dmTLUVVvGe:EeKDPKLRvaFjp7uXinakEmEV9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219486, "uuid": "1b6051ac-ae16-43a2-ad4d-619450b1dd04", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219486, "uuid": "416ff0d2-8a27-454a-adea-f286e6b03d66", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219486, "uuid": "7314e97e-612c-402b-807e-d5a1e11c7e64", "value": "catalog-2116769889.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b256239-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218574, "uuid": "514afd55-6f5b-4976-be66-88ff563453be", "comment": "Malware payload", "value": "9ed8929723432e7bd5afeab3f058e994", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218574, "uuid": "c7828c4f-ab84-40ae-a2ff-7a46a04a02c6", "comment": "Malware payload", "value": "2954d037695a081693fe5e7e13af6288d6d05023392344412b8f89dab7c6c7f0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218574, "uuid": "e0bf3b0f-7bdc-4d09-85f0-27786a12850e", "comment": "Malware payload", "value": "c39abbf49ffdaebbf45e59d2df70fef50cf15af8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218574, "uuid": "3137b8c3-5487-43cc-b215-6b32d3016110", "comment": "Malware payload", "value": "ba6fa3831bb8c1b5f8b176f514f2eb5ef1d437600410ad8580b0dea487e36cf979fc1a0a0e51882fee0055b965b5f1a8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218574, "uuid": "bcdb124a-330b-43d8-b623-f4d9fec02706", "value": "368302176BCB71328046EBB14B352A09A653BEEE640C6056DBEF4778FB3205568AC1D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218574, "uuid": "69a9c0dd-5bca-46d5-b983-b83fa7493ce9", "value": "1536:FRn2hxVTZQ72ZTYzqcIxxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZiZt5:FR2hxVB6IzJ9a03fjwe1moYpoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218574, "uuid": "a7619d15-83b9-476e-9281-bd2425ae297d", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218574, "uuid": "4be4e960-bf7e-4519-bda3-20284f12e4d5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218574, "uuid": "509cb81d-340a-4728-9bb0-ffc1ea96654f", "value": "catalog-1605206355.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddfd86c9-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219760, "uuid": "884408e5-0a19-45bc-b29c-e8fe67f432bd", "comment": "Malware payload", "value": "ee8d64e9051104c644fc8134497e646a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219760, "uuid": "4c728ebd-7860-43a1-8211-e35b1ccf02f1", "comment": "Malware payload", "value": "296a3251f530b2aec987ecaee0b4f6cb2781a6ff21bffaef63e93091d50aaa22", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219760, "uuid": "2ae3e3c6-de43-40aa-9e92-84cc6eae2382", "comment": "Malware payload", "value": "6093a409d6f24bcd0ac024b18d8af5d9775736d4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219760, "uuid": "a19860d4-b4f8-4ae9-8a9a-e6b5bc8b36d9", "comment": "Malware payload", "value": "243b590b32f38bade6a386478534bb16ffb471f406ee36d0ec315b2d2c86ceda164e302cdb9681fe85fae330f1312cc2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219760, "uuid": "76a08c4e-d23b-4213-8c7a-24fb3bc5e10a", "value": "9A8302E4CB5F0C98C1859D0E3B26FCA8B915710CB12862F6FA5D19A527538DCB2B2CF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219760, "uuid": "b8852513-9bef-4ff9-929d-aeaad9b4d456", "value": "1536:of1lwsMJDr0vqBuKXxP8JXvKDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnh:6cbkvaXxP8JXoM25NfuQjMCYNBwltD04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219760, "uuid": "6be1f2e1-a1f0-431f-9797-a8c19fa57303", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219760, "uuid": "5ddd0c4a-c00d-49f4-a750-f23a4b800eed", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219760, "uuid": "b182da01-b2c6-4e3d-a522-d5cb91e57e6d", "value": "catalog-325206941.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9004a032-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218341, "uuid": "0a4d0238-9f29-4213-8bd1-25b0827c7fd5", "comment": "Malware payload", "value": "2e49203beebf469a49be8aa4af19ca34", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218341, "uuid": "4a76c4ad-e157-497e-aab4-d2fe9061a39f", "comment": "Malware payload", "value": "29de01dfcf05454dd9d6e300b0ca9641e0694bfd612aecc8839aec99ac74e0c2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218341, "uuid": "d8eaa6d0-04d4-4bad-ad6f-07cc10ef6689", "comment": "Malware payload", "value": "8cfbe3589ea8398cf5daf2d200d1d9cedbbf18e7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218341, "uuid": "db1e0160-f6ee-4115-81a8-1e72bec59752", "comment": "Malware payload", "value": "f188e20ed763a70f05f31fe2982304c40cf48344ff7b063025c16d21810cba12229ba8a454032c99a310fa0437be6f96", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218341, "uuid": "95a38fb8-fc0b-40d8-9dec-a5345dfed428", "value": "CA8312F7CFAE458582027E1673255DBAA0583418611436EEDEDF16608BC25E4E8F3CBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218341, "uuid": "ea5677c7-7966-42c4-bc55-4b9dd43e10d1", "value": "1536:2302Gk7xSWWRpNdZ2rQD2FPdo1f+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnd:qn0BpwQKW25NfuQjMCYNBwltD0DCuADp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218341, "uuid": "a2880d13-2fea-4aa6-b3de-f6c382cb4517", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218341, "uuid": "f9fcd246-4cf8-45f0-9864-dd666a46f071", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218341, "uuid": "47ff0a91-30ce-4a17-91f6-e5bfd1ae1513", "value": "catalog-1450034454.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e2d77a-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220718, "uuid": "60e62d22-499b-4ce1-b32e-974df9475622", "comment": "Malware payload", "value": "c9fd386af928f2dba2862b846773a063", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220718, "uuid": "56579586-951b-4e27-a3a2-4628f45a2c63", "comment": "Malware payload", "value": "29f0e6b6f76d5bb21a348ff3165d478e9c4eedbc58b217d3a542f61e90b95a15", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220718, "uuid": "97bbf51d-9654-4097-b97b-fa36c905abce", "comment": "Malware payload", "value": "81a44ce4778908d10e2b76aca8c6c7e120a9382e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220718, "uuid": "b577175e-b711-449b-b694-732c7c72892b", "comment": "Malware payload", "value": "906ea853dcfd1955baf29ec7d66a9528d46bdf2280b643ab66d9e0f4c9e83f6f0557f706019f3fcb026cb1cae8c6d6c5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220718, "uuid": "cb14fe1c-0e78-4b1c-be27-305f95584bae", "value": "4383121A99BD1CD9C0AB13F00D73094D4860EFAD411C8459F10ABA8F789FE85DEB3AE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220718, "uuid": "caeedd98-60fc-44e2-92c8-85293bb59b7a", "value": "1536:st1QVGeGAg5dwSp6yMvBjqqxPGLuhCWdHsh1oSFWsfEFhHqLW/:sAG7A8l3MvBjqq5OsZdHAO5hKM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220718, "uuid": "dd134c05-11cb-4e7b-8095-31c429a89648", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220718, "uuid": "814a2d8c-aec6-4660-aa7c-d70f54e7d4a9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220718, "uuid": "240e374d-c577-4054-b92b-431f3fd980b5", "value": "info-1338819252.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c10d8f-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218381, "uuid": "e8c3ddad-8492-4a80-82b0-bf3221e4da50", "comment": "Malware payload", "value": "891088bd69bea905514e2c7a483054ab", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218381, "uuid": "974d0a1d-232b-4532-87a1-8e51f22d9bcc", "comment": "Malware payload", "value": "29ff12e07be560ee8ab0a50c0c5f0e3a871f12c088208c6ee404348dd61de977", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218381, "uuid": "05c77fec-7ec6-4d00-a806-07be780eb78c", "comment": "Malware payload", "value": "c851d07c647648d9ae50d9ae56e3b36f5f94be57", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218381, "uuid": "2f4846ef-4c6e-42db-85b6-0715899f1a15", "comment": "Malware payload", "value": "7ea87ffbce89f2471c9f37baee90826eb1f579b9b7373abdf892a0a00b16915882d5f9658feee6337e5a77f4ab9b27ac", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218381, "uuid": "f2557eb6-82f1-4835-acd5-b74cce9e39b1", "value": "498302EC70238A66637345E6DD7E90C33B6BCBBC441DB056A82A69364A307FFE121535", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218381, "uuid": "7444254d-4c6e-4260-bef0-b1d134c97f20", "value": "1536:rzKTWDE4Qgl8LS4v50FC+p7UjoB8+wXdpUna5ahL2dmTLUVVvl:reKDPKLRvaFjp7uXinakEmEVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218381, "uuid": "2395ae57-b4c6-4c14-818d-a64bd18889b6", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218381, "uuid": "e3bc8805-6a25-4f2f-999c-e126c16bd5f1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218381, "uuid": "bb148320-81d7-416b-a90f-1d64a4e47bc5", "value": "catalog-1467432203.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16a4132a-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218996, "uuid": "a62fca49-a5ff-480c-beaa-a830bb285afe", "comment": "Malware payload", "value": "ff88e3d03f07435a767fe14290596c9b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218996, "uuid": "647f727e-c81e-4064-9beb-1524153f714d", "comment": "Malware payload", "value": "2a416f3d7a7078a61815a46e51cfeb339ba636a1fb28f6fc95c56376bee4c400", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218996, "uuid": "9976bf4e-a34a-4b7a-bfc3-ca204935834d", "comment": "Malware payload", "value": "65928a354c55663f0ab47dc53aca52921145a398", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218996, "uuid": "49fb07d3-7140-4600-9eff-20381d3e4ced", "comment": "Malware payload", "value": "a641a36b3fc8a35d4bde32fe6b35393b0565298eda876afb8beaa1406f32d96532141f4b2770c7fe36baf0865cef5c4a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218996, "uuid": "44b0f623-0b2f-4c48-b6ab-0e8251cf1a58", "value": "5183028BB4D8433ACB3523F658AE5E4422B1A47F040CC6DC65D73A78AB53672A572388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218996, "uuid": "723c785b-f2fa-4da2-adf5-f78bc7de78cf", "value": "1536:6EwAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJv1:6HijtuPmU9j7+XFWtYe14hbOjd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218996, "uuid": "b14068e9-452a-40c9-80f7-e6868d002af9", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218996, "uuid": "5d7bb7be-56c3-40db-b875-48c966502cfd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218996, "uuid": "5b9aff59-e4fd-4a05-842f-1702e85bd78b", "value": "catalog-1830896425.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f4f2518-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218581, "uuid": "6d722c24-7859-4a9b-8b91-d0b6c322907c", "comment": "Malware payload", "value": "3565abd60e9d7a0e617b1470c8fbd26f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218581, "uuid": "afbd0473-ae3b-400d-963d-fa29ad4be748", "comment": "Malware payload", "value": "2a43775c3923fd67b8f67bc8a25a0984c718df5eba8020c28537961d0e073abd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218581, "uuid": "7f8dfbef-5559-4fa3-bf13-fbf17a94d149", "comment": "Malware payload", "value": "4a7c4c7f28db8d8daadd2e7aea2d9c39f6306819", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218581, "uuid": "df0b93b9-ad16-4e91-9ba6-667e1b03eab5", "comment": "Malware payload", "value": "6b25596aa8d22c65c9fd778fca36ff02d7a2a2d8bfca46e565f4e300b110aebffc27d93bdc33724f08b91fe47d8ea9c0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218581, "uuid": "a978f450-3711-4521-aab5-ce8204fb38e0", "value": "208312EC74238666637345F6DD7E90C32B6A8BFC841CB056A82BAA7659307FFE011531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218581, "uuid": "52598505-d044-4d31-8b13-b66bbebf5954", "value": "1536:5BzKTWDE4Qll8LS4v50FC+pTUjoB8+wXdpUna5ahL2dmTLUVVvZ:HeKDiKLRvaFjpTuXinakEmEVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218581, "uuid": "b37dcafd-5bea-43ad-878a-2fdf923d601c", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218581, "uuid": "f8f62a70-3822-4cd2-923d-19ad22bb51c8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218581, "uuid": "f5d6d54a-4635-4306-af44-fcac90e2c24c", "value": "catalog-1610671222.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee733536-a484-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217640, "uuid": "7d2d5a5c-2abb-4965-9f46-a36ed2f66838", "comment": "Malware payload", "value": "8907575e3e1331972b9729e8d0832b4b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217640, "uuid": "e803f440-09b0-45bb-8301-61ae8f3f6967", "comment": "Malware payload", "value": "2a5386cbbc59594ab5d6c3520cf75f175e438429c9d39b3ed4e3bb32aaff208b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217640, "uuid": "09451f0a-179e-4c53-88ed-9adc3ed15860", "comment": "Malware payload", "value": "e53751ca83935c55a4acd3e05a0b9a3e4393d8d8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217640, "uuid": "a1d9a224-944c-4170-a249-3c288e77eba8", "comment": "Malware payload", "value": "e64835dfb3c4b2fdf55563033981e5f6a79ea350bbbd191162316ee48b84b7a98d42bb4a6ae57f728a2f4a9deade5bcd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217640, "uuid": "4a9c5dc6-c7e9-4f0e-bd9f-7f2d32ccf3fb", "value": "0B831225A5DB9C5CE818F4000FAEB39B0A6DD32681664B067F70E0BB3D579BC6C47662", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217640, "uuid": "9886ccf2-9e9e-48f6-849c-df09b090dfca", "value": "1536:dFYPYOPAM8a4fhs/9UGdyWxaqQ6Rxt5AB/aqPwL3VbCbb:dFxaya27m/Qwt+awaxCbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217640, "uuid": "64749cd2-ec4f-48de-85a2-33ff1f790e71", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217640, "uuid": "eb2c90a6-addd-4bf9-a5ec-236972822be3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217640, "uuid": "4dc71e09-a365-4a8e-b825-a89662068017", "value": "catalog-1083331771.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a327e2-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221011, "uuid": "06065563-9d33-4bb4-b9b8-089cfc6c3572", "comment": "Malware payload", "value": "df623c5098242a65e5953ebb4e5b28c8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221011, "uuid": "ba72a23d-e275-4e7f-92c2-7f21c6abfe93", "comment": "Malware payload", "value": "2a90afb3c1a0a3f7651e9a9f9cbdb178d90a1222ced91ad5826d29f880c6aba3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221011, "uuid": "0c704259-e7d9-4d9c-921c-48829506f642", "comment": "Malware payload", "value": "fbbb7d82bfac7390a08b85ff0550a8d94a2233a0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221011, "uuid": "e7260406-7dba-4728-838e-72f5096d5170", "comment": "Malware payload", "value": "7c1c4dbb0ee3aef514ebcc2f09d7e9a06435c8816bb0b7adec69e27abe89395e53cd9bdf1c08079bcea4568f641d8948", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221011, "uuid": "4078ceef-2248-48ec-ae4e-dc674805fd38", "value": "A783024B599828FFA295AF10232CD99EA90FCEF4D9705514F20BEB5CD0B7B29726041B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221011, "uuid": "070e070f-e9e9-48f0-9aef-ce954743a200", "value": "1536:O6sEDF9MwsqZSCzfAkZ8kISNurvd197v7UZoctQ2kPo+4mpRlDi1nUSUqxuuM:O65R6wsqZXzfA21s19T7YptKRNpoUSU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221011, "uuid": "06222840-4776-47cd-a824-0c788732a63c", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221011, "uuid": "a7af0f62-268a-4199-af63-7e9759e9f0b3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221011, "uuid": "38d841a2-48b7-4e52-a86e-3a25fbf5e992", "value": "info-1431919791.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01922eae-a3f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619157113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157113, "uuid": "15dff2c8-5b93-468c-8da1-c6cd66f79a85", "comment": "Malware payload (AgentTesla)", "value": "f02a7b0ad63bfba0de55bc74a60e5fbd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157113, "uuid": "7c2edbc5-10dc-427c-8b70-10e0e23371a8", "comment": "Malware payload (AgentTesla)", "value": "2aa513edb21e3a57d9cb3f9d3a718c568aa2979be71d4afc951d77fa46d87d93", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157113, "uuid": "82eaa6aa-4239-4b5b-8f7c-adba27a7a73d", "comment": "Malware payload (AgentTesla)", "value": "350517555290af854e85695c05746e32b562bc90", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157113, "uuid": "bb2dc77a-e68c-47b4-bfc5-cbdf5c33fb95", "comment": "Malware payload (AgentTesla)", "value": "63754425b4f36c569129075dfb022cb322857fd986ec8823c311bc07992578e4eaec20f61c10443e706f8805762986e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157113, "uuid": "fec2c09d-46ff-4bf1-8b26-e05405649e4a", "value": "8F15D0823188DD9BD01729F2989FD56052B46D9F8165DB0E3F83BE2B54EB382205B74F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157113, "uuid": "fa91b923-7d0c-4ff7-8699-8d0bd189a759", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157113, "uuid": "7942a04b-0d7f-4c2c-b2c5-975d73ffd85b", "value": "12288:s732brA3Z+0+AQR1YmnPwauuSrSDiD+Crt9XV/dZ2VLMP0ZfCW8dZSiyyjKR:a3grAgrRGmPpuV+uD+CfF1KLlJCPrd8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619157113, "uuid": "2f5b7b25-b86f-4f1a-98d0-e3bb336c3edf", "value": 915456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619157113, "uuid": "88576f63-f2a6-4859-a1b7-bf112ff93770", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157113, "uuid": "fec6f499-8ea0-4466-95ea-64b2d98e232f", "value": "ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57d28542-a42d-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1619180021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619180021, "uuid": "263bbaa7-90f1-4af1-92b4-5cf5c089a369", "comment": "Malware payload (RaccoonStealer)", "value": "922c56e560ff92025f5b1aece20becd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619180021, "uuid": "a0d70d06-c078-494d-a726-7b88bb8dc590", "comment": "Malware payload (RaccoonStealer)", "value": "2ad9f7f159286d1b07d913e0172e5cdcb8694f2f69a71f49118f1b9011cb6366", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619180021, "uuid": "64bf2c47-660f-4140-9cf4-41a192788af7", "comment": "Malware payload (RaccoonStealer)", "value": "ad5c966be0750a6ae571c8324bf8e6ed2c3d990b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619180021, "uuid": "dfe70a22-949b-42d9-89a8-d89897c7b2ee", "comment": "Malware payload (RaccoonStealer)", "value": "775b889f982aae4972807707fe887a9ed3a9825fc385aaa14aff8bb367f0bcad7ce713597603411b46fe0a0b6963bcb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619180021, "uuid": "b9f6dcd7-ad7a-461a-ad56-bf14c2bd6920", "value": "ADC4F11132F0C072D0D324768526C7B05EBB78F215659ABFBBC81AB96F647D0B62631E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619180021, "uuid": "d1ee7252-dafd-4dbe-a3b3-8cdde8975c50", "value": "23f1e68344716b56a4d1f4cc32903797", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619180021, "uuid": "6070908a-898a-4820-b5eb-ea97efa82b2d", "value": "12288:6rgz73rqvKTptKUOd9FVy7pWVi+qFE42iEMEdh6uR1vmNULhXq:6MzzOvKOU2IpWVg+JiVETBjvmNULhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619180021, "uuid": "f43cd8c4-45a0-459b-a49f-cf015aa34f4b", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619180021, "uuid": "333ce693-5778-45b1-ae99-c15c67a842cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619180021, "uuid": "00eef600-8c66-4421-9367-06237739215b", "value": "922c56e560ff92025f5b1aece20becd0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "666f5a3c-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221707, "uuid": "da2ad4c5-99a5-4708-b94e-7e007c966e91", "comment": "Malware payload", "value": "680921aff8e456462d77019e0adef548", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221707, "uuid": "6265ea66-0f82-40d2-adb8-4f1064309c42", "comment": "Malware payload", "value": "2ae46fc605d8cc0d9f9d1a605f6ab127dd7f1fd4ada256b04daae9ad0823118f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221707, "uuid": "58e2b97f-84ec-4e44-8cf6-47b24f806b03", "comment": "Malware payload", "value": "33dd5ec8a9c1ca7d3d2a23a53c1aa96996f6eb66", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221707, "uuid": "cc3d73f7-911c-40e5-90f2-5157265ec24e", "comment": "Malware payload", "value": "f198d7992d7df0e4aecb656725655bc46fc655621fd009d372480929e3a6f97f0339c0d8b34c1c17c855dcbb7414a1da", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221707, "uuid": "95ffde1d-9175-41e8-a0b3-a74fc10a63c2", "value": "F183124D35EDC040E17F7D60A36AAD5901B86F4BEFFF9164CA6961329901863FA0368E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221707, "uuid": "830203b4-7d62-4dd2-af43-7c4c20eec00a", "value": "1536:7wJNfD6jITxi7UnLkb/Yw3LCq1GeOuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbE:7wzOEliUne/L3LCq4kO6xoKDShicdBMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221707, "uuid": "a556d6f7-1aab-4485-be0e-dd61047a870e", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221707, "uuid": "6b1b58ef-c730-45be-8fb6-5f22d0ddf156", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221707, "uuid": "016057a2-3042-4ae5-911a-c9620d61bab4", "value": "info-1831851029.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0dc71d8-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222261, "uuid": "a8c02a8a-01a5-47f5-a3b3-71fa1a0cdd28", "comment": "Malware payload", "value": "f5c8805da1f1d45efc45651c166fb4eb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222261, "uuid": "3ab9665c-e474-4e94-b35a-fb86a8dc44e4", "comment": "Malware payload", "value": "2b0bd804115e4ee64f7163a0985f538c814db450e90c2d4a1810bb09de40096a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222261, "uuid": "76cb019b-3f6f-4f39-a6b4-c204d01d2525", "comment": "Malware payload", "value": "f9a00be93e617eae9e0ce97a8446c1956ab6f973", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222261, "uuid": "dce26933-4e2b-44a9-ae88-b2d857b25ae3", "comment": "Malware payload", "value": "949b187e00c7167bff78be1769a66443c3fe5237052d64b8be45d8af64b3a2728d2ceee9b6076cc36cbf948e222bace7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222261, "uuid": "5660f454-63dd-4638-9508-a373622369c7", "value": "4783124D35EDC040E17F7D6053AAAD5902B86F4BEFFF9164CA6961329901863FA0368E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222261, "uuid": "6348f437-1843-4bf9-8bcb-d301bbbd63ed", "value": "1536:bwJNfD6jITxi7UnLkb/Yw3LCq1GeOuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbw:bwzOEliUne/L3LCq4kO6xoKDShicdBMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222261, "uuid": "21a58f3e-d2b3-4592-9946-fa1ee843309b", "value": 86793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222261, "uuid": "d8a86048-4425-4c20-bc65-d43c55202a2b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222261, "uuid": "5f2d457e-007d-4461-ba9b-afc3cce914c9", "value": "info-28985872.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bdcfa7e-a447-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1619191249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619191249, "uuid": "4913254a-81dc-494e-ae7f-d9367df3eb7e", "comment": "Malware payload (ArkeiStealer)", "value": "e90b82496fef072f16fdf92fef3477c3", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619191249, "uuid": "ba735813-2ab3-4035-a56f-8605c2d69da4", "comment": "Malware payload (ArkeiStealer)", "value": "2b34da8a8450f03c6401808a4699509737169c381cc2ce9b26ce8558f982fabe", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619191249, "uuid": "0717d9b7-0e74-45ae-ba15-5a9d69fbbcc0", "comment": "Malware payload (ArkeiStealer)", "value": "13752bfc7c35202d57c405703320d3a8e602d1b5", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619191249, "uuid": "579eb9f6-1254-4780-8030-f5ed0236b4ff", "comment": "Malware payload (ArkeiStealer)", "value": "45ee3fa3c6df6f1cdc511f8893a64414f9e45ee3f2ccb6a6e76f651bdaa93f3d05826f778f2ab91e3b64c8477ef39d74", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619191249, "uuid": "83152bd5-dc87-45b6-8fdc-6051b582f0b0", "value": "38D4E11232E1C232D0A214F5453ACBB04FBF747115615A4FBBE44EBD5F273A2AA253DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619191249, "uuid": "69449e1c-12e5-4e62-8d08-4dadd154b179", "value": "82e9466d9b3642d5e33c59c42fc4d4be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619191249, "uuid": "7467e21e-30d5-499c-83eb-dd1cadd37e2e", "value": "12288:qUXfRj1HUP7SgQluKJ8PNDlNPMJM8hSJ:qUf5xUPBQlQ9lEhS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619191249, "uuid": "d42e7eb1-f9d5-448f-af4d-af30dd3e8b2d", "value": 650752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619191249, "uuid": "4195de03-1f18-435a-bbad-77787d1e438e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619191249, "uuid": "55ea6615-ac45-42a2-95c5-348e738b11a8", "value": "e90b82496fef072f16fdf92fef3477c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fc7156a-a484-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217481, "uuid": "3893acb6-02cf-45cf-9f50-d4f309c46f79", "comment": "Malware payload", "value": "7228da4259206cf6513b1f15a8f875cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217481, "uuid": "2b46a46b-6c8a-4594-82c9-4c43ed1c8e5e", "comment": "Malware payload", "value": "2b36b229f43234326294c480d0219c42b6b8cde837fc57f53832416f9eadd708", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217481, "uuid": "e71be8f7-6cf2-4a97-b248-af66032953ec", "comment": "Malware payload", "value": "15cf6a1ac1bef3079cc59cce5bb7f2671c44b7ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217481, "uuid": "21389b2c-1f6a-4118-9ade-d13f94ba2036", "comment": "Malware payload", "value": "d0b81907db44988072e602017c688acf70c37e19b4c8ccdef3fc5c9d1246abe75836e36e0d34f8115801c33705fc7cb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217481, "uuid": "acf808f2-55a0-4eca-aa02-dc113a7ea205", "value": "B28302ED3A16C666E2B1931DCD3D88C533A29EB8A00EF0526C4F7F7A7D215AF9811534", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217481, "uuid": "41e220f8-1090-45e3-a8b9-844867ae9570", "value": "1536:DRn2h1Uf0IbwZQ72ZTYzqcIcUjoB8+wXdpUna5ahL2dmTLUVVvW:DR2hsbG6IcuXinakEmEV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217481, "uuid": "6a2fa5e0-a868-43b2-b6c2-0df06cb5ab21", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217481, "uuid": "28618c48-8db2-4592-b005-8d335db0273a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217481, "uuid": "aab42879-2e80-415f-ad2d-4eed18289056", "value": "catalog-103156243.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0554415-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218476, "uuid": "1b3beabc-ac70-4270-bcea-4181f9829386", "comment": "Malware payload", "value": "3ed70b5919d938ac592b3e92bf3832e4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218476, "uuid": "4d6dd509-e6d6-485b-b40d-29c5dd72eb8b", "comment": "Malware payload", "value": "2b56196cfb14a697726d8c5e8abe01ceb9798d6ddc919ce63d629aa575866e95", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218476, "uuid": "2034f139-87a3-4bb5-bc3f-af4a47225d35", "comment": "Malware payload", "value": "4baa68a6e2cffd66f61a04be7d8defaecb4290cc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218476, "uuid": "0c4c2180-dd92-4e37-8533-4199a0eb1102", "comment": "Malware payload", "value": "96f8f58550476b34b8fba07243e90cdd9a35b2106caec7236f4af73290cb067342cb21be2116a06fbe92f8f762372e1a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218476, "uuid": "c364a4ce-7895-4ee0-836b-f79253d4a4fb", "value": "38831221D787DDACD418E5001968FF980F2AE7666556440BFEB498BB366E82C14C2EF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218476, "uuid": "2e53ded8-ab52-454a-929f-005f022c2ceb", "value": "1536:qr6WB7yMfHVwvqBuKXxP8JXvKD3yWxaqQ6Rxt5AB/aqPwL3VbCbe:qcMdwvaXxP8JXoim/Qwt+awaxCbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218476, "uuid": "c846d88c-e5dd-497d-b469-359565897584", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218476, "uuid": "f57e66c4-15b9-4143-87f6-b86ec7c98263", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218476, "uuid": "a5ed8d31-a176-4144-8d30-b5793cf4b5ea", "value": "catalog-1523551402.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "946b656f-a441-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619188713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619188713, "uuid": "53d7bbe9-2aa9-43a8-8911-74513f7283ee", "comment": "Malware payload (AgentTesla)", "value": "7e615588a8f136d9e0ad12b9c94e1dc0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619188713, "uuid": "ccb976e6-77ec-4518-bde3-21bd23543c68", "comment": "Malware payload (AgentTesla)", "value": "2b596be066a85c5b338f606108824865ffb1c1d8400d488d45ba813da05ff02e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619188713, "uuid": "85b50f86-1eac-4e94-b1b4-8893ce6d98c3", "comment": "Malware payload (AgentTesla)", "value": "22c9c48398442d5c8d3851e7e9c5e4020946704a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619188713, "uuid": "995d0b7d-0121-4226-9db9-9b2d7125bbc9", "comment": "Malware payload (AgentTesla)", "value": "446fb7ea963a3d283d18a3776ee7e61c403f7228f174a4194f5b8451706b53b683b505d9c8709f9d3eeac5c681adc765", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619188713, "uuid": "9cdda493-af50-4b64-80ad-e5dcb598e75b", "value": "207489ACC08746D88F86ABB82B1B2F85114C7A6EF784A5337274977527E2C7B501787C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619188713, "uuid": "5a69f640-2d39-48d5-9cd9-f217e4671d74", "value": "6144:5AovCRtAZ8AWZsV3pl7M6pFwlNHqj2rwSu0h6je0UHNE6zoSLhoi1mpI1aEJuh4C:5q6Fb3cBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619188713, "uuid": "864f6494-d27a-4a9b-9203-a17c815f2ca9", "value": 362543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619188713, "uuid": "06286c9e-3637-4363-a8b4-a60fb603a02a", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619188713, "uuid": "3da82d11-f2dd-46e1-b458-13a8d1366c81", "value": "INVOICE.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e6b4ddd-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218741, "uuid": "ea061cab-1beb-4b30-b8b4-b4615caa4cc6", "comment": "Malware payload", "value": "a8366227150c650fc768f20ba87f4c43", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218741, "uuid": "5fbc605a-d6d0-4987-8010-07ca57856f7d", "comment": "Malware payload", "value": "2b7d49f56114a7d642b7e8b902922548009c3dd4abef23acbbc73d65db7b3c7c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218741, "uuid": "f71ba730-4ddd-4dc8-bc1d-e75923fcf115", "comment": "Malware payload", "value": "3bc64f86817b3c8fde96f8a2874b5c754ccc7b8f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218741, "uuid": "7051a7e6-92e2-4365-8d85-50505283cb6b", "comment": "Malware payload", "value": "2122ba755e5277f332f74d4c37681f3bf4d47f19668593d80b4cf0861af61cc493e8b57293727220c429c1f7584262f8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218741, "uuid": "2bc3ed98-663d-4fa4-9991-623af0d9ee96", "value": "23831235A5DB5C5CE818F4100FAEB39B0A6DD32681664A067F70E0BB3C579BC2C47663", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218741, "uuid": "3db30f77-fb97-413e-a15b-512c06d304ad", "value": "1536:RFYPYOPAM8a4fhs/9UGdyWxaqQ6Rxt5AB/aqPwL3VbCbD:RFxaya27m/Qwt+awaxCbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218741, "uuid": "a71a94e2-d0cf-4029-b567-9f06c9d8a5dd", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218741, "uuid": "29bcf791-da2c-480b-a353-fcfcd1e3dbba", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218741, "uuid": "a6753a4c-b34c-49e0-a91d-55516f5aedaf", "value": "catalog-1692991554.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d9a4544-a42b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619179038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619179038, "uuid": "3b6682da-9e34-4f56-8d85-215a09680be0", "comment": "Malware payload (AgentTesla)", "value": "937f4145afda312ea29113f4fdd3205c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619179038, "uuid": "08792f0e-3041-4960-b05f-4233570258eb", "comment": "Malware payload (AgentTesla)", "value": "2b93f169b080e670f10f56b770419101ab249afebe50a851c6b82e20bb44d695", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619179038, "uuid": "b5fc416c-6009-4de7-b67d-8e036f415003", "comment": "Malware payload (AgentTesla)", "value": "c352221154693447621000c506ff97e5db1da287", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619179038, "uuid": "ea222c0f-13b3-4990-a1db-8f69fe11f71e", "comment": "Malware payload (AgentTesla)", "value": "7cd5b877bd5f256bb89eb2d5e5fe7d49c92c6b84646192d73340e5dca0345ae32881ecbbe0f1db5bf086b65d4b7ebc1e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619179038, "uuid": "0c7edeb3-4644-43e8-b8b0-e3b7dc088612", "value": "7FD4232F01876596DC7595034E274821FD312E9CF3F50674AB28EFFB2FA416AAC8211E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619179038, "uuid": "73981af5-8c70-46c5-bee6-4192d1c555f9", "value": "12288:ulzNGykSKJCyevLSpf6Q0TaR5/unp6yEbqh+lUcmHNIlRWM1b:/SKJCyezkfpmaCAb3iHNIlAM1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619179038, "uuid": "b9134d63-a5be-421e-83e0-f95cf441c187", "value": 628711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619179038, "uuid": "1753dad8-5b9e-4653-be87-fcc256d08f65", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619179038, "uuid": "04e48c20-738f-4e0c-a127-6d72ca25badb", "value": "_SKM_C3350191107102300.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c353040-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221583, "uuid": "0ae7c4f3-e3d9-4967-9eea-d79cd1945ed1", "comment": "Malware payload", "value": "e6442d9b00d39864a295d2d1d4c0a239", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221583, "uuid": "3227b808-a052-402a-a3fa-13d78112a4f7", "comment": "Malware payload", "value": "2b968c1c3a11d3efb1b2b2c6c0c3aa9c90c32feb60afdd73764cc3eafe34fd21", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221583, "uuid": "09e93800-d90e-4fc0-9c0c-09efab0801f7", "comment": "Malware payload", "value": "07e62008ba740e8f540341b99aef274cc703e381", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221583, "uuid": "358b5de2-c59a-48dc-a75b-fc813d1dc3e3", "comment": "Malware payload", "value": "f465d5023c4853f40ecfcdb4fe4d7e19c3aea9a3868c60ac97b338cbb20b8cee765d4353993a6d4621e01a25f6b2657c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221583, "uuid": "ac7f1162-a5ee-4a92-a749-8b53bac71273", "value": "0883124D35EDC041E17F7D6093AAAD5901B86F4BEFFF9164CB6961329801863EA0368F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221583, "uuid": "89fc4f00-d48b-4488-92e5-a480bc61bf36", "value": "1536:4wJNfD6jITxi7UnLkb/Yw3LCq1GeOuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzb0:4wzOEliUne/L3LCq4kO6xoKDShicdBMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221583, "uuid": "bf76eee0-68a5-4685-b7fc-50f839689fe3", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221583, "uuid": "7a5be2d8-c688-40e0-a627-32261ff220b3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221583, "uuid": "793932d8-2419-4d57-928a-17710f4aa7b7", "value": "info-1762124054.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb01ccc4-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221071, "uuid": "515e8604-0bdf-4fc8-b0a8-de6f49acd4fe", "comment": "Malware payload", "value": "0a59a78e5da6c19f9cdda4210f1a0b22", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221071, "uuid": "818d7a43-a853-428c-b51d-ec552286a255", "comment": "Malware payload", "value": "2b987432d5c59221254c9b596a6975657ce6351d82c4a674185a256787788183", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221071, "uuid": "7aca42e3-d285-4d6d-9226-be48b91bf67a", "comment": "Malware payload", "value": "bb59b384e5e8129e9746461fda6b862be99eee23", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221071, "uuid": "17b90fe1-9e3f-449a-bc90-09c7a7df0701", "comment": "Malware payload", "value": "7ba82549a33c5c56786e249eada54a0ab48ea8ef91efd8d7bb1a88d2e4255f84ccbcf222349865607842de6bf5459324", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221071, "uuid": "063d0c78-4794-45cd-966c-8b5702d568f0", "value": "4C83121E78BDA3D561D2C60229357A914F94EBD38C86C00571B41A3AA4F0FB609A7E9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221071, "uuid": "1e04e0b8-7a74-4e07-8667-bac29c693313", "value": "1536:lfvNZdYvEm4HQWVy+sb/+M5Y2VXw1QFsrGq9ZMlmZQTQd+:lNUl+3Vy+KXw6Af5d+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221071, "uuid": "a26cee9b-51c5-4336-beb9-5beb3889aa84", "value": 86794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221071, "uuid": "eefe07b6-3335-4c42-bea7-8bc424735507", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221071, "uuid": "b469fbff-178d-4bf5-bdf9-9be50df69f38", "value": "info-147318367.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1efc807c-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221587, "uuid": "912a6c82-b43f-4abb-9baf-34283736f2e9", "comment": "Malware payload", "value": "44b4c95d0045a29dfdb718ba7d37088f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221587, "uuid": "d4bfd896-0507-4cde-aa27-4eef63dba4d3", "comment": "Malware payload", "value": "2bb15544994cc1865c3621ebb930e3adb8d110548e26e585cb92878331342b1c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221587, "uuid": "342a0df0-42c8-46a9-a71e-1af33fcfa2fa", "comment": "Malware payload", "value": "7d29afa1106e9f29937e9181b7aaed1dbcc813a9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221587, "uuid": "64e5e50d-4ea3-4762-abc5-445a2183642c", "comment": "Malware payload", "value": "b9925f2a01e3d667db2661167604756a2ff2e871ce71e4be0c0cea6bd21cdd14c3cc56b1d164d0fa0d37ef79b316be62", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221587, "uuid": "4eeae657-3792-47fc-8ca2-e47ffb36834c", "value": "4F83124D35EDC040E17F7D60536AAD5D01F86F4BEFFF9164CA6961329901863EA0368E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221587, "uuid": "1241e71a-c3f4-4379-8691-73c4b5f32d97", "value": "1536:twJNfD6jITxi7UnLkb/Yw3LCq1GeOuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzb/:twzOEliUne/L3LCq4kO6xoKDShicdBMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221587, "uuid": "5b2a0d3f-59f4-481f-a862-f7987f394be4", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221587, "uuid": "49c38bb1-1dd7-42d8-b236-168cf3dbe5b7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221587, "uuid": "caf9c99e-ce58-4569-955c-482f332c83df", "value": "info-1763996983.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9450455-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218383, "uuid": "f60e54f0-86d4-4ad0-94b2-71f2a8fad377", "comment": "Malware payload", "value": "653d2e6b26a275713ef92b209410c5cd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218383, "uuid": "8d1cfcbf-62bb-44bd-bc05-68a8291c8c78", "comment": "Malware payload", "value": "2bed287da18af0530159b13217f97cc3a312ec6b114901b4923f159a19939eb2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218383, "uuid": "796702cd-5c1a-4b9f-94b4-01eaba9552c0", "comment": "Malware payload", "value": "808bb4d5c1ee995b8a9efe9e64345b04186cde4d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218383, "uuid": "a3249ed9-fab1-436d-b1fb-0ff9749f9ac0", "comment": "Malware payload", "value": "6fd1b8a01ee5d7ab0586e81a366af6bd55376ab007d605f4f433857d27b6f7a91ea6561b74995ca9703d3c648a1eb689", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218383, "uuid": "15e89414-12f8-4e65-8a15-da19137d4c90", "value": "3B831217FBC626618066E9F25B393B1E6A837ADD785475A64FBC03C0F53614E1CE81C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218383, "uuid": "91e85986-2950-4194-afdc-44e54149ba9b", "value": "1536:Tqmy0pi0wcMlbCUN4gCQZiwotTCWxxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZy:fy0pgGUNEvtTCWzJ9a03fjwe1moYpoZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218383, "uuid": "98fa4766-89fe-4434-bbe4-2d1ae847f07d", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218383, "uuid": "35b70f70-63fa-4fb6-be6a-fd6f47d1b815", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218383, "uuid": "5145a8f8-c4f5-48f3-8dce-025854af1999", "value": "catalog-1472220997.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa77596-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222090, "uuid": "4945c96f-bd58-4a6f-912d-20b7f7a4e680", "comment": "Malware payload", "value": "6f23a308db04eb712ff20c926ada9c6b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222090, "uuid": "3a316c12-e390-4b81-8f87-9f3b848fe8d6", "comment": "Malware payload", "value": "2c105cdc3dba49b4ddc347a17e21d52460e14d15575f1d5639852d614266dfd9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222090, "uuid": "f772a790-b521-4513-8410-29536ca6f318", "comment": "Malware payload", "value": "87b018307140296df227b2ac374ff6ce714d65e4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222090, "uuid": "0185bf98-86fd-4bb0-a1f0-bd8634235fa4", "comment": "Malware payload", "value": "d6cc0e72d121b05c3f09d2919c7c57d191df48a2f5935b889e45277a18d64c91bf9ac667e41988b88cf69b6f78bf2a55", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222090, "uuid": "f7527801-42d4-45e9-852f-14c246a7f3e0", "value": "8583121B567E3C98C219A5E45EB31F2D2D600CA9905C80AD514B64FE21BCDE28E638E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222090, "uuid": "f35bdee5-8089-4c39-a989-e0b2a5aacb68", "value": "1536:BtaLgbCL+q1zmW7WPGLuhCWdHsh1oSFWsfEFhHqLWs:BZG+xW7qOsZdHAO5hK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222090, "uuid": "d1a7dee1-a4dd-4319-9dd2-234b49cde35c", "value": 86794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222090, "uuid": "96309d52-c9c2-4c2f-b135-e475528b8dbe", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222090, "uuid": "8865f85c-0d99-4938-9e05-65f3fc82197f", "value": "info-21123488.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a3d3f39-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219190, "uuid": "ca030ec3-947a-4826-ae2c-6f246e6c7cc5", "comment": "Malware payload", "value": "b0e29a54ef24108a164da9af67f88bc8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219190, "uuid": "952469b2-26c9-42eb-988f-28680d9a563b", "comment": "Malware payload", "value": "2c2bd1c126a33ee6d0ae81d24c3cfbe14a4fa52769357b515136ad20e369ee09", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219190, "uuid": "85a8a7a6-6c35-4557-a5ad-4bb9fc8cc6b1", "comment": "Malware payload", "value": "6f203848bcff64a49fd09aca9b6c1c290e5315f1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219190, "uuid": "6966fd89-b507-43f8-a08e-3bf698aa2671", "comment": "Malware payload", "value": "21906fdee331eb279930b41e84cc0746f12c1650d19e15ddf444ba48a1c04df0e280a1186f99cc8821b6191fcff4aab3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219190, "uuid": "6c3ddfca-a791-46ee-a726-e9b75d328da6", "value": "DD8312EC70238A66637341E6DD7E94D33B6BCBBC441DB056A82A69364A307FFE121531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219190, "uuid": "0055e65b-00f8-49a0-b4d1-ab5b0623da91", "value": "1536:WzKTWDE4Qgl8LS4v50FC+p7UjoB8+wXdpUna5ahL2dmTLUVVvG:WeKDPKLRvaFjp7uXinakEmEVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219190, "uuid": "42d23b76-07b1-4542-a249-c39d17dac0ee", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219190, "uuid": "d3822185-327e-46fc-a481-6f445ed52d39", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219190, "uuid": "bd3e265e-94b0-474b-9453-809c4eeeb274", "value": "catalog-1930544434.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88dc0a68-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220047, "uuid": "67ab296d-feb0-45c8-a00f-35ebb2d78b1c", "comment": "Malware payload", "value": "d5a9a5ee6d9f749d61c07429d00a3fc1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220047, "uuid": "d55155ec-4943-4d12-9ca8-91453f1d53cd", "comment": "Malware payload", "value": "2c2d3fe36f8a1dce3c16b352c56823870fe9cb16220941f081020b5bb25691b0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220047, "uuid": "92951be5-affc-4d11-a399-d52e4eae5618", "comment": "Malware payload", "value": "630a7b99325ba66e9806f1dd581923e9dea26992", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220047, "uuid": "a523a9bb-1e1a-43c4-bfff-a14670c3823e", "comment": "Malware payload", "value": "cfae9d49421410a2f676e1bcc7d99b60e72bdf793dc3b1eab9eb88e8a77fd9f7b9c874706a3613d8dbaf2a64a9bca0c8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220047, "uuid": "5013b134-b15e-4014-bc71-35c005f0c171", "value": "BC8312FC7E17D8E4A772968FC4FFB8D5179289E4E019A0A35C0A3E36D4106EBE512570", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220047, "uuid": "c7c5d6ba-40aa-45c1-a81d-4118dfd39c03", "value": "1536:OAS5f/KPDChIDbflm7UjoB8+wXdpUna5ahL2dmTLUVVvc:OASl+Dbw7uXinakEmEVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220047, "uuid": "92060297-3795-4337-a70a-7720579139db", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220047, "uuid": "58312d52-cc72-44a3-b3d0-8e1cbf3a9dbc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220047, "uuid": "bdded95e-a0bf-4658-aaf8-bf3b55b58682", "value": "catalog-491378560.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0114cff-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221428, "uuid": "3768fe09-8eff-4ee1-9fa3-baab586973f7", "comment": "Malware payload", "value": "4b23ce5c0125b7b84896ffb3558a511e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221428, "uuid": "8a7c1d44-0538-437e-94fa-073b5fde8a10", "comment": "Malware payload", "value": "2c35006890d3558cd49f467e631b9343eb9b6c8eab275439f86d263464c8b864", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221428, "uuid": "b7e65ab7-5741-4b28-b0b4-e699e8b8809a", "comment": "Malware payload", "value": "b6e036aaa1000fbaab2ae772e59e7e5d0e3aad2b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221428, "uuid": "ce73693c-6c78-4339-adec-d6357c647375", "comment": "Malware payload", "value": "d03d9edfcf850b2812e7d98bb33c6dc5388e00d4a56d09eb51dd17de5256959563bdd68ca92ab12b673ab16355992f23", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221428, "uuid": "2afb5024-7b13-461f-9a1e-68b9a0763ff3", "value": "1183121B667E3CD8C21DA5E45EB21F6D2D600CA9919C80ED514B64FE21BCDE24E638E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221428, "uuid": "8068a396-fb7a-4abb-b783-97b146d228a1", "value": "1536:staLgbCL+q1zmW7WPGLuhCWdHsh1oSFWsfEFhHqLWS:sZG+xW7qOsZdHAO5hKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221428, "uuid": "c9bd02f9-9773-439e-9861-42f02b70683e", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221428, "uuid": "0a8f542c-d5f7-495f-9557-c88e580a182f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221428, "uuid": "7b59427a-101a-4890-bb11-3f5b397bc45d", "value": "info-1679680690.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f66cdfc-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219440, "uuid": "2681232c-a7f5-48c1-bcd9-bff1dfe61f58", "comment": "Malware payload", "value": "2ea9c5102d179a5e911bd106d57a23ae", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219440, "uuid": "45044907-ab1b-48e4-a4fa-c662a9acc676", "comment": "Malware payload", "value": "2c36ee01c4169fce2a461abf449ba5c6a530b6d612542d87de4a3e81c9fb5994", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219440, "uuid": "fb47a487-14bf-4949-ac61-ed623314b679", "comment": "Malware payload", "value": "38c7672909fc233fca24ccbed8e36a025be78c6f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219440, "uuid": "cf1c5a8c-f67d-453a-9030-2747cdaefd0c", "comment": "Malware payload", "value": "51ec55c3a9d10773ba2b8873c5e0381724abbec30a75358b0c6a3128948477bd28d6c4b281e61d20994934bd6ab65fd7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219440, "uuid": "c4dd90d7-2d4e-47ce-84ef-d830f1ff047b", "value": "EA830268CB9F8D948005ED0ABB12F8ED75506248716973ABAFAD1124FF478D5B2338F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219440, "uuid": "17582de3-2435-4c5b-8675-f174382a1191", "value": "1536:1A6P7EGmwH1zVQLQDYflSJXvoDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnm:1AY31zVQnIJXaM25NfuQjMCYNBwltD0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219440, "uuid": "81cea18f-3fc7-4c44-b996-53126805ccfe", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219440, "uuid": "468ce251-3c45-4684-ade3-9961040096b5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219440, "uuid": "0637a307-4865-422c-8687-b8bbb19d4d57", "value": "catalog-2090743359.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9243978-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218464, "uuid": "910599f7-73a2-4a2c-b436-61f57ee4c1bd", "comment": "Malware payload", "value": "1dab59d4b353d0ed726960c3b07b9b53", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218464, "uuid": "718c0dce-77e3-4c2e-a9c5-f8fb20e2bc61", "comment": "Malware payload", "value": "2c3cb066b381460f85047bda214b37b1b216883ecebc606de83baeeddc532a57", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218464, "uuid": "ee42e5fc-7ad2-40a7-a966-05206261aaf9", "comment": "Malware payload", "value": "deda306c8111ede11bde81bea8a458b73f2b53e0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218464, "uuid": "71a1b650-7ec0-4216-a4df-e0a4af1aa4a1", "comment": "Malware payload", "value": "38b34bee33adb23ae4ebab3be5cdd0736a9fa8df836296c737a454f64784fd30caf41fd05f8122ffceba0598b5180e97", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218464, "uuid": "02e4a7ef-31ae-43f0-894d-9b9fc54f1a30", "value": "978312EBCFEA59984202BF07730A5DBAB454280C6118BAA97FDD11502F524E0F4B7DED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218464, "uuid": "16c8dda6-2e7d-428d-824e-2412a97603ca", "value": "1536:PKLWkP7EBmnbRARpNdZ2rQD2FPdo1f+5ff9fuQjMCYNst+IHClPLqkwD0DCuADr/:PKLWSFbkpwQKW25NfuQjMCYNBwltD0DE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218464, "uuid": "b46ead17-0695-49df-a07c-d8f760c356e9", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218464, "uuid": "453c987e-b7c9-4ae5-a706-e4e44307b50b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218464, "uuid": "f8eddfaa-d121-4ad1-8cc8-a87c69f3cab7", "value": "catalog-1514452630.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c43a8b-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218968, "uuid": "5b5efa8c-47d9-4698-a432-36cd9503263c", "comment": "Malware payload", "value": "c2a9b0518a9bc53696d2bb0d4731ab66", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218968, "uuid": "9885948f-9024-4cc1-8ef9-a9f6b8ce3cf5", "comment": "Malware payload", "value": "2c620f5d5a6a48a5621434da97f76d6d06ac37692fdcc600f7894d4cbe117635", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218968, "uuid": "a6f994d7-f422-4524-8c75-963068170044", "comment": "Malware payload", "value": "6fc142089cde9f79f2b033e0b9176741564f0810", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218968, "uuid": "7d432b94-0dea-4ebd-818f-1dd261520a91", "comment": "Malware payload", "value": "e2388ae94eeb2dc85a6e462695b6d4758c6b63a9f0d56307c92483ccfa38632fef7075ec4a196c0b4e9514a5a2b64296", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218968, "uuid": "47aa2975-cd4a-417c-92eb-c2e72a612267", "value": "0883028BB4D84339CB3523F658AE5E4422B1A47F040CC6DC75D73B786B53672A572388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218968, "uuid": "29e8d9f4-d532-403d-a44a-e708e1e7f3d8", "value": "1536:xEwAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvp:xHijtuPmU9j7+XFWtYe14hbOjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218968, "uuid": "00ec2ec9-f72c-477e-8607-645f5a47c165", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218968, "uuid": "bc6bd7e1-8139-4e0c-8fc0-94350e3827b4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218968, "uuid": "5145a872-1cc5-4620-a330-d5af615ea189", "value": "catalog-1816477513.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d204eb7-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220349, "uuid": "041f215d-4b3d-49c7-a5ee-fc347badb96a", "comment": "Malware payload", "value": "01dfcbaa07ad9249a0c73b154d6ceb3e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220349, "uuid": "9b233e5c-1da0-47c6-aeba-0bf59aba8fa6", "comment": "Malware payload", "value": "2c854807a2cb39df2ae7cb03a76dcdec03766db9a5c1d9a423bb9808d65d5010", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220349, "uuid": "47233ba2-229e-485b-bb64-2ad8521649bd", "comment": "Malware payload", "value": "28fe12f4d73b4f6cef2972b6ff80e570ad8d0814", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220349, "uuid": "6bfe41fe-45f2-46be-96af-a7f67eab6c0f", "comment": "Malware payload", "value": "98b37f178031b299af938552739c1f8267531e3e75b268fb2612e275b11352119c41164efc2ee78014eff825a05ba79b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220349, "uuid": "993ffa0e-b43c-4cee-a2b2-9485ae53ae18", "value": "7F8302F02CAE15BA838DA677A17D1543CC9C5FE116686F8B631112282EB1CDFC43B676", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220349, "uuid": "3712b31c-d7d4-40af-b6a9-0ce9ad1da2a9", "value": "1536:qr7l+KIkejUgUlrZcCWb/bLCDxxp/ERd9QnGlRTH7qrelcz:o7l+9UhlrZcnfLMZERQnGnTHMeg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220349, "uuid": "2c8ebcb7-5a4c-42b2-95ee-a759c528e580", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220349, "uuid": "85f26ded-a8ff-4ef5-9373-136b5abce74f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220349, "uuid": "196f1ad5-0783-414e-ad34-1526a5422757", "value": "info-1105574521.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbc63444-a41c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619172914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619172914, "uuid": "62d6afb6-e588-41d2-9d68-55001c8d14df", "comment": "Malware payload", "value": "e24a13def9b76e0fddba9f02dcdfd074", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619172914, "uuid": "53eebfa2-1e2b-4f73-8c5d-3adc3dc93b61", "comment": "Malware payload", "value": "2ca71e114a5388aa4d17bb0727bb668dca590b81a063670a44d2dab3adc05af0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619172914, "uuid": "906959e0-4983-4369-9350-094faa3e2a96", "comment": "Malware payload", "value": "79c2905b796a18f98d9cbac99acec014a9e1d924", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619172914, "uuid": "58bc20b9-05d0-466a-8be5-d78b8d12fcbf", "comment": "Malware payload", "value": "1bb28a7ab5ae9d067ff86619fae50be016f760e5894a9fe60e95a187a6efb2dc24f2d8a72ac86cc9bdd01b93cf10298c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619172914, "uuid": "ba4cfebe-ec1c-4f32-b1de-1d418ad9703c", "value": "F813F1756B435BF16B7382718A6C45E6FBCAA73C85FC0EA41687006DDC931C2DAF1852", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619172914, "uuid": "fe976e05-25bc-4abc-a91b-10da91e7ea66", "value": "768:1yMQWytDyaZLgR8IZJTuaW8KwjZTORY9wn2NAeapMLtq3U7K:1ygyt2ayjJtAa6eapMLhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619172914, "uuid": "9283241c-c628-4bd4-aebb-99261a36935c", "value": 42404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619172914, "uuid": "caf45f8e-f711-4dea-9a37-baa8a5fddae3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619172914, "uuid": "f1383c97-9bbf-48b7-9c4b-15542e9dd3f3", "value": "ARMV7L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f7e255b-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218367, "uuid": "8db8468f-fe81-4050-9eba-4a595f03711b", "comment": "Malware payload", "value": "6b57a02b6622464eceb16366aab9caeb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218367, "uuid": "c96c6686-7aa3-42e5-bcc2-9f150332b4fe", "comment": "Malware payload", "value": "2cc5d6969d7abb234d503be179c409a1bb46f3c4a62bdeade13f334f012cacfa", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218367, "uuid": "b9b42d5b-b4ba-4ef4-8dd8-109e2647fe8b", "comment": "Malware payload", "value": "4751b8fa857af39681548a81b21bb7fdf2d4983f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218367, "uuid": "ba7e56ab-5459-4adc-ac26-c9894fa9ecca", "comment": "Malware payload", "value": "1906b4c4dc538c5c35a6a4f473d0638c1ee263156310bfefdcf8308eba770f745074b9fdb8a5b12fa78e42a08fd10955", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218367, "uuid": "82444bb3-8f9f-477d-8a4b-dcd9e1d6b9d4", "value": "15831217FBC626618066E9F25B3A3B1E6A8379DD795472A64FBC03C0F53614E1CE81C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218367, "uuid": "02c747c2-32de-468c-93e0-b9787be1b5fc", "value": "1536:Nqmy0pi0wcMlbCUN4gCQZiwotTCWxxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZ8:By0pgGUNEvtTCWzJ9a03fjwe1moYpon", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218367, "uuid": "92be2161-78ee-4e32-87da-e11e7425648e", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218367, "uuid": "af9908d7-e972-4b0e-ae44-bcd4c11e483c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218367, "uuid": "42ff4c84-4fb9-4939-9318-ae7e4f158785", "value": "catalog-1460604339.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be1ea2dd-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218848, "uuid": "3ee877d3-d2ab-4e0d-af83-3fe8f5f433ac", "comment": "Malware payload", "value": "615bb9a2cca3a8ce7d9d361b59f0c652", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218848, "uuid": "1e34238d-ab57-4a16-93c5-595391bc151a", "comment": "Malware payload", "value": "2cc676dac8361f2526df98790955e218fad422967bbb320be04e6e22c79ad4c1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218848, "uuid": "b4866bae-5db8-480d-93c0-c24f7f8561c0", "comment": "Malware payload", "value": "856118d0c81c09da7efea2e36a795ede878cfaec", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218848, "uuid": "502b9513-5088-451f-a75d-fb8bdc1346e0", "comment": "Malware payload", "value": "78848731c88eb812ce41d4dd8db146662729bc98ba002225130a01b5415784b75fd45d69eb6b785b22d7c6831d9df4a5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218848, "uuid": "b704bdca-c79b-4c4a-894b-cb4a3100136d", "value": "D88302E8765AC742D370434DC6BDB58637A68FE8900DE043BC0B7B3F6C226BB5425565", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218848, "uuid": "9502b314-17fc-45bd-8a07-b1dc06d1cfda", "value": "1536:IFNCZ2i7uJeZQ72ZTYzqcIkUjoB8+wXdpUna5ahL2dmTLUVVvW:IFNCISue6IkuXinakEmEVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218848, "uuid": "e98060da-1caa-4b2b-b08b-f5f1159cb9ba", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218848, "uuid": "0224b299-2abe-4721-9309-fcf2e99dd349", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218848, "uuid": "402683b6-91a1-401f-b59a-897a86006aa6", "value": "catalog-1740845463.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e88c676-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218795, "uuid": "2174cfb3-4b5d-46a1-93e2-453e64b6b755", "comment": "Malware payload", "value": "830ca9039f1d220a9d24156c4481b3ce", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218795, "uuid": "b2603312-0db6-4466-bd70-25b890889236", "comment": "Malware payload", "value": "2cdda3ad5e330bb2b2456c04ef7ce41971bf62e1def739ee59bcf206cb81018e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218795, "uuid": "82da57b3-f244-4686-9168-e540b9566ecd", "comment": "Malware payload", "value": "9c4441b5ed2d5fb607a44dd5682e21a8b1ad9d5a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218795, "uuid": "400e6f2d-ffb9-4315-bd63-093cdd4d5083", "comment": "Malware payload", "value": "8656422fe3cbaff9cb29e82762e105c61b04701980482fcb9e14cde1c5b5c1632867baa25135bc8e6b639ae67c6b9cb9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218795, "uuid": "21b44e34-ebe7-4f47-b4f3-753f30261588", "value": "DD831277DE8BA18EC002723013782FEA4B2C6B72996115061670747B2B6F9794CC7BE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218795, "uuid": "bae8fa8e-4e5e-422e-bd35-188e11cad230", "value": "1536:+HuRWAXdZ2rQD2aCv0yWxaqQ6Rxt5AB/aqPwL3VbCbJ:mg2QKDm/Qwt+awaxCbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218795, "uuid": "a8a184e8-a2e8-4f50-9914-315f5824f42e", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218795, "uuid": "165b71cc-5470-4957-b93b-088215741983", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218795, "uuid": "1fcb79c1-c380-4a69-9370-3029f3c005b1", "value": "catalog-1714116926.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c47a7d8-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219006, "uuid": "346b60f0-e5a6-4c4d-975d-79e95766d66c", "comment": "Malware payload", "value": "edc0de959ef8f39bcb8b26fcf38be03f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219006, "uuid": "247a2f69-7e52-47c5-aee4-cfdcb6d38f55", "comment": "Malware payload", "value": "2cfcc68ef31adb481d50a64db8ed1caaa6adea3927390a3ec632fda30e0f7da6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219006, "uuid": "6599fcbf-f92c-462b-8ac2-935cf860fa4b", "comment": "Malware payload", "value": "88e3a1d8c6d52743fd684deb1f26c69c19d37c92", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219006, "uuid": "660bc567-b402-41af-bc5e-3bbcd098ba46", "comment": "Malware payload", "value": "69c6a4999241166be1365f8e2dcb08a850e70df11db14c7e1bac261e81fd10d78e26975b6df57df53da243ce323edacb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219006, "uuid": "6e6a9768-4bf0-40a0-ab45-bed228caf6e5", "value": "B283028BB4D8433ACB3523F658AE5E4426B1A47F040CC6DC75D73B786B53672A572388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219006, "uuid": "6c4a9e7f-4d22-4c6c-9797-6cc3489ab6b2", "value": "1536:rEwAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvq:rHijtuPmU9j7+XFWtYe14hbOjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219006, "uuid": "e14488ba-713f-49c4-8ac6-94ce2f12744f", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219006, "uuid": "88c02d4b-169e-460d-b38e-6e79868e8925", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219006, "uuid": "c0d7265b-0fdb-4f5c-aa30-377ca0a77a0f", "value": "catalog-1838397133.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ef68b8-a403-11eb-abe1-42010a9c0039", "comment": "Malware payload (LimeRAT)", "timestamp": 1619162241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619162241, "uuid": "7e1c6b13-2fe9-4f76-84a3-1f72d5b10c82", "comment": "Malware payload (LimeRAT)", "value": "3e41ff56c3bba0c45e9e263fa4d3e499", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lime-RAT", "colour": "#331175", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619162241, "uuid": "1e38c7dc-f2d0-4715-9bd1-0b0187c40ede", "comment": "Malware payload (LimeRAT)", "value": "2cfefca0970f7db586b646dbdf1b9fd57e386599e751666472c3c4cc78b221f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lime-RAT", "colour": "#331175", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619162241, "uuid": "5bc3ee10-af12-4461-925b-25319c633565", "comment": "Malware payload (LimeRAT)", "value": "addbe7eff3daabef2babe49bda929f0bcd4d24a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lime-RAT", "colour": "#331175", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619162241, "uuid": "29d6c19f-304b-44ea-9e1b-7f5f2943e4ee", "comment": "Malware payload (LimeRAT)", "value": "333d03ac1533afa7d5f23e279d1a48008c1898f86474fc1dcec7c82fb49bb7fb39523edf97081d6fd07632c533c6b6ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lime-RAT", "colour": "#331175", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619162241, "uuid": "1e394094-9931-4b68-982d-19a12dee41d4", "value": "B2D26D0477E19355D3AC59B20F7262250BB1DB1BAD3BFF2D0CC554931E9BAC18B84AE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619162241, "uuid": "4fccc054-f375-4b73-8aad-ffb91dc5c381", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619162241, "uuid": "851173eb-16d2-4ae1-95f3-236eeac66d82", "value": "384:yB+Sbj6NKGnD6N9AHNkAWqDdJ7F03vDKNrCeJE3WNgRnBZEmhdbJ5DINQro3lcZh:opGD6N9wN/xF0f45NCBZZZKej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619162241, "uuid": "981064c0-ed2c-4d92-8a6a-9f5a17261c0b", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619162241, "uuid": "eb2d412e-b121-4195-874d-3087a07c6d27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619162241, "uuid": "07ef4c57-0650-4476-b433-65efbe5ab663", "value": "wRLu7Fk9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cbd9814-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218980, "uuid": "b2d84686-be64-436e-a749-3229b2725371", "comment": "Malware payload", "value": "97f2844a6ea98c134c41df0f2997c2a7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218980, "uuid": "c9c4ddc0-f40f-490f-ab50-6d0b72a05810", "comment": "Malware payload", "value": "2d2b81f1751d339489a906dfb484de102e4a7a11022edf7abd6155c9d92d7f64", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218980, "uuid": "12fd55fe-1a9b-44ac-b0ed-b4546df76de9", "comment": "Malware payload", "value": "9f1c4dd78dbbef8f8334d15f724438a7be559ce8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218980, "uuid": "6601a4f1-f257-40c0-a22e-d88dd1be1f56", "comment": "Malware payload", "value": "7e88e3f14b316c3eda8fd276c815f1686efde0a9c0059ae63eed2e96179027bd7b79801c0a314e0d21a6e969bc463fc4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218980, "uuid": "da6d5a5d-ef63-4408-89d2-851a4a5da810", "value": "628312F347D9689D7067BC2886687F8F58E95B23AF040C4F8AFE0B6B11974AD3650390", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218980, "uuid": "fa843026-31e5-4f88-9678-6aa503ddc028", "value": "1536:/A2fnBKj0MlbCIZi+nTnfZA6l3SNZzTJAsB0Ic6DMADMt5zC/IDIz10b:LBIZiifrCNBJAIlcAGIz1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218980, "uuid": "a271e73f-1984-4ca4-a90b-d9ce895bc8f5", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218980, "uuid": "e48bdaaf-37c1-415f-9cf5-382f149028a0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218980, "uuid": "f9c79e99-f386-4e48-a415-c8eac9403183", "value": "catalog-1821898475.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3343ab1-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219715, "uuid": "790a4653-b83d-4c9a-a9d9-90a3f8cf0a31", "comment": "Malware payload", "value": "1d8b42c45fd588e7f666090dc30e25db", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219715, "uuid": "33e46eef-2fc0-4ec5-8f41-9348d5d9237b", "comment": "Malware payload", "value": "2d38d481af536d195ffbb798ad111fed285412f4eeb7b0d9ecdd1de26a055656", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219715, "uuid": "446e2e59-f100-496e-948e-6148ff31c07d", "comment": "Malware payload", "value": "9e39b89d4230f3d4b367404f02e9468b723ccdbe", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219715, "uuid": "3da05930-686c-423c-b9b5-2fb8410417be", "comment": "Malware payload", "value": "bee31fbd4a3982b61b0045b4aea15f7db98163593ce14942599a98906d2f0a38c1ebda6cbda9f3d35ee9702bdbdbb6a8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219715, "uuid": "07e9df1a-8e13-4944-93a3-ac70058d0935", "value": "778302CBB4E5433ACB3913F658AE5E4422B1A47F140CC6DC79973B786B53672A472388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219715, "uuid": "8dd96073-a09b-4fc0-8292-3412557ee28f", "value": "1536:zAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvD:zijtuPmU9j7+XFWtYe14hbOjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219715, "uuid": "6b65820d-0abe-4d51-b272-1542ace8a463", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219715, "uuid": "5eb1ba10-1179-425d-b883-605a1c9875fa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219715, "uuid": "2b7c3f0b-749c-4c7a-a816-80ec341f011f", "value": "catalog-294190532.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d987bab-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221585, "uuid": "e15cc6de-cadb-46dd-a94f-d887019fa970", "comment": "Malware payload", "value": "a6225ba7d53ca93f862737d4b6eb9cfe", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221585, "uuid": "2498dc5a-231d-40ba-a66c-bc90866b014d", "comment": "Malware payload", "value": "2d5be9d53fae1a3f9ad384c224be8f60b4321f03994b5cec10ab5ffdbf438be8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221585, "uuid": "5b6775a3-6a7e-4361-b4ea-ded2d08f0548", "comment": "Malware payload", "value": "41add95da7e507fc068eb2b9bb049710b80f8058", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221585, "uuid": "fa7f9d21-f982-4788-af8e-513ee142a3b1", "comment": "Malware payload", "value": "79e303cbaa8a146aadb7341895e5317c724ffeea7cdbefefe16282f70b35afa0e3fe3945fa11f3b729babb18ff71ffde", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221585, "uuid": "1f18bf26-fcc3-449d-915c-795a73ed7677", "value": "3B83027F6D2F38ECC215D1A99E3717691B305EA5856C806C12DB389E21ADCC24DB38E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221585, "uuid": "91b8daa5-1b0e-4cfd-b2ca-28bda10de2b9", "value": "1536:w4NZdYvANUL+q1zmW7iPGLuhCWdHsh1oSFWsfEFhHqLWM:wOUJ+xW7WOsZdHAO5hKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221585, "uuid": "0554324a-33d6-4d13-a798-101edfdbf65b", "value": 86795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221585, "uuid": "0b658003-fb7a-4ed3-822a-ca05d4e54b94", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221585, "uuid": "4b5fbdd2-2235-44fc-a59e-2f4b75bb4b81", "value": "info-176231848.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbdefffe-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221018, "uuid": "e3083806-5700-42c5-be1b-a6d8816595c1", "comment": "Malware payload", "value": "96ef1c2dc0c8dae69d9043ae233bc46b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221018, "uuid": "5f685651-37fb-4ce1-8f3f-1cc0166e0516", "comment": "Malware payload", "value": "2d66a7c4ed55076f5d451523a2a8cafd9f712bf8d68fb2083371c1c7ed63c58d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221018, "uuid": "9c06c629-35a3-4d63-a5a9-2b011b3863f5", "comment": "Malware payload", "value": "af1743a7e47b54976ecf9b180ec326052bff9ced", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221018, "uuid": "c2f93b20-2d68-4165-8b87-aac5c83d4d1b", "comment": "Malware payload", "value": "1fb5c5671f2715cbab811b76bf436ed8e454366dc6cf23120c7e14d171d501f3c7f5f8043cb7d69267f94aee67b453ee", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221018, "uuid": "3883922a-910c-4769-9c20-15ebd9600138", "value": "208302B7322D0BFF900AB89B809FF5F9F156A93E5D1EE510B3642D20353153EA411AAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221018, "uuid": "4fcc72db-8866-44d4-9da6-fb8b1cc7c163", "value": "1536:oQBAV8QI/AATZvjL3+xnxv5ZUSzhhcBrasoi8vQMwdjV46CTA:g8QI4AZP3+9xv/UGDmrajvIM6CTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221018, "uuid": "4181d4ce-8d61-4a51-9d81-f529683d689c", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221018, "uuid": "b25727e7-5300-4e84-819a-1cfea01558de", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221018, "uuid": "e6c01d22-2cb4-4ec8-ab55-e14736fcf069", "value": "info-1439629251.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593a3d23-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219537, "uuid": "097b933e-22e7-4a85-8f12-b41f433f3001", "comment": "Malware payload", "value": "947cef6b5425f02a83e30cf208603be7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219537, "uuid": "6e48b8d5-b41d-4f7b-b62e-c5a8a4f1d764", "comment": "Malware payload", "value": "2d6c86c120269c27d7f5bc00220b0b8d57b5a4b2ff6342553e94d8281bc7323a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219537, "uuid": "50e0fd19-7f2b-4aee-8fea-59b550b3b5e3", "comment": "Malware payload", "value": "76a4679bcfd7958917ee0bf84baa02d9e17e183a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219537, "uuid": "37a30bc5-8a2b-45d5-ba76-23e243a4ee9d", "comment": "Malware payload", "value": "96f6989a3f52bea17ebdc123615a5a84c8fd9b112148e9c5bba9f5b06bb8beeedeb809c9a9876fb4a93aac9d0ef3a2f6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219537, "uuid": "b6363213-9ce2-4f0f-9ff1-937be9e7b300", "value": "228312599B1B7DA7501F3CF31B322A5ABA03BABE0C1C7096C778C2D0E33961E25642D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219537, "uuid": "84b4c5f4-d340-4fd3-a575-eb73cde85680", "value": "1536:EEf1lwtMJDrsPSpV8LS4v5YFGrfZg6kxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGA:dcQ8PjLRv2FKeJ9a03fjwe1moYpoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219537, "uuid": "58bba958-bfd7-4890-99d1-28dc06b69267", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219537, "uuid": "6c0448e4-2d9a-4bf4-9f6b-67d17afea4c9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219537, "uuid": "356ff988-532d-4093-83e1-2b4f82c63651", "value": "catalog-2134565139.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f98fe1a8-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218518, "uuid": "7e18ea93-0954-4f8c-858f-4abefcdd92ac", "comment": "Malware payload", "value": "8a3d3e140582f078efc3e74242366a32", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218518, "uuid": "aca16fc3-40ba-4ae3-90f6-19e2740e5b8e", "comment": "Malware payload", "value": "2d8c5283dc87e6b61675b5ae29ea3f6bc0cebe9014228a461c37797b168a1ac5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218518, "uuid": "9051fc3f-69e3-4a5a-a989-a3ecdda141f9", "comment": "Malware payload", "value": "d2fb479354d987577d5c56e13fe3dc7de40cc03c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218518, "uuid": "00d0e94d-ace4-4379-9715-68c29059dfda", "comment": "Malware payload", "value": "276c54178485a02ca119a3629f7bb2cd43322badda8fe3f3ed04ec4939abe20682b4672f10145f3fe666bfe3122bd954", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218518, "uuid": "242299e6-6ffa-4245-ae63-f57b2f4f76ea", "value": "748312599B1B7DA7501F3CF31B322A5AB603BABE0C1C7096DB78C2D0E33961E25642D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218518, "uuid": "249b90d0-c20b-4bee-bcbb-7988302270e6", "value": "1536:o0f1lwtMJDrsPSpV8LS4v5YFGrfZg6kxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGn:xcQ8PjLRv2FKeJ9a03fjwe1moYpoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218518, "uuid": "4d8add6d-f855-4991-9010-5aaf1e26c45f", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218518, "uuid": "27ea0290-307f-481e-9691-30e2681e60ac", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218518, "uuid": "b4c36c3d-ab78-4489-b7a1-07ad32037e64", "value": "catalog-1564379523.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f2903f-a3f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619156372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619156372, "uuid": "be413a1d-72bc-4c4f-95eb-408b411f40f7", "comment": "Malware payload", "value": "c8c88378182d1364ce084ec0feb10d84", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619156372, "uuid": "f1cb5e14-a7dd-49af-b16d-717c5a9a543d", "comment": "Malware payload", "value": "2d95345632d0d562e00c0fdac342b391ee36a164694e18588e5183611fc4c40b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619156372, "uuid": "50f03b90-e751-4d21-b428-0b7a52d20048", "comment": "Malware payload", "value": "1e850abf87a12c702452c69c424a43771ba711bf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619156372, "uuid": "0f6d1e61-7671-4197-979a-e5f11fbb29db", "comment": "Malware payload", "value": "dc49e0db377544eb8a3454f79c71cd527261a92b12cc98950feb91c2bcad020fe168280bab294b37f49ec2201c2b2fbd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619156372, "uuid": "49159043-4114-4606-9b54-dd5238b07402", "value": "2F34137CC4764A08C1E614738C18841998EB326A7EF886FD6A89B4E4D7426F70F6FF50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619156372, "uuid": "3b4dcb4d-4ebc-4084-bacb-3ab7c141b516", "value": "3072:rQBXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGHRGawwycTUy2p8:sNE5SDvbXAyHbVt15wTQD+LTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619156372, "uuid": "593a6dbe-0478-427a-9ae9-91c4121c6a5e", "value": 240279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619156372, "uuid": "af28bffc-c32f-452b-89a3-4ea47c8df1ac", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619156372, "uuid": "bc432a4c-7633-4cb5-bd47-43f315fa4b49", "value": "5.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e14bac2-a3f5-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1619156034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619156034, "uuid": "bb6f330c-4500-4f56-96da-6cf9c1059f96", "comment": "Malware payload (SnakeKeylogger)", "value": "1ac7e7e0c48420754fa06e5c4ef08cca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619156034, "uuid": "7a3fcc02-6001-4fea-9063-61bc81d4b63f", "comment": "Malware payload (SnakeKeylogger)", "value": "2db419eb61fa6ac898ced79a8d7e1b08adfff587fd1a3a5606942c44b0ae401f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619156034, "uuid": "c4b9da41-9f1a-4d6a-9d38-93dfbee8026e", "comment": "Malware payload (SnakeKeylogger)", "value": "1d54ef0c12c2590d81e3908197331133d81113c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619156034, "uuid": "942f17a3-5603-4f29-b1b9-0dc62f1c3c29", "comment": "Malware payload (SnakeKeylogger)", "value": "2560165f50b0d000218d57d707e376ea7aa407f4170772fb6f0e0666ca5e003dfb3590098e0f399b7237d4659ae346a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619156034, "uuid": "f50216dd-c278-41bc-9e59-be13a37588e8", "value": "92058C9C7650B6DFC857CE738AA42C60EB50B4BB470BD303A09316AD994E69BCF151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619156034, "uuid": "73b7baef-bfcd-4dcd-aff7-622639dfbe07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619156034, "uuid": "74cc64f3-17b3-47d4-a908-9e0437a71d5d", "value": "12288:2RRfEm1ywefX+KLuduFFixJ/CXgFMHPY8IOZ/Yoi3roZMTTGx6aeSoVx2L3cJvZi:6fjywRKzixJ/C2kZ/hXSaemT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619156034, "uuid": "99e90b41-c9c6-4154-b1c3-2631ca97c13f", "value": 850432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619156034, "uuid": "a617968c-c68f-4af4-a3fe-8c2ed3e45c05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619156034, "uuid": "d3b2f90e-71bf-482d-9777-43e2a225d05f", "value": "SWIFT COPY OF PAYMENT TRANSFER.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f5b980-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219049, "uuid": "ce36821e-36e1-44b4-86a5-a33abeab428d", "comment": "Malware payload", "value": "b13a212b3cde6fd8dff9c1547657a8b7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219049, "uuid": "a7dc0edf-2c8f-4c83-af5a-10d66f8ade1b", "comment": "Malware payload", "value": "2de80527541a93734645851c3c67707c9e112a382ba2b26e00892c764bf0f71c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219049, "uuid": "d275fc25-5f4f-4506-be55-724fa61d684e", "comment": "Malware payload", "value": "1567d6220a3844517329b312b3d6989babcdb5d7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219049, "uuid": "7c67cb8a-30db-4c0b-8ef9-c983a53cc25e", "comment": "Malware payload", "value": "dcb4be2b8c48a9cd8cef035624824541d95d71e86c5862819ef4f7779a2bbc9ec49978890b5b12503282db4f7aea9435", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219049, "uuid": "2d529be8-281e-4851-b18f-40e534dbe3f2", "value": "C0830287F8EC874D593E15F3889A1ED58784913B14105BFD9EFB2A38F64982261A33C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219049, "uuid": "743c3789-32c5-4fcf-9e3f-6d053130dc47", "value": "1536:XL19yMfHf9Yq8DbflMoSVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvu:XL2M39+gU9j7+XFWtYe14hbOj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219049, "uuid": "25989272-8aeb-41d4-9938-2ea8030c8308", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219049, "uuid": "e8d02ac5-a2ce-4ee8-960f-935b9d447a8b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219049, "uuid": "9b92a865-c498-48aa-b56e-4e2569964242", "value": "catalog-1858789858.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6fa4f2a-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218084, "uuid": "79c8bab4-7c35-4bab-9f06-be127e67a064", "comment": "Malware payload", "value": "1b08014fe4944d6abaa93335a08497e2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218084, "uuid": "e7a05648-65af-48c0-9d4b-38ffbd5f271f", "comment": "Malware payload", "value": "2e29e8e3652fb89c0e7a5dac67f417242f221b9b457576574a47042bfb1a099e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218084, "uuid": "dd80db89-b45f-4379-8a82-0dc9335dd228", "comment": "Malware payload", "value": "e1fb2a94059676e6d976a744ea21c87463056d58", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218084, "uuid": "b1a0dd95-e237-4a33-af7f-0008754c3c24", "comment": "Malware payload", "value": "65986d7814a7a98fb5077032916419579fd9f5ffc3154adf4df4f4d818e46bcee4fa16e638b3aa9c8063d7d7930bde9a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218084, "uuid": "0dc82786-46a2-43fe-9ddd-34c9f7773049", "value": "DB831232EA9F5484D404E2625AF27BE51F34CBF28136450B5FB4743EAD1759F0489ED2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218084, "uuid": "ca072106-24ed-4fa7-8298-720164ccfe65", "value": "1536:n2Lsy0pi0wOQYUtcDYflF4yWxaqQ6Rxt5AB/adPwL3VbCba:Ny0pgOQYqtm/Qwt+aZaxCba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218084, "uuid": "41292f40-141b-4b2e-8a6a-fdc76227a6dc", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218084, "uuid": "dbd781f4-8f61-460b-89b6-a8fce2adcfe7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218084, "uuid": "e92fe379-2355-4096-be83-e10becdaee4e", "value": "catalog-1325416959.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "126f614b-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221996, "uuid": "e6686a72-9920-4b03-81c9-76c465c27442", "comment": "Malware payload", "value": "0741e6895506a9705071e8396cfd9f33", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221996, "uuid": "0cf58ceb-8397-40ca-8284-33d9a8ad67d2", "comment": "Malware payload", "value": "2e31c05794257f1a82b8c5c3cc50b1bf4ce7496413ccfc954c335718a45aa81d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221996, "uuid": "506458ea-7271-4770-9364-7eefce7833b1", "comment": "Malware payload", "value": "a76a126afd7fe8016c4123471eeef47705968a7d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221996, "uuid": "70982573-7910-41ae-95fa-8cb44d5fca62", "comment": "Malware payload", "value": "5e6003cb3d8dd23473ac6cee91ecbacd000103812cf6310ac4b74575edebbb761b8e306518abb3c7f06147809aa0b649", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221996, "uuid": "4682fcce-0732-4b76-b416-b576232a9d19", "value": "7F83121798BF24ECD07A7BE01D72584D58B0EF68801C8588B269768F72DC9E64F9BDC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221996, "uuid": "84bb1006-d407-40ae-b008-b6adb688727b", "value": "1536:9jHZbN5m6RtwWdwSp6yMvBjqq1PGLuhCWdHsh1oSFWsfEFhHqLWf:9rBm6XwWl3MvBjqqdOsZdHAO5hKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221996, "uuid": "28f8d267-469a-4be3-9611-fb6f1292ef96", "value": 86799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221996, "uuid": "77426322-4bc6-48a9-853f-a38c9679bfc6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221996, "uuid": "eb71fa33-f497-4c12-9855-4241cda18161", "value": "info-2052203114.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f3503e3-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217937, "uuid": "2537501f-1a5b-43f2-a80c-40f974605af6", "comment": "Malware payload", "value": "69e1c1c0ab163436b93479bfd296bf92", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217937, "uuid": "315062e7-3f1f-4f8b-8905-9b7c9f5dad50", "comment": "Malware payload", "value": "2e4034e615c8ecde9cc8c21470b486f7b02ca0eac8e5d58b2e93140714e0014a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217937, "uuid": "c1bb0aaf-ec74-4988-970e-512674eaeb49", "comment": "Malware payload", "value": "6b5dbe8ccbcf49885bdf4a89ac5923c021db66ec", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217937, "uuid": "40675f6c-d45d-4230-b18b-5c7c9b92d5d9", "comment": "Malware payload", "value": "96f1ba5b24794dd68488d9bf8ff24730dee9ed18d698f74098aff7ed73be16e479ee3cc3285323e607c0b837473104ed", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217937, "uuid": "34d1cd01-5985-4081-9f44-87607a1b4a2a", "value": "2A831297AA726CCD30573C31023107DE7AAE5BA71D28080FD2B466AB17AE65E77C07D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217937, "uuid": "5ee15920-8471-471c-9947-08421fc00406", "value": "1536:7pAnSCrzJKKMc+4ng8LS4v5YFGrfZg6l3SNZzTJAsB0Ic6DMADMt5zC/IDIz10y:6bIcdLRv2FKLCNBJAIlcAGIz1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217937, "uuid": "58ad617c-99bd-4017-a00b-ae409588df81", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217937, "uuid": "a4e42d70-e1f6-4fea-be16-3a7d7d5156bc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217937, "uuid": "3fc0aa8d-0a3e-47f8-b277-38b3b8b59e80", "value": "catalog-1246101458.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3168de1c-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218182, "uuid": "e37decff-fc39-4e06-9c7b-ad5995ddf7a0", "comment": "Malware payload", "value": "592dd1c6ce878ecc8f015c8356c0e2d0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218182, "uuid": "8c887b40-d47a-4532-be14-8a1decf6a149", "comment": "Malware payload", "value": "2e54cf8fc003e053ac0cd48e5d9dc3528937562056e8974b746cd000ce13078b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218182, "uuid": "313a5ff3-5a2a-4bec-83e2-e3e53b1e7287", "comment": "Malware payload", "value": "61ddc058c90eadf75c451a2bc0a1f16480074287", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218182, "uuid": "807748a9-5302-42f3-8ba6-9fabebcb6650", "comment": "Malware payload", "value": "caa7355a0bed69bd1bd5c7f099a3a36d5c32e9e330e4145e4d6690c0aa1b5fd671c2e2028f90e3b1fa87f8099f50772a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218182, "uuid": "97ed05e2-ef23-407d-97f2-7040f1dac911", "value": "3E830217FB8666618056E9F25B3A3B2E6A8379DD785471A64FBC03C0F53614E2CE81C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218182, "uuid": "50dea9d5-c8d7-4f67-b8b8-362e8d0159e3", "value": "1536:5qmy0pi0wcMlbCUN4gCQZiwotTCWxxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZU:ly0pgGUNEvtTCWzJ9a03fjwe1moYpoX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218182, "uuid": "0d0ef24d-d695-43e2-8b33-889dc027ba0c", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218182, "uuid": "de2e2c35-72d7-4545-ba3c-ff9a537c8354", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218182, "uuid": "6aa5dd93-ab89-414e-9359-8266dd88cec3", "value": "catalog-1380458541.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a3c0dd1-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220479, "uuid": "44a3c35d-9739-426e-9c8a-faf1d0b08604", "comment": "Malware payload", "value": "1c07f1c4cae706e400a83fe8484ceb55", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220479, "uuid": "64366175-5c38-4bce-b71a-adc5feff3447", "comment": "Malware payload", "value": "2e67954b59a46e2adf10cbdde512cb9c2724eabc5564216026ec787d16b238f8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220479, "uuid": "fbc8bf80-0e20-4f05-a2fa-47473f59cc4e", "comment": "Malware payload", "value": "a034954906ac23b1f23babbf2aa03b4c6b55426a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220479, "uuid": "7abc1b97-2c8b-4505-996b-71d72aa63094", "comment": "Malware payload", "value": "c8b809cc82668e59424f61f60d4c6e62701bf8231a2fa50977bdee9ab6ea44a925986ca038baedfd1a108d93a05b8537", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220479, "uuid": "f70c4a67-98ba-4c39-a20c-5812de3eaef2", "value": "1583121E78BDA3D960D1C6422D307A914B94EBD38C47C00572B95D2AA4F0FB605B7D9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220479, "uuid": "abee87d7-1843-4451-bf05-10c9ae84520f", "value": "1536:uNZdYvHm4HQWVy+sb/QM5Y2VXw1QFsrGq9ZMlmZQTQdy:cUG+3Vy+0Xw6Af5dy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220479, "uuid": "43383fa1-feff-4c0f-b8e6-5a0c2dcf288c", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220479, "uuid": "7bde8a44-8796-40ba-aed2-0cc0d7b6e6b3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220479, "uuid": "b529804f-8966-43ed-b47f-f4a586f6238c", "value": "info-1186801316.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1587c958-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218565, "uuid": "c8a16d9c-f3a5-411e-86e7-bfc8d57996b2", "comment": "Malware payload", "value": "dec4337de5f5082a18c59d7791c2cbb4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218565, "uuid": "714d9f97-9cc6-4aad-bb09-23622d8dab3f", "comment": "Malware payload", "value": "2e6aea61fbe2ede451f215d3dc0865b6d42246cb1219fa0772d13635c9036b0d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218565, "uuid": "e35a100f-94e8-4555-b010-720861b470e6", "comment": "Malware payload", "value": "873d81217ffe5d606deb3672e2a956bedee73459", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218565, "uuid": "76b95d91-d9ef-42ca-82ab-405d4920377d", "comment": "Malware payload", "value": "9594163797765e6106fcb578293eccc931ec1ac42946fdb9ca2eeeb3938d76ac4da6d395da7c6e77003d37cc3750a52d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218565, "uuid": "e36fbbd0-282c-4889-95e5-fb194e7a5b10", "value": "3E831276DE87A28EC402713013782FE64B2C6B729A61150A1670747B2B2B9794CC7BD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218565, "uuid": "2ce8bd13-c580-4ac9-bfaa-b851cce9006a", "value": "1536:wuRWAXdZ2rQD2aCv0yWxaqQ6Rxt5AB/aqPwL3VbCbW:wg2QKDm/Qwt+awaxCbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218565, "uuid": "98ce1b63-bcae-4d2e-a1d8-f22db0b731d2", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218565, "uuid": "f2b03e79-a4d5-460b-962c-362a4884fb2e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218565, "uuid": "863187fe-537f-4584-bcba-2b90f76482fe", "value": "catalog-1602770595.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55f7eb9a-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220391, "uuid": "7b4dd04b-9795-4602-98dd-38a08b7673da", "comment": "Malware payload", "value": "67dc187ea7f545776521a56cb54a90f9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220391, "uuid": "4f6d2fd0-a3e9-47dd-b213-4f251fe6d488", "comment": "Malware payload", "value": "2e820ba787499851e426c8c681075ba42b3aae3f1c13134a7c2bc94a735c0c78", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220391, "uuid": "01886eb5-53e0-4031-8bc6-be35a5ca7a27", "comment": "Malware payload", "value": "c522ff7f3d497b42c96c92a5fdfd83b4afbfc755", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220391, "uuid": "906f6bb6-3268-40a8-bd76-224db7dc90b0", "comment": "Malware payload", "value": "54f475914fce05d9ef9ce0e10e54431a3178aa32dda471197752fde7c158c7f991b32ceb8ebd4d041b58f0f2d8f2713a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220391, "uuid": "1bf70e9f-f35e-4542-a8cb-c585f22feba5", "value": "7E8302B7322D0BEF900AA89B809FF5F9F156A93E5D1EE510B3642D20357153EA411AAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220391, "uuid": "aed9d60e-40cb-43b7-a329-af1cd63f1908", "value": "1536:RQBAV8QI/AATZvjL3+xnxv5ZUSzhhcBrasoi8vQMwdjV46CTF:P8QI4AZP3+9xv/UGDmrajvIM6CTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220391, "uuid": "62c19678-4bc6-4846-81cb-0453a999e59a", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220391, "uuid": "3832bca2-ed82-419f-8b56-195d212da0ce", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220391, "uuid": "bdcb6818-99a4-4168-a01a-3e749e6f950a", "value": "info-1133425953.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d748f75-a42c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619179574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619179574, "uuid": "41d6dc88-924c-4a57-9c70-458e96e40661", "comment": "Malware payload (AgentTesla)", "value": "e3a27617a162859e3656776392ab3ea0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619179574, "uuid": "36e55f73-a890-42e1-a6ea-cecb7758f5d3", "comment": "Malware payload (AgentTesla)", "value": "2ed644c21ac18f06fd8fae3a23247b5744cba84516393150e2df81c17fc93610", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619179574, "uuid": "5864d778-40ee-4989-be69-b37be17c6840", "comment": "Malware payload (AgentTesla)", "value": "759c6baff085cf8c30e62e2b48695c2c86bd6edf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619179574, "uuid": "3d5dc854-7887-46ad-b459-486796437ae4", "comment": "Malware payload (AgentTesla)", "value": "d84175773dd6aea318dda78d49c22fdb20f2ea3a3597493cdb56814f50c498e53a0c6a5d00527af62c499b8f0b952edb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619179574, "uuid": "f343cf06-ccc1-4223-aa51-cf825992ca6d", "value": "9FD402323758AFE5E53EA73E2024100403F9F516F326F95A7EB800CA5667F8A4773A95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619179574, "uuid": "0ef9e3c9-f4ce-49d3-96e1-62e40325287e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619179574, "uuid": "0c4738d6-6b37-4e30-b888-01ffd06c36aa", "value": "12288:CZlUANdizaessUAWzs+n8lxsdYGHxyZ2OMPmgZak6f2+akiPGhiX:AZa/3gs+nMxHCxyZ2OCZakUFiPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619179574, "uuid": "bfd4a8e4-b099-4474-9513-20cd2b7c2ac5", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619179574, "uuid": "0ee0d3d3-e63f-4335-8f2a-8fc4994ac0b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619179574, "uuid": "f11190d6-f1cc-4f89-b2bf-4367f1c016c4", "value": "RFQ20200423-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2595b57d-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220310, "uuid": "d2ffa280-73b6-4bf2-841d-329c2a4eee72", "comment": "Malware payload", "value": "06985f4669f2d83e70d9038c9d93d1c7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220310, "uuid": "8a2231ec-e297-45a0-822d-7d2091bbfaf9", "comment": "Malware payload", "value": "2ed910308c91065867c1764c153a4ae0d0728d19acdec3db65057d62b983dd1f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220310, "uuid": "85b56ee8-8563-4115-9aa7-6337e5d81198", "comment": "Malware payload", "value": "26fd71aeb678318de5be0cc4e4ab5a737e10c6be", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220310, "uuid": "41aaf9f7-cdbd-45f5-8bec-cea9f4ff0241", "comment": "Malware payload", "value": "6ff036d245a940d19f365a355ff20777bc4e82e42596ab6c637cd4a17891c44481245acad6649fc0284bd3b4fc1112b2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220310, "uuid": "f17d4103-c366-4bc0-b1af-14c53b3b796d", "value": "7683121AA9BD1CD9C0AB13F00D73094D4860EF6D411C8449F10AE68F789EE85DFB7AE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220310, "uuid": "6bd8377a-b775-4e65-a466-037eaa18a316", "value": "1536:Kt1QVGeGAg5dwSp6yMvBjqqxPGLuhCWdHsh1oSFWsfEFhHqLW9:2AG7A8l3MvBjqq5OsZdHAO5hKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220310, "uuid": "ee488f8e-ea17-4e29-b468-8cbf36cb2982", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220310, "uuid": "a20c14b8-b20c-4c37-b081-9d432eaaaf78", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220310, "uuid": "dbdb2f54-2e7c-489e-a6c5-4ea2eae6553a", "value": "info-1077743538.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "491d8dde-a436-11eb-abe1-42010a9c0039", "comment": "Malware payload (FormBook)", "timestamp": 1619183862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619183862, "uuid": "228b8d29-0a5e-4b3f-9762-7f5884e63fc7", "comment": "Malware payload (FormBook)", "value": "8ec1bcc446399823a677217d3063562b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619183862, "uuid": "8848ac61-a7a0-4a2e-9db8-5776c3d42581", "comment": "Malware payload (FormBook)", "value": "2ef41da6731f4164de8d3281a4b296965e8a34426f88e47cbfd44a5177419c5c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619183862, "uuid": "801d0d51-cbd7-46e4-9b26-b62f3cbc030a", "comment": "Malware payload (FormBook)", "value": "a65d12d45d840262d1d79b595ba6be0288efaab5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619183862, "uuid": "bad2f626-b3f7-4a67-a326-8e99077babff", "comment": "Malware payload (FormBook)", "value": "c0fe7b53a88d8778463acc996d6f44fcf0bc00345c1ab20ed45e1bc3dfb958c0367c6c27c587b8f9951bd3dbc3d2d94e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619183862, "uuid": "a6cae8bb-4ab4-40c1-89ae-965e4e8abf29", "value": "6BA5E0747504D89BE52B0DF64C2FA47060AB3E9CA498E40D34A57F6A64F335610AFF8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619183862, "uuid": "e7d848ea-322f-4a7b-97a2-b970decd0a02", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619183862, "uuid": "cf469066-67f9-4adf-a292-6172c15e1bfa", "value": "49152:TD6X6lTSdWVFW5H6tXGqECl3VkMPfWogS6lkglTTpi:TBlTSwHWSXgAkMPf3vgTTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619183862, "uuid": "d324a5ea-35a1-483c-a694-9498fbe8315d", "value": 2222247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619183862, "uuid": "bc9dd0a2-4afd-4cb0-939f-2a64e1c5e743", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619183862, "uuid": "19299279-0b6a-4bf3-a426-6a969fab3cb7", "value": "ojife.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f560366-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218635, "uuid": "21a57150-c79e-4da0-b843-6e7697047f61", "comment": "Malware payload", "value": "69c9b92ee3b3dc3fa5f44a3075a2405c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218635, "uuid": "325a7d36-0ba4-460c-8610-302df44d8de9", "comment": "Malware payload", "value": "2ef62e1da4a2d16a60222408e124a7e889cbdff9690a86887152632ce68c9ec3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218635, "uuid": "fb661644-a4fb-44ec-8568-d681cd6b54da", "comment": "Malware payload", "value": "92ff588927a64cc1450ec93f9bace0601d146066", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218635, "uuid": "5f6f6b25-8939-4b4b-8743-6d0ebe46fb6d", "comment": "Malware payload", "value": "14199657e290bd88971e362c0199dc682291da4f27cc8ede232d9ce77d8f6f23f2350de985f1c422e22f9f6c0411edb4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218635, "uuid": "c2d6e444-c1e7-41b3-b905-006d4a0048df", "value": "0583028BB4D9433ACB7513F65CAE5E0422B1A47F140CC6DC79973B786B53672A472388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218635, "uuid": "97ee1dcc-3fc1-4050-bcd0-6f1a30ea8ba7", "value": "1536:fAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJv7:fijtuPmU9j7+XFWtYe14hbOjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218635, "uuid": "b28c8b15-2de4-43d2-a1d5-33b36b2f6681", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218635, "uuid": "b04946b0-fc28-4997-a405-9786aa38abbd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218635, "uuid": "282c3562-6314-4f6c-8710-85390e2eecd4", "value": "catalog-1651939121.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a21daf-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218026, "uuid": "f0b38653-0e3d-4d7e-97ee-92d3e892cadd", "comment": "Malware payload", "value": "381d7f758af77b0d447e0e32f8559920", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218026, "uuid": "a118f85f-3aad-4c5b-aff6-4d52492c7663", "comment": "Malware payload", "value": "2f19178505ffb1819473c98cd796f489d97db8ed6d5a370d56ab0d4c968e4953", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218026, "uuid": "839e6215-3ee0-41e0-bf0c-9869b30ca9ff", "comment": "Malware payload", "value": "1f207d5ecdf8dcb11574d851ca38d43e31b7352c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218026, "uuid": "163ce078-8bec-49f6-88b9-2cee4fc107ed", "comment": "Malware payload", "value": "e3d659538002f01ad39ab72c413107e83df9c66c49f93eeb676872d34dc650abdf8d065f358a312611e8b1d351c8ed1b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218026, "uuid": "9243b2e7-482a-498a-a524-dcc0ddba71f3", "value": "2783128B74ED173E0E326AF7488F2CE956E4923E0810679D2A677434BB68512F16F3C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218026, "uuid": "b02937ec-c1ab-44b1-9843-c9ae457c897b", "value": "1536:kLWkP7EBmsb8RlihIDbflm6Vadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvh:kLWSiboZw6U9j7+XFWtYe14hbOjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218026, "uuid": "a415ef27-365f-4a70-8352-1d199b948322", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218026, "uuid": "f51c9586-8992-41ff-afd5-fbd938b450a8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218026, "uuid": "a5445a41-e116-4f46-bb6f-5bdcd6ffb676", "value": "catalog-1302443453.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce31457f-a452-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619196111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619196111, "uuid": "5d4b2019-d86f-4d17-85bd-b403356f33e6", "comment": "Malware payload (AgentTesla)", "value": "0fa6133dc744a82450e2f2b3efebd2c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619196111, "uuid": "49beb6ba-5d03-4132-8958-74495544730b", "comment": "Malware payload (AgentTesla)", "value": "2f2b3fad075e54867ccbdb33459be8838c82715040e3f49af5ff2a4aeba741e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619196111, "uuid": "90110b2a-625d-481d-b5fa-f0cb7984971e", "comment": "Malware payload (AgentTesla)", "value": "50b1154ce06f042c304eb3d38e3226b8e2ec804b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619196111, "uuid": "4cc604b5-be80-4fbc-bbd0-d1f4e803ed42", "comment": "Malware payload (AgentTesla)", "value": "bfbb2df126e6ab127ec13b3fbfe4f3cf90c3d1e69382193d9f82099dbd2776af46ac484ce4837779aadf48b59f382180", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619196111, "uuid": "2bcc19d7-3bd9-4890-a232-e6443874e313", "value": "2874AD86AA40C041DD3E5BB0F83E9DF0455B7D6AE874B14F6F49BE2536B30E3152728A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619196111, "uuid": "51188e29-3ba7-438c-aba7-0944c6166cc2", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619196111, "uuid": "2fc7dbc9-0085-4522-aa63-eee3a51e0aac", "value": "6144:GPX0EPXBmENa7TtsUoA4EPwWa1mrP/YW/K4RmiCeHqLiJ:XEPXvN6Tts4wWa1mz/hC4RmYq2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619196111, "uuid": "f244181e-89cc-467c-985a-7fcc698e6256", "value": 342468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619196111, "uuid": "4d6f3e73-5198-4657-a55e-7f6170d8d39c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619196111, "uuid": "7035c6ba-c309-4a33-9723-4618cf5afbb8", "value": "SecuriteInfo.com.Troj.Kryptik-VJ.15120.19121", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae93635-a3f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619157156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157156, "uuid": "20ebb251-f063-4d31-b7c3-5fc4f474ca77", "comment": "Malware payload", "value": "cc3d70499f858056b3eb4aadbca22b90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157156, "uuid": "8639fba7-e3b9-4083-9be0-e637b14cce11", "comment": "Malware payload", "value": "2f2bfbeae9af039db61d3b9f9adef3b5c0a1ef9635cc80510cac0d87f9aade00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157156, "uuid": "fbfeb27d-fd21-4130-8399-129fb3f68fa3", "comment": "Malware payload", "value": "229b70fbddb9d3de9f42b241b30333141d5710da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157156, "uuid": "bd32fef8-8a86-4c7d-b77b-ebeb3af5573c", "comment": "Malware payload", "value": "dc8fb7dac30ea6dad4450d141bbaacaf1c32ec3d0759ce0686f99f7b1c239eb5bae95ec2232b906de6eaf2737e1c80da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157156, "uuid": "cfc5ef63-536f-4831-9ca5-9e56d6a76733", "value": "05940261B7489A66DD2C4CBBC2A3C97106762537DD214FD70C8D873FD1AA1C0AA136BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157156, "uuid": "02fffd5e-f192-470c-859d-296a12f30a30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157156, "uuid": "046769d6-aac8-4cf5-b589-8fdb01cd9c3e", "value": "6144:b51ebwX0Qn6KK1GVKF69vGz879zctI2E0yi2vCizKZ3zJWZLWH:bj90srYgAG0I2yi2aizKOLWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619157156, "uuid": "3245553d-4fd3-4efc-8e58-fa80a8152053", "value": 435200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619157156, "uuid": "01ff1344-bccd-4601-8e9f-91273daee7be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157156, "uuid": "1967a5b7-0e09-405e-9704-cec805f5853e", "value": "P08240421_CIF-Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "025e8990-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218103, "uuid": "a054f121-8b7b-4e30-802b-bc61bdecc635", "comment": "Malware payload", "value": "d6a6a0559ac91c729721b65e61dedccb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218103, "uuid": "06a7fe20-850a-4fa8-a32d-c8e4fdf895d2", "comment": "Malware payload", "value": "2f52bf21f6f84ce767e9355364e57731f6b22263b94755b00aa8920400876052", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218103, "uuid": "690344d4-d9da-453f-826c-c631f24eef66", "comment": "Malware payload", "value": "e6be78b17d2cd2de056498d0298b373138a3b488", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218103, "uuid": "fa143fd6-869c-451d-8229-e397340d45a5", "comment": "Malware payload", "value": "e3c69a2b73197c834aa1e328d20d42afca20f8b26fda4d818fe170ffdb87d993f983602ce0ff5ab31680de5d82ac3206", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218103, "uuid": "5cfadc87-c9d6-4116-bab6-8676a61a0040", "value": "11831217FBC626618066E9F25B3A3B2E6A8379DD795471A64FBC03C0F53614E1CE81C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218103, "uuid": "bbd3d7ad-d351-4424-9264-1381b5ffe95d", "value": "1536:Aqmy0pi0wcMlbCUN4gCQZiwotTCWxxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZ1:my0pgGUNEvtTCWzJ9a03fjwe1moYpoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218103, "uuid": "0b590011-9c98-4518-84c1-27ffc1b35646", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218103, "uuid": "14b1d040-67bd-4074-aaf0-e7cc71a7c70e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218103, "uuid": "ffb948ac-ba42-4ac3-ba90-3711e6d3e499", "value": "catalog-1329556842.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f96ded26-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220236, "uuid": "974dabb3-d9ce-4ece-b406-8c17a85e8935", "comment": "Malware payload", "value": "668e3e32eb1692b09cb7eae51a687154", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220236, "uuid": "9c1fee37-1f75-4e20-87b2-d2ea07e83cca", "comment": "Malware payload", "value": "2f53593d6225e9874b4c080ab34b0e3176576e47157b9e3224f69ac2b38f1d3c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220236, "uuid": "018a2d59-010a-4fb1-83cf-650b06c9bc85", "comment": "Malware payload", "value": "7c860151afb13a720976d0e3b4850ce77040c8f4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220236, "uuid": "94005218-6e5d-44b0-8e6a-deb8c2040ac6", "comment": "Malware payload", "value": "bcbf62777a312ec62b5d5d88a0e4f2d85e67871016acf3e55b7d2c054d384e14c4f2df26ee4025b5fb1772bd74b3be81", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220236, "uuid": "2f05d172-0137-46be-8304-02c5171d3bc5", "value": "CF83029C30FF0144957A6CB8613FE80750FCAFDB2D37B74947208574AA114EAB6239AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220236, "uuid": "a0106aac-cf43-4379-abd6-029dbe64811f", "value": "1536:ZWr7l+KI0ejUgUlrZKFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbXYZTa4hpax:K7l+NUhlrZ6O6xoKDShicdBMM1/XPQTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220236, "uuid": "0358c3d7-d50e-468e-9179-17571ae22cba", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220236, "uuid": "6b1b65fb-bf73-4b70-995f-fd1e573c2dfa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220236, "uuid": "e9b22178-8855-4dc7-9883-c84b26f8f758", "value": "info-1027219722.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0683786-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217966, "uuid": "98b3f748-43aa-4853-a459-43e2aa5d86b3", "comment": "Malware payload", "value": "34040754782163aeb74b7a37d57d0cac", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217966, "uuid": "a6c7f017-caac-4af9-832c-dd10a151daef", "comment": "Malware payload", "value": "2f87e5fa24cf8c7a013364a380e15cbee05a9fa22ffd01b3b554a06dfe0bb327", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217966, "uuid": "acbed46e-7233-4b4a-8bfc-6e74883a953c", "comment": "Malware payload", "value": "f834b7f42d8dd4674e33a833e462d8c7b6e95d0a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217966, "uuid": "e4802034-9e15-4448-8bc4-5da1e5cf2612", "comment": "Malware payload", "value": "8bdc7a30d3623b551a6c56839f9e1ebd78b6a106e065a556d219a612df768ed20cccfa4929f300c7d55b32f49010b334", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217966, "uuid": "bfe96aee-d46d-47ee-a646-6e51a136caca", "value": "F883121F7B8B6932C057E7718F351E0DA393FAED240D6159EE9F47A4FB2600A58681C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217966, "uuid": "3f7f09a0-ffb2-481d-b44b-697d4ace2a7d", "value": "1536:iRn2h1Uf0IzwZQ72ZTYzqcIxxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZiZts:iR2hszG6IzJ9a03fjwe1moYpow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217966, "uuid": "79ee66fa-be62-4cec-bb30-a24f0d21fbe9", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217966, "uuid": "adc65941-4d70-4142-957c-af919584b5d4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217966, "uuid": "a474408f-0ae3-4755-b4b7-ad5ea382a75d", "value": "catalog-1258857438.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b21e15-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218834, "uuid": "e7f6380e-c392-4c3b-9a05-e3d2b1ce26cd", "comment": "Malware payload", "value": "aa9de9039d80445784b5715321889048", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218834, "uuid": "a05ca545-66b5-4c71-b6a0-26684b13afd7", "comment": "Malware payload", "value": "2fa14e52d55c5d9f320d6089dbc40ebefa31372c47fb9f3cd609716ef933d047", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218834, "uuid": "4affa675-88a2-4fdb-aea3-8017e1ddacca", "comment": "Malware payload", "value": "e66f055e834324cd52538886cf73301312ed82f8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218834, "uuid": "ed864584-d7f1-4307-993c-2d31f7f08313", "comment": "Malware payload", "value": "f68ee69981b7d39bfe5d219993f66467fdfde8834d780908b02ae848871ca91734f85a671905262090c5e94a9eda0144", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218834, "uuid": "fc4e5a32-91c5-429c-9bea-79161060e7ff", "value": "418312EBCFEA59984202BF0673065CBBB45428086118BA7A7EDD11506F524F0F8B7DED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218834, "uuid": "0555dbe6-bdcd-455d-ba1b-b91316ce8795", "value": "1536:DZKLWkP7EBmnbRARpNdZ2rQD2FPdo1f+5ff9fuQjMCYNst+IHClPLqkwD0DCuADD:FKLWSFbkpwQKW25NfuQjMCYNBwltD0DE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218834, "uuid": "98c68889-e5a4-4bfa-a7b6-00c2efaceea6", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218834, "uuid": "96e0f57c-be7f-403b-a180-549e20eb0cde", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218834, "uuid": "e4d9c05b-5bb5-46d3-b306-0e4f5fbab352", "value": "catalog-1731438440.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce3f7ac9-a484-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217586, "uuid": "3c0b2b94-ce53-47e3-9cb4-132d55ab7382", "comment": "Malware payload", "value": "4d23e5b1969e7f6a594040afceec6ad7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217586, "uuid": "a89eb2d4-76b9-49fa-9efe-543807aaf31a", "comment": "Malware payload", "value": "2fad53389601a7f7b06ed91f079f0ec92a61f2785f72a096724c62d9a7559ac8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217586, "uuid": "390b12b4-9ca1-4fb0-aa52-9bdeffcf070b", "comment": "Malware payload", "value": "f54b44fb2a23e8e32090d6cafd432ae125d48d95", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217586, "uuid": "c6948426-730c-48a9-a7c7-43b3f51bce02", "comment": "Malware payload", "value": "e2ec0f127ec7c6baf9206418ff33440a5c23517afa51a0802629fa64a5c40e8227ada8b294a7f83c2b104d4aaef4749e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217586, "uuid": "7b497861-d2bb-4126-aa89-9b4fb13ebd13", "value": "9183028B74E9433ACB3513F65CAE1E4422B1A47F1408CADC79973B786B53672A572388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217586, "uuid": "e3405ed3-d937-44d8-acc4-0a6dd90fcba2", "value": "1536:X/AfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvk:vijtuPmU9j7+XFWtYe14hbOjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217586, "uuid": "c948a915-db62-4524-ba1e-42e7ca24d36d", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217586, "uuid": "a20cb1cc-8678-4c18-ab38-574151febba0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217586, "uuid": "a1097e44-5e8f-491b-b6b8-26a60402fe73", "value": "catalog-1054082057.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e6b681-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217762, "uuid": "85b0fffc-19ae-4d94-b33a-a26a5ebb2388", "comment": "Malware payload", "value": "4b5f5dbc02cec4c046d4a1a37719cf84", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217762, "uuid": "2c093bc7-181d-438e-983a-3e9eae254c94", "comment": "Malware payload", "value": "2fbc797867e6acff3f48205330543a1c85ddc5ce025f4bd5b03b48012bdd590c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217762, "uuid": "c7e5329b-2dba-483e-8d90-cf42ba1fc88f", "comment": "Malware payload", "value": "7af972eb01fc1a91f372d9ff202886cdfbe63871", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217762, "uuid": "3f18863f-a4fb-4d90-8ec6-5cf494614010", "comment": "Malware payload", "value": "ee5e57df388c0fe6a6146b84cb2dd420072331add880caee404f927ad4ec94635ec1396284f7e320106c61edf8e1b34b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217762, "uuid": "efc1d4cc-b050-4cbe-bd06-7061d10c3d23", "value": "7F8312A6FDF91BC81829DC25819A6DF1097F8D5D91433378947C38B1290CABE6A026DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217762, "uuid": "40f02935-26a1-4170-b908-fa97775fee56", "value": "1536:3pKLWkP7EBmrk7xQrqQaiwotTqFUAAWB9Te87VqINbtezgVRxr9AiUrQTKXs8FI3:5KLWSUeXvtTqFpe8JqmdIrLjFRbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217762, "uuid": "2fb6f050-ab03-4a3d-b2d9-0ad6ba45a667", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217762, "uuid": "8b9a5d17-e69f-42de-91c3-d90d447b4553", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217762, "uuid": "469b5161-1dd6-4be7-83df-953345f614c4", "value": "catalog-1148351076.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "145f7700-a409-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1619164446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619164446, "uuid": "ebb7b609-e02a-4dba-a860-dd4c9024736b", "comment": "Malware payload (Gozi)", "value": "d73c2013ed413245dd0df8a77ceb19fa", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619164446, "uuid": "009b6a6a-105b-49c3-b604-94b5b553ce06", "comment": "Malware payload (Gozi)", "value": "2fc64e90cb340de60dbe513fb3ff30f1dd205d306f8834c5e3c3d2c2e6e4a7d3", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619164446, "uuid": "3adc8f98-a2a0-4ebf-af63-8174e9a870c7", "comment": "Malware payload (Gozi)", "value": "2e9030e7fad413c886bcaa7f37252684ebfec448", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619164446, "uuid": "e01c3cc6-ee5b-4803-a2b4-4a5e4b039865", "comment": "Malware payload (Gozi)", "value": "be36b6230fcacb6d970db47cc20462e7c043fac6c33535a8cc8b6538c87bf9caa697447578fa7eb246a14b2de36b0b18", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619164446, "uuid": "4f06a9c7-66e1-4070-af96-fd00a7b46957", "value": "E4E49D1135C1C07AD5731A318E29D2E5059EBC220F3196CB73CA6B2F5BBA4D12E36B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619164446, "uuid": "74904ab3-dadb-469d-80a5-8c2120454382", "value": "280f6bee6b47f33229400f9b2c1bb70e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619164446, "uuid": "6cd5c8a5-fc4c-4142-a5df-385b8d781551", "value": "12288:wFdCFEURvc2mBAkB/tcB/gRzqPClvPMQimj6ylrOFqvz0xQLXPiC:wFdChvc2mBAXEimj6ylaFqwa7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619164446, "uuid": "2c0e7cc4-f2d4-4a26-97ee-42756003cba3", "value": 679424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619164446, "uuid": "45d3bb56-a6c0-44e6-a54a-377a35c33388", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619164446, "uuid": "0cae62aa-9217-491b-b198-362eb994a592", "value": "pasteCounterArray.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44416463-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219502, "uuid": "7bc8c412-5fd7-49e5-85ac-42b3ea49c7e6", "comment": "Malware payload", "value": "0d5c305e24d1ecbc6a78ef411e8435d3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219502, "uuid": "703a7df4-b32e-4b78-ab33-9aa11d0fb11a", "comment": "Malware payload", "value": "2fe595919911b052a1b5ae74556e2daec9ec8bcf22fe9bf88795038136bd3225", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219502, "uuid": "8ff74c55-6bf7-4f57-b8d1-dfbe12ccb0e6", "comment": "Malware payload", "value": "8d6561ccbde244f94c4339ef9fc1eda315371110", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219502, "uuid": "8b398a80-41a1-4db2-8d91-77413c4b3077", "comment": "Malware payload", "value": "34c82c62842a2fd0bb0f65dc9e27207331d1624a79b85272a3d801fec6bcd45ad3b674c92bcdafb5e926391678794462", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219502, "uuid": "6fc80545-7f45-4fb9-8497-f38c6f72b4ef", "value": "7A8302CF74E9433DCF3527B648AE1E046261A43F440886DC75D73BB86B52AB265723C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219502, "uuid": "84ccafb3-5c7b-4bb0-839c-7f5f64979b56", "value": "1536:VAfNtg2tf2vCapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvc:Vijtt2v7mU9j7+XFWtYe14hbOjU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219502, "uuid": "b5e318fc-4a39-4a09-bb83-8017f2d8d15f", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219502, "uuid": "4a372479-fa16-48b1-aa8e-48bc703d7d23", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219502, "uuid": "a0039a96-937c-414f-a63d-fcf7ef02144e", "value": "catalog-2122282410.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f81afc2-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220434, "uuid": "575471c0-8310-40da-973c-6c6bf6c25cfb", "comment": "Malware payload", "value": "404ab6a02f018db82c1ba042a11e85e9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220434, "uuid": "a238c821-4dcf-4338-9aca-26a608584cd1", "comment": "Malware payload", "value": "2fe5a1b77733435fe92b8dbce997ee8b308fcc38063ad057914a642ceb88ea24", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220434, "uuid": "87510c61-2774-4a00-a9f9-f4ba537b6f90", "comment": "Malware payload", "value": "07396c143443f4337f5361af27a6ea926e150f52", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220434, "uuid": "8d02ae37-0154-43c9-9668-f094499d3bfa", "comment": "Malware payload", "value": "f9988b2a90e0522c4e2348c751b51d432be78b86ee5a30f3ff37445642fcea088e44339fb27a911395333c2895839d69", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220434, "uuid": "e9612625-91fd-4519-b6d2-289fc6eabef2", "value": "CB830207966158FDF16ABF01273DD8CFAA4ECBE1E93519C0F20E6B65D2A3399225440B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220434, "uuid": "44fe2414-1a40-4c7a-a5ac-f0b4b3ee93fd", "value": "1536:9HZbN5m6RtLlLHfAkZ8kISNq7xWgwMQZL197v7UZoctQ2kPo+4mpRlDi1nUSUqxf:NBm6XLFHfA210wN19T7YptKRNpoUSUql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220434, "uuid": "39ed424f-07f1-4146-9d99-1d71ba9eaa2f", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220434, "uuid": "6eaa1b83-a34d-44b6-8f34-bca0ea15d1e2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220434, "uuid": "39db61d7-739d-4b8d-9fd5-61c39f6abcb4", "value": "info-1152541333.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a1335f-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219885, "uuid": "0ec692c2-c8f2-46d5-b059-f61949dfb70d", "comment": "Malware payload", "value": "6b04e57397323c025cab9c602929312f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219885, "uuid": "b39f9f88-e452-41b6-bec2-69ff26b30b75", "comment": "Malware payload", "value": "3025f53b200561cd797d3b9e7b02af23552e86d18df605bf96684622553aaa4e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219885, "uuid": "a11909f1-6725-4eb9-b7ed-beec1532ae83", "comment": "Malware payload", "value": "76c55ee0cbe370870fff2f8790cdcf9c2c5bd6a2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219885, "uuid": "da066838-d93f-48d9-b412-349ba34e06ee", "comment": "Malware payload", "value": "420404f0a078c7eb23c9b5c201ab777a6808407cfe7bc21bf249a503e4cb53f5df0983c0d7cf1c27aa65bd09d4e5d2e8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219885, "uuid": "7fbad6f7-66e8-46f4-82e9-18882caf2674", "value": "B28302EC7A1BD68AE371835EDA3EA8C133575DA8D00DA062780F7F6B64216FF9524160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219885, "uuid": "e1e709d6-e79f-4d58-8334-0a86d2bf3ad9", "value": "1536:Lf1lwsMJDrdAZQ72ZTYzqcIkUjoB8+wXdpUna5ahL2dmTLUVVvy:jcbt26IkuXinakEmEVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219885, "uuid": "7ff49f7d-0bb3-49de-9e2a-e1e575c30479", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219885, "uuid": "2d734b0e-3649-46ba-90fc-1edc6304a85b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219885, "uuid": "ea4db50e-a990-4315-bd9d-916c808dd610", "value": "catalog-39738814.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bff5593-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221341, "uuid": "ba3b7f9f-c6aa-4a27-af20-d13f7a4c7df1", "comment": "Malware payload", "value": "c94259d092834a8604c2e1bc7939aa42", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221341, "uuid": "fcc2ad3f-7332-42ae-8fe5-b8c9e91dc6f5", "comment": "Malware payload", "value": "3055ca4a8106c375479995439ba2daeeb1e2b5940971045747a8c90e90dc84d1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221341, "uuid": "26a411f3-4246-4fe6-919f-e1c58aa597de", "comment": "Malware payload", "value": "d552e86a2d12928d550ea579ea2d43677b1af2be", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221341, "uuid": "ad6566c6-bea6-4eba-906c-ac5dc822e27d", "comment": "Malware payload", "value": "ba20e750e9cee1b08efe29602faf60bd05b2569094d48e794a895ed67794b861da8123e85b1b95cc95401de2049b572a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221341, "uuid": "dbb4ba85-6c05-4f1d-9cb6-58f0b4b9f955", "value": "BA8302B7322D0BFF904AB89B509FF5F9B155A93E5C2EE910B3642D20353143EA411EAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221341, "uuid": "90df16ea-45c5-4f97-ab90-c8f8e3bdd882", "value": "1536:nOQBAV8QI/AATZvjL3+xnxv5ZUS0hhcBrasoi8vQMwdjVH6CTQ:n28QI4AZP3+9xv/UpDmrajvI76CTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221341, "uuid": "ec3393ec-f76f-4c2e-8436-329c9091aa97", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221341, "uuid": "7d29bf4f-c4de-4d95-a02c-d289c4a18649", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221341, "uuid": "474589a2-9c1c-47f3-8526-5837135fe89b", "value": "info-1627279202.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fd15b17-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221266, "uuid": "38e5af9c-4a98-4664-a505-214e3c19ac77", "comment": "Malware payload", "value": "06539110ee6b41aaf97cf757a0712df1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221266, "uuid": "7d410d81-09e0-4cd9-8eb9-c398b463e9f0", "comment": "Malware payload", "value": "30603c6fefd3aa1a9be5d86bee3a6c90ac3f4d4ed501b153248feeb17a981a07", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221266, "uuid": "27c5c637-cd86-4266-92a7-cb03e09be20b", "comment": "Malware payload", "value": "a8c618e8476f35f15207acab8268f1406c16e407", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221266, "uuid": "3d18a65c-d846-4422-af1a-cb54207b9189", "comment": "Malware payload", "value": "e57cc273c4c89549ff580b31e356ecc5801e3ed96f8692a1aa49a2fd6ff4905bec95e3415b8c61570ae217f4d696f14b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221266, "uuid": "c4733c60-b0a4-4164-924c-b21af3c7e7ce", "value": "5B8302E6AC778C1D818ED2F1403B5E146BF464C1A4B8E39AE95A7E49DC27DC90D0882F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221266, "uuid": "5ec0cd2d-c9fb-4237-89a8-e053648f7f03", "value": "1536:PxKzlSo7mgV3eG17lbkCOUT7oqlaHvvbFq9GHocnoe1RqfwSOJrpMEIpz2Po:PxKzlSoSCn12COUT7o/v096oiBkwPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221266, "uuid": "ee4e6ba5-1404-4600-9acf-cd5ba090b9cd", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221266, "uuid": "111b3845-30d3-4f37-89fb-93d81cf5222d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221266, "uuid": "71184095-3e70-4aeb-94d7-8de9c6345b55", "value": "info-1583506946.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13deadba-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218992, "uuid": "58d62e95-419c-476d-a91d-6aec4352b648", "comment": "Malware payload", "value": "d21795e23d63be8b5b62645abea62fb6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218992, "uuid": "f7b4d712-eee7-4462-9768-c6c355a4cc15", "comment": "Malware payload", "value": "3064d293be840f78f197a2c50e691b82ec60ad82bd251c1abb4e89d35aab7c72", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218992, "uuid": "f7f46576-7c19-4017-905b-abfe8e34eef8", "comment": "Malware payload", "value": "5efb09f26ede6ac3fd5fd9fa1b2c4c15837be54b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218992, "uuid": "b7213123-549a-4673-bb76-ff797f37b17b", "comment": "Malware payload", "value": "72bbae7ce03aef6da9dc520ab15373e66c53874f88a361bf23cbe3fc03ac4c0bb322321062b0806f4a505b4a19a4ef28", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218992, "uuid": "0e8aaacb-8414-4483-82aa-24afd9c62f93", "value": "028302EC7A1BC686E371835EDE3EA8C133575DA8D00DA062780F7F6B54215FF9525160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218992, "uuid": "79934772-50ed-4ae5-8c43-6356d012f20a", "value": "1536:6f1lwsMJDrdAZQ72ZTYzqcIkUjoB8+wXdpUna5ahL2dmTLUVVvJ:Ecbt26IkuXinakEmEVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218992, "uuid": "fe3d8535-9a46-4743-bd08-60d96064c395", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218992, "uuid": "50524ecc-a6ed-4194-a656-c5185f09076a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218992, "uuid": "2deddaad-ceb6-469d-afdf-6a2fda324e7b", "value": "catalog-1827608941.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ff7aab-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220448, "uuid": "55949685-9af0-42bc-94ce-d7c27d78d037", "comment": "Malware payload", "value": "0affa37377e5b10406f253a8f1a22887", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220448, "uuid": "7bc4e824-0f3e-41c8-b400-fc17e44f95f8", "comment": "Malware payload", "value": "30745caee18ed1694347b1c5a3fd0573bbe7c324a589ef48f89f2edef5c6d76a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220448, "uuid": "de2d8807-429e-48a9-b5de-475e9bc27cea", "comment": "Malware payload", "value": "31c0766f11180e6229ae391b7a83dd3c5c80dc0d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220448, "uuid": "93688ae5-cb59-453c-a59a-c1072aaeab2f", "comment": "Malware payload", "value": "6024e84be92fedae49e41d3d9bfa44df14d5d32206f09543e4e4a965ee01e64d59e11626645eb4d88342d2c9a095138b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220448, "uuid": "875fa252-5b30-4cd4-bdf5-a97c273ade5e", "value": "B38302A91826BF1D8B09E9E222DC37AC7E840073B1F593DF401E707271A6FB568611B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220448, "uuid": "3cfd3102-5557-48c3-8b08-7152533b4dcc", "value": "1536:3q9taLgbGL+q1zmW7PlTJkv9c/EWd8E//nfYRq1o+VCQHeWnsUWuopyE:3q9Zi+xW7PVJklMdT//gRL+VbAR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220448, "uuid": "5d94bb6f-9c27-446e-b6cc-49d6f7bd3940", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220448, "uuid": "1a0872e5-b98c-4075-aee0-e1ae3b985dee", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220448, "uuid": "400590f5-d7dc-4abc-949c-ef83dcd96561", "value": "info-1165896402.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12bc1c66-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219419, "uuid": "b92dad49-9d64-4395-aae4-07d5dde42eba", "comment": "Malware payload", "value": "da1022adf96114f3b7c360789a3b9865", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219419, "uuid": "389d090a-5797-4c7c-bad0-0601ee3deb79", "comment": "Malware payload", "value": "308ca3073e520384df6ceee9e9576f7a50562aab1446edd899628f1fdebf0d97", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219419, "uuid": "3198fa35-8428-444d-a8df-c14914d4a27c", "comment": "Malware payload", "value": "6382aae1ee5a29b1161b199d9a52d8bcc7291416", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219419, "uuid": "a433a682-463f-4caf-9770-5bbc959606cc", "comment": "Malware payload", "value": "1615ac20dfe32e26b6c68b91a222531460c8410b2da2a2ee344e3c3c245ee00ad562ffcac296303de0a97cfc1373deb9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219419, "uuid": "dd668504-c863-4c21-b0fa-4f83a4a47da9", "value": "278312595B1B6EB7501F7CF21B322A5ABA03BABD0C1C7096CB78C2C0E739A5F25641D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219419, "uuid": "24549d2e-acc3-4f08-8ea7-23c8b8eab20c", "value": "1536:bNf1lwtMJDrsPSpV8LS4v5YFGrfZg6kxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGf:5cQ8PjLRv2FKeJ9a03fjwe1moYpoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219419, "uuid": "c5a4ae78-dbf6-49fe-bd4b-11757e80891c", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219419, "uuid": "d410eb65-827d-48ac-a4ec-e1e672f5c7f5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219419, "uuid": "e0d9576c-f7fa-426e-865e-ed2e275f57a3", "value": "catalog-2082240970.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc38f67-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222233, "uuid": "dc353b72-63fa-4261-87a8-8bfa1cd1fb60", "comment": "Malware payload", "value": "3677d519041402c78b160510760ac488", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222233, "uuid": "abd30057-739e-4b29-9b05-6f8184d9c28b", "comment": "Malware payload", "value": "30be532074b726106d4f892f4766763ae7ff9af17ed98abded690251b3ef69ea", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222233, "uuid": "a110516c-bac5-4226-913c-2f98726f6e5d", "comment": "Malware payload", "value": "ae4cf014df0d6a4962af082c5a6e444639a9edb7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222233, "uuid": "38e19be5-f6ce-416e-bbd9-a044ec5d3b3b", "comment": "Malware payload", "value": "f3b52e168cb0bca839749d9ec516b44352c4c8bdf568448ebe056a6de2575cdfbce50433a9b76fdc9b1c34fc5fddf767", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222233, "uuid": "cbeb8080-86b6-40ba-a06d-ab7fa37d5bad", "value": "C6830297E05B6E7EC28DD065901E363C25FC24C2F8759B9BED4A7D268836ACD6C04C1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222233, "uuid": "b2508f20-6880-4bc2-8ec8-9988cfb00634", "value": "1536:3aDzeCSrujL5x7mgV3e27JWgtrQZcUT7oqlaHvvbFq9GHocnoe1RqfwSOJrpMEIE:3afYrS5xSCxIGUT7o/v096oiBkwPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222233, "uuid": "0bd1939f-ba37-4a3d-8cc4-7fc8d68115b0", "value": 86795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222233, "uuid": "e4079415-4309-46b5-99c1-6a57fc3bb99a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222233, "uuid": "b33ac317-8045-4124-98f9-d53ccbf54c02", "value": "info-271750732.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc2a89c-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221397, "uuid": "c80d70cf-bdba-4fa6-b6bb-422e550bfa0c", "comment": "Malware payload", "value": "c50d71d2e28ad3e78eb4d1d004174def", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221397, "uuid": "3e0ea801-9b53-4696-9866-d04875cee89a", "comment": "Malware payload", "value": "30bee41a86cf5b225dac2f040452668c84c77a0a5e801252d210092128963935", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221397, "uuid": "12b9a0b0-350e-42aa-9257-37b7832c2aa4", "comment": "Malware payload", "value": "4db8596ef9f1f8ff69d554e7d14c2fd691f82a68", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221397, "uuid": "40c1c063-95d7-4a4a-88dc-887dbc19b50a", "comment": "Malware payload", "value": "b2446323874ecffd5f07e07f48ab92b2b1ba4d1bb2baf6bf9c6517e6c0731f7eb5d80ae47983453affc0a21c3373d2e2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221397, "uuid": "9fb8847b-0846-4569-9113-7a3c079d2d30", "value": "70830266E87A9CEE419DE0A2E03E3A1837FC11D3E0799787F61E3D4680379CE591442E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221397, "uuid": "55b2189c-8332-4719-9b1a-bade252ea4ce", "value": "1536:anNHeop+LU9t5t7mgV3eE7JWgtrQZcUT7oqlaHvvbFq9GHocnoe1RqfwSOJrpMEL:6rkLUj5tSCrIGUT7o/v096oiBkwPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221397, "uuid": "1479f8a4-b49f-4eaa-859e-d645473306e5", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221397, "uuid": "2d3fd202-1468-48c7-ada7-83bf769c2f17", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221397, "uuid": "d3fe6b21-1613-4a00-b7eb-56da86bfe099", "value": "info-1662554823.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76cd849a-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219158, "uuid": "17a15751-177f-448a-b8e9-813fc9006daa", "comment": "Malware payload", "value": "90b3826c671635a5af9eb22ccbc7a15e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219158, "uuid": "8b7a7224-2f8f-4567-8489-093bb0a85119", "comment": "Malware payload", "value": "30cd6112864c37f2de15515e1191478ac4cfa5ac94d2f01aeac60e720d0f388e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219158, "uuid": "f9308d62-5ca5-411e-ac9f-c9f3255953dd", "comment": "Malware payload", "value": "f380b55c3020e67e1c3321b5da1ce3cc8ee8c3d6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219158, "uuid": "140aa937-353f-4bde-9046-202c8411f5cd", "comment": "Malware payload", "value": "4e0e8e2ff731461aed99c7a5a41144ba896c01e491d54af5cfe067389defb6b30f20ab39889817603a6420422c908b5f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219158, "uuid": "7914ba2f-43df-4454-a0fe-f6e25b425b90", "value": "528302C5FE771FED8C9D8E358066ACA41E17CB85D11B2268B06C39F3261C6BD67018E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219158, "uuid": "374bd7b5-87d1-4af2-8865-89468b41418b", "value": "1536:YE+3fNtg2tq2vxQqAvqBuKXxLXUAAWBHTe87VqINbtezgVRxr9AiUbQTKXs8FI+C:YlPjtk2vxQFvaXxLXne8JqmdIbLjFRbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219158, "uuid": "b464d53e-a71b-423e-aa2b-a7acbd17999b", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219158, "uuid": "f0720259-ac7d-4d72-87ed-5f645f656344", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219158, "uuid": "703a1e29-f11d-44e7-b989-e42e3a1606f0", "value": "catalog-1917435832.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "234b1b5c-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222024, "uuid": "27cf549e-c2fd-4c3d-8280-7bb06b0396c4", "comment": "Malware payload", "value": "754c8df475b7bb17425fe1fe2226ba55", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222024, "uuid": "7aa6b33d-0449-4bc6-b2d2-f5c95a142d83", "comment": "Malware payload", "value": "30d812945105f72e28aa955eec40a2fe4f299d619831813d72d8be6beace7132", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222024, "uuid": "172795a9-e8d3-42b3-9016-08aa85146d34", "comment": "Malware payload", "value": "6e0e96a248869061b4c369f1bcbc94952ae11be4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222024, "uuid": "405a9be2-0f8c-47b2-9909-d1e3b98099ba", "comment": "Malware payload", "value": "72262b0d8ebab4d46d0d85b7f057ee32f561b01478c4e744e20440d020d8df04b8026272e219dd9ea6063bc970bb1931", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222024, "uuid": "518012c5-f36e-42b5-9aa4-0895bfb9cfb1", "value": "5D830266E87A9CEE419DE0A6E02E3A1837FC11D3E0799787F61E3D4680379CE5D1442E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222024, "uuid": "9d701f26-9cfe-4d5b-a238-f1db8a395c62", "value": "1536:XnNHeop+LU9t5t7mgV3eE7JWgtrQZcUT7oqlaHvvbFq9GHocnoe1RqfwSOJrpMEo:9rkLUj5tSCrIGUT7o/v096oiBkwPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222024, "uuid": "efd0a1bf-4237-49f2-b15d-1d87454a07e0", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222024, "uuid": "08bd1a5c-3dc3-4b66-999d-e60f616468af", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222024, "uuid": "813ba077-95c2-45d2-b421-f5cc29ac2ab5", "value": "info-2067350233.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7092ce9-a484-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217574, "uuid": "2d9f1f16-a9bb-4bfc-88d7-aa5d57740a7b", "comment": "Malware payload", "value": "44d3a6ca778a6169ec4ef35eada0db15", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217574, "uuid": "6397c059-2f36-41eb-83ae-332d6f7e4c01", "comment": "Malware payload", "value": "30ea8843a451933ff2cd7f77f1e045b9fa6dbb920704676f8685d08174343577", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217574, "uuid": "518c1e56-ebee-4eab-8406-7eeab77f4909", "comment": "Malware payload", "value": "4d7817954589b1461e89b1d65d183ac036c86756", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217574, "uuid": "35d42966-19aa-4989-9910-c055870d37aa", "comment": "Malware payload", "value": "e52fd582310277da30f9dee6abe087c3bf1811c173dbefa8dd1fb762abe3ae17658b329f96b86917acc72cbc1935a7e7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217574, "uuid": "195ccdb8-1efe-4ec9-b4f1-1639dc683a0c", "value": "92831232EA9F5484D404E2625AF27BE51F34CBF28136451B5FB4B43EAD1759F0488ED2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217574, "uuid": "37f16bfe-74c4-4b4d-bf0f-c6561a7027ce", "value": "1536:+2Lsy0pi0wOQYUtcDYflF4yWxaqQ6Rxt5AB/adPwL3VbCbP:Gy0pgOQYqtm/Qwt+aZaxCbP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217574, "uuid": "9ca9e960-2824-4347-b250-bf14b0db68f6", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217574, "uuid": "c5aae70d-83e0-4494-86b1-ab848495c900", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217574, "uuid": "a985f41b-e0e8-4bd5-af85-eb94850e9f77", "value": "catalog-1049776761.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01292cb3-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219819, "uuid": "aa168b01-4b06-4030-ae64-d349736c1997", "comment": "Malware payload", "value": "ccdf193a1183220a42e130ad332dfb31", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219819, "uuid": "3246179f-9332-4875-97df-cbdd8710c79d", "comment": "Malware payload", "value": "31052ac06e1071d13eb340088f985cd4deddb7df0d00bbcbeb232c5983862ce0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219819, "uuid": "6a25ba79-65cb-4465-a8ad-30059a479557", "comment": "Malware payload", "value": "a6893f6039dd6e93d16bde4a7442832daa703aea", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219819, "uuid": "ddecbd77-3953-40e8-86b1-7606dd6d9322", "comment": "Malware payload", "value": "3d41457520482afa2da26b8ed3026c70047baa9d632fddc6abd6e018b45352c4d096757eb358d46d3a02167463b10c99", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219819, "uuid": "2cda5233-0b97-4e1c-becd-028ae7ec9bcc", "value": "2E8312FC7E1B98A4A772969FC0FFB8D5179249E4E119A0A35C0A3A36D4106EBF112570", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219819, "uuid": "fde8bf70-115b-4cf5-9b9b-cd40ba841677", "value": "1536:ueAS5f/KPDChIDbflm7UjoB8+wXdpUna5ahL2dmTLUVVvL:pASl+Dbw7uXinakEmEVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219819, "uuid": "af42e54b-bf39-4a33-8582-666b815ea2cf", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219819, "uuid": "3a708362-b2fb-47df-a488-3da46c0fc0d3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219819, "uuid": "608d7e38-1cb6-4199-95ca-8221d3211acb", "value": "catalog-358827216.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141330a7-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218562, "uuid": "eb6c6d42-278d-4db7-975c-666f5ef5bb83", "comment": "Malware payload", "value": "4191e049b37e471753e92a7a3d3308c5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218562, "uuid": "0e903553-112c-45c9-9ac1-dc771de895fe", "comment": "Malware payload", "value": "31309dd926be2f8af648b5bcff11777d0cc91faf7f30603748844fa36b211f52", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218562, "uuid": "6ca132cd-7404-4b24-a51d-2135f24f384a", "comment": "Malware payload", "value": "e6c31b1a7d7673c7f9ec5022a5c3381a5e5b69a7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218562, "uuid": "a2f16707-e51d-49cc-ac95-ca6f57c4c5ae", "comment": "Malware payload", "value": "203ad480f60fde94b77f98d8572b97481ac050f55dd0693ca20c4e7a55c6aa93fe100504dc55acb07c12655e64d0664c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218562, "uuid": "779cbfc6-b371-4f89-8111-b55f72e01743", "value": "48830268CB9F8D948005ED0ABB12F8ED7550524C716973ABAFAD1124FF478D5B2328F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218562, "uuid": "35c85a04-e2df-481d-ac34-9fb847080da9", "value": "1536:WA6P7EGmwH1zVQLQDYflSJXvoDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnex:WAY31zVQnIJXaM25NfuQjMCYNBwltD01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218562, "uuid": "482f510c-5360-4799-8aca-0b107c46f840", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218562, "uuid": "9f07dc38-2cf8-4b3e-b359-12379dd02cbf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218562, "uuid": "c78b9c82-7d58-49f4-8059-6c807489bc30", "value": "catalog-1601888296.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "261c5cc1-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219022, "uuid": "3f664e7b-5d3f-44e2-a252-c9c2cf896934", "comment": "Malware payload", "value": "7dd3decaa6076ebf9a6e30ecee118dfc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219022, "uuid": "5f42b514-60ae-498d-a79d-bb7200fbaa2d", "comment": "Malware payload", "value": "31537676ff2e52c2fac67d3853152b9231fb85f6c690731612054995f7389a0b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219022, "uuid": "24e53b23-509f-4c8d-8535-8d773a562dcf", "comment": "Malware payload", "value": "24fdaac4dac1076118da886423874bf0f3f9fd1f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219022, "uuid": "decd74a6-6e3c-4ff1-9f7a-5b6dce97ab6a", "comment": "Malware payload", "value": "8e56ad5eb7a60eb17509f721bb7d4a15f034068cf6bce468378fe654173c6bea1270309583963ac6dae90a21ba795d70", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219022, "uuid": "97988f3d-52d1-4e51-9af7-bafa3850a3c1", "value": "D2830276DE8F8289C016B23003787EAA1F686B7146A1141E5BB0747B2F5B9BD4C85FD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219022, "uuid": "4df1814c-8b03-4db9-a6cb-af0111d8c3c7", "value": "1536:EEpHCzlWAXdZ2rQD2aCvdyWxaqQ6Rxt5AB/aqPwL3VbCb3:EqCzh2QKmm/Qwt+awaxCb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219022, "uuid": "57c6d8e8-9f49-4cfa-ae77-2a15ad62d15e", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219022, "uuid": "24c836da-b48d-42b7-b9c8-bfa55d785197", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219022, "uuid": "5c9b8f18-f634-4620-8ec1-acc6f1f2f0ec", "value": "catalog-1844993361.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e010369c-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221911, "uuid": "f9c4dfb1-0c18-467c-a426-5143786fa774", "comment": "Malware payload", "value": "8a87c886cb5b6e513862d3e7ea3965b0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221911, "uuid": "69ab0e51-3ec5-4ab8-b38f-c937febbcf59", "comment": "Malware payload", "value": "31779f4f3f11041e6dce1853993d108fb8a4d695cf02683b9d6754aafe799a9d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221911, "uuid": "86c2db91-015f-4a26-a61c-9db61b8a354b", "comment": "Malware payload", "value": "35867924e6bac76f6e5a3fb051802636c820281c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221911, "uuid": "04cffdaf-7f4b-428f-a42b-6f717df52ad8", "comment": "Malware payload", "value": "f59a622924781d06db75a92b12b2c9116f4d9703409b48b8d825be9ea8424221b28e05c2b5186eb1bff7f96aec6015c3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221911, "uuid": "e1f286f5-5ff0-4c3d-94eb-d9a0d98be887", "value": "258302AD1836AF1D8B09F4E222DC37AD7E840073B1B453DF415E607271A6FB5A8611B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221911, "uuid": "317b64c5-335c-4ca9-b75b-152a84695a18", "value": "1536:QataLgbaL+q1zmW7nlTJkv9c/EWd8E//nfYRq1o+VCQHeWnsUWuopyZ:QaZ++xW7nVJklMdT//gRL+VbARS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221911, "uuid": "6176c7ab-952f-4466-a957-dd0f814999c0", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221911, "uuid": "2140ea79-e1d9-49fc-894f-dbe5ee8e03d7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221911, "uuid": "facc65c0-ac95-47d8-b289-44495b29f001", "value": "info-1972893084.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c40f83c-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218710, "uuid": "e003204e-41ce-4df0-bf1f-4bbca77e3112", "comment": "Malware payload", "value": "a8daa1f7aaf0b1db2541f1c6375b4029", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218710, "uuid": "fac1487f-aa33-4d34-8977-8546be4cf3b7", "comment": "Malware payload", "value": "31951f53423d810b84eebdfea8144957715ae73d82de5345b4412666606bfcd5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218710, "uuid": "4fc652b3-d59a-4ab1-b8ef-945fe21f73ad", "comment": "Malware payload", "value": "96de4d97bcdfd1c0e42f4c33ec9725c3ab9f055e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218710, "uuid": "b425d919-a0bc-41c1-ba85-e90b545a0a98", "comment": "Malware payload", "value": "ba4457bb520b3bdf33e83128230f1bb5b1800664587e5bc0fe965941b4794a109d74be4de2185df813c62fd21292582d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218710, "uuid": "e2be4969-039b-47d9-8510-819c93de56bc", "value": "6F830298876F8C9C8005AD0EBB22B8ED75505148F176B3B6BF6D1134EF468D9B2738E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218710, "uuid": "c89004f9-0c26-4396-95b0-b87f494ca226", "value": "1536:1A6P7EGmof2vtQLQDYflSJXvoDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnt:1AYn2vtQnIJXaM25NfuQjMCYNBwltD0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218710, "uuid": "b885c14b-f7aa-4e79-bea1-7e27f6d774b7", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218710, "uuid": "4f5f9574-8bdd-491a-aeb8-d6c909547e2e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218710, "uuid": "bf2b414f-e81e-44c4-8ca9-f6386a02bbf3", "value": "catalog-1674590889.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9268a265-a41d-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1619173248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619173248, "uuid": "4b25f7cd-1f7a-4037-a75d-855c11d929bf", "comment": "Malware payload (ArkeiStealer)", "value": "48d0d922b4cc7c9e144db59f6267d34c", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619173248, "uuid": "f2082284-83a9-4c49-bc3c-4543e91d7e76", "comment": "Malware payload (ArkeiStealer)", "value": "31c36ff08b6dc2e3c953f933c80f8035214ad8b9bee4870109cb1aacebdb475c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619173248, "uuid": "08db9bc4-184f-4011-ab50-d5dd5ffe305c", "comment": "Malware payload (ArkeiStealer)", "value": "0f6b9b0ebbe686dfd748ccfca669b0d269d206a6", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619173248, "uuid": "610c11b8-12a1-4978-af21-0294ebe8dd2a", "comment": "Malware payload (ArkeiStealer)", "value": "313e8214bbad43aa048f08a4438ff61f40fd8da241303360be85f930c0b218488e275d558ba848cbab190241eac6dedd", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619173248, "uuid": "f7d45b4a-a1bf-49dc-9106-d36cee148572", "value": "26D4E10532E1C0F2E0D221768129DBB18FFB787159659A0FBBD40BB94E357A1FA1D31A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619173248, "uuid": "2c5e75a9-c580-4426-baea-3178cd6f1902", "value": "23f1e68344716b56a4d1f4cc32903797", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619173248, "uuid": "5b328450-7463-49f1-b042-a3f0d0cc069b", "value": "12288:IoXEu4j+fQtu8eehFSAAjVO2pe179QHa5pzo4jpJqhSKSUv:IgEjqfQQFefSAAxO2pe179Q65/shS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619173248, "uuid": "ec4c9386-bbc0-4d1e-b927-7e9d51258300", "value": 651776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619173248, "uuid": "e2be187d-5fe8-493a-bcd9-cd46a12721ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619173248, "uuid": "981add9a-e091-46a0-92ac-4bdb0209ef2a", "value": "48d0d922b4cc7c9e144db59f6267d34c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00158f53-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218958, "uuid": "7cf4a103-73ee-4eb0-8f1f-6814df07a4b9", "comment": "Malware payload", "value": "77460b8f836dd5aca0174b42746ecd94", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218958, "uuid": "8afe2d6a-f9ef-42ba-8fb3-356191f4c377", "comment": "Malware payload", "value": "31c67ffa73952a0ff964df337cb3e1f936f104755d106c59ffb147eead8521bc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218958, "uuid": "01e9c790-a883-41da-9711-3a5be9bebf7a", "comment": "Malware payload", "value": "91fcb1c2dfe0f2ae6cc208816d165ecceb95d76c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218958, "uuid": "af2d5176-c92c-48cb-a911-7eee4855d6fe", "comment": "Malware payload", "value": "32b93be7db805737926197890d54e59318c851f7703eaccb3d4465f3d676a11990dcdb24c3a2020e48ac72640df61d8c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218958, "uuid": "76b4cb79-0441-4b73-af37-a61a46214693", "value": "1B8302E872A659785CFCB51D2FBF79591EFCF7A54EA20237E2048012B8F1698ACD4314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218958, "uuid": "4c9d9a39-91c9-4716-ab97-b6a90aad1ee1", "value": "1536:kq6WaUf0IqrKC4r94hhs/9AGEiFALqCJI3+xOtGkwdO2eDiFX+:Zq0EaKUFALAOxeh4ONqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218958, "uuid": "5e538cbd-f0ba-47dc-96f2-d5491b79b498", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218958, "uuid": "66861f1e-9152-4099-b02c-c1c5d3d9e7ef", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218958, "uuid": "4257e781-043f-439b-9b18-6b4c38fc1fa7", "value": "catalog-1812277935.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c661887-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221637, "uuid": "75c14904-e09b-4379-a4b9-48d330d2afad", "comment": "Malware payload", "value": "48ae24e2a82b9f3ee05de9783d5a65b1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221637, "uuid": "d4fff752-b9b9-403e-aaed-eb34cc8d61f5", "comment": "Malware payload", "value": "31d67931abbde5d9f00e56742af116b78d44ca5649c3321c04c1ed2c36ce80ae", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221637, "uuid": "342a5b12-f53f-4fde-83b5-518d849f7702", "comment": "Malware payload", "value": "ef4245099686e942529e29d9419dfcdebec515bb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221637, "uuid": "f3a2839f-b560-4694-b040-1e2b0f15d1b8", "comment": "Malware payload", "value": "fbbeca561338c3b31533e2d038a4f9199461e41d4d287e2cc07a092ed78ef32d587ed188a5036575d1072730dcd15dd9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221637, "uuid": "b60a8b49-95df-4656-a83a-207c49b4b6d2", "value": "B983029C30FF0144957A68B8613FE80750FCAFDB2D37B75947308574AA114EAB6239AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221637, "uuid": "bd299a12-1cc5-40b3-b275-3585d08a476f", "value": "1536:Hr7l+KI0ejUgUlrZKFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbXYZTa4hpE:L7l+NUhlrZ6O6xoKDShicdBMM1/XPQTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221637, "uuid": "c2335d21-6bae-469c-adcd-d03b834e8151", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221637, "uuid": "4feea343-2bcf-4ecc-aaba-429c77bfc97b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221637, "uuid": "098ee044-b245-4dae-a4aa-f128e4be4bc5", "value": "info-1787965709.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ccf0b7e-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218228, "uuid": "a9ccebf5-44dc-4cc4-a12a-8c64e43b4573", "comment": "Malware payload", "value": "b5f3e1434d751dc08b8bf37ae12132e4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218228, "uuid": "5a00d2d5-0b1d-4d53-9ecc-9461b15d2a97", "comment": "Malware payload", "value": "3223205a710a90f9ef2856344308dcae8b4ff8c5ac9b9662b4cedb093e090c22", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218228, "uuid": "6d70c296-7817-4125-a2c4-f4dc9d82a9bd", "comment": "Malware payload", "value": "cfbe998f49f1bde0aab247832ff89efee6490f47", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218228, "uuid": "595e2446-1450-4e46-96d2-52f355d325c3", "comment": "Malware payload", "value": "62c5e69e2d3604e964ccad9e30b463531696fa975449d9d51104062e44805b3b17c9f536c293fb9054fcf9dbd9000322", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218228, "uuid": "223d366a-19cd-4df6-add9-59243c2240dd", "value": "65831277DE8BA18EC102723013782FE64B2C6B72596115061670747B2B6F9794CC6BE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218228, "uuid": "e8d45321-92ef-4d17-83e0-a3cc228c8fbd", "value": "1536:b3uRWAXdZ2rQD2aCv0yWxaqQ6Rxt5AB/aqPwL3VbCbH:bg2QKDm/Qwt+awaxCbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218228, "uuid": "c53c1dcf-4c36-4470-b00c-f5e17d8d68b3", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218228, "uuid": "fa559768-f1af-4dbf-a331-6b993a570546", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218228, "uuid": "885767bf-70cc-40b0-a823-8ba441899f65", "value": "catalog-1404104013.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc873d42-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219382, "uuid": "23664223-c01b-431f-88c6-b890d6344d4b", "comment": "Malware payload", "value": "bf633cef33361893f0fbc8fe2333e8c9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219382, "uuid": "bd199a35-178e-465d-80e5-35b037f15a84", "comment": "Malware payload", "value": "3225739519a5e582d3de88e4979a63798e097e2811085a7f6ae6a52eb02278f7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219382, "uuid": "7a7ff08d-4f48-47ad-98ca-90a77bfa4ee7", "comment": "Malware payload", "value": "022bc2c4a5b435c798749681c0ceedbfb1d0313f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219382, "uuid": "7575851c-d5f0-4d77-a56e-0deef1551688", "comment": "Malware payload", "value": "8670bddc33603a170422e27f67f9cf66a02a6e5a9b1fe6cba015d03c9bf5e3973163d3eb0e19bf65f1da2f7d9b6eba67", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219382, "uuid": "08028bc8-3d40-4958-821e-4570f7e9bbd9", "value": "DB830268CB9F8D949005ED0ABB12F8ED75506248706973ABAFAD1124FF478D5A2338F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219382, "uuid": "f5591bf1-ecba-4343-a6f9-5316cc39b52d", "value": "1536:sA6P7EGmwH1zVQLQDYflSJXvoDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnw:sAY31zVQnIJXaM25NfuQjMCYNBwltD0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219382, "uuid": "fd78d182-491d-4c94-be1e-8bcc8e197bab", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219382, "uuid": "e85e9758-5835-4888-8c9d-e20a9156e0f9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219382, "uuid": "0d15c619-6fa3-4878-9c09-17dd1aeb1bc2", "value": "catalog-2052041705.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd61a20-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220132, "uuid": "4beb9a2c-232a-4192-8679-66a08b5e627e", "comment": "Malware payload", "value": "45ef730f4af6691df268de7054b1174a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220132, "uuid": "2be030ce-fad1-40b5-8712-b4023f00c217", "comment": "Malware payload", "value": "3296a15a6476c561b03f2fc73e504913efc5dd5fc4967d4e4538da0a2ff9dc82", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220132, "uuid": "52721f7e-e6ce-475f-89fc-306983208c03", "comment": "Malware payload", "value": "40ca6ad8c04bbca9bb30db697c5ff0155806af8d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220132, "uuid": "0173e38b-7d2b-4c71-bc20-a2cb02043f7d", "comment": "Malware payload", "value": "f355085ae24339bc9e67db44908dcb63665415a95a32466674af051d0f7f69d2b4b6f9519917a41effdd19ffa98ecb68", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220132, "uuid": "cb2a4862-3021-49a8-8c49-bd7cff70182a", "value": "2C8312D78ECB2268742CECB9C4772CC40A15CDB3D2462269266636B71845F7FB7008FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220132, "uuid": "3d23c0f7-d64f-43c8-a2f7-5ea9486d0e54", "value": "1536:gqAS5f5EV5fEnaj1ZQUcDpTe87VqINbtezgVRxr9AiUrQTKXs8FI+bN:vASvEVZtj1ZQUcDJe8JqmdIrLjFRbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220132, "uuid": "19a8a1d6-fb36-4c06-80d6-ad0446c805a8", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220132, "uuid": "ffdc9ea5-28b4-42e8-9cd5-7dfefa7251ba", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220132, "uuid": "0f4907c5-f4d4-4807-ba83-c272684327af", "value": "catalog-538603061.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af619d6-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221285, "uuid": "1a816542-a793-4380-9976-be1026933523", "comment": "Malware payload", "value": "5cb9531eae68ebd8b023efa03e92ff4a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221285, "uuid": "2aef54bc-d1a8-4bf9-b4cc-76fc8bcd19cb", "comment": "Malware payload", "value": "329a776fbe333eff3cad140dfbba680f9579570db5db100ef8b0211a6c1335e6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221285, "uuid": "5707e980-fab5-405d-ab22-1846c6cef56f", "comment": "Malware payload", "value": "cfe11a8fdd9940726860d78d46bd2a9acd3f59a4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221285, "uuid": "5aa6e503-41ee-4b6e-a14f-61f98d38b380", "comment": "Malware payload", "value": "5f5d8f697ba338713ee41eae548fdb1738e523d11bb27d23784980d5be29ebfbba6bef56311e5b26172490510505f813", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221285, "uuid": "208a5384-8400-4464-b93e-1f9aabaf5e5b", "value": "1083121E78BDA3E560D2C6022D3479914B94EFD38C47C00571B45A2AA4F0FB605B7D9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221285, "uuid": "b241b10c-043c-479e-ac5b-f7ba8113212d", "value": "1536:RNZdYvHm4HQWVy+sb/QM5Y2VXw1QFsrGq9ZMlmZQTQds:vUG+3Vy+0Xw6Af5ds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221285, "uuid": "da219747-1e69-4eb5-b02a-78186388f570", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221285, "uuid": "f0e973a3-aac7-47fe-a47e-d523c765aa48", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221285, "uuid": "0e96eebf-ef8b-443b-917a-4129cfb5043d", "value": "info-1594232614.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3182236d-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219041, "uuid": "4bd50953-5fa1-4f79-8155-99cd4ee385ba", "comment": "Malware payload", "value": "4f7244d543c4bdea5f554a71dc0a95a0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219041, "uuid": "9e2e9b00-bb27-41c7-9718-6e7764737b12", "comment": "Malware payload", "value": "32aa15d0459991c1f86aaf5ead0c520af9ab1b3e23254f1e6c6a3a3289663032", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219041, "uuid": "c69112e7-518c-4730-9056-2b12281d7d03", "comment": "Malware payload", "value": "2bb3570b6dc94a52c75fd0e5699f8bbf90925808", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219041, "uuid": "00d27e38-088f-4bef-b3c4-101424828acd", "comment": "Malware payload", "value": "1ad792abeee4faee49203cd898b3b0e76dbd1b0ffb475b02ab852a10b91e2c54c646f5ba53ae98cdf05f83cd9b667630", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219041, "uuid": "ae7a3363-53b3-4787-ba95-438abdecd688", "value": "E18302CFB4E9433DCB3527B7486E1E046661A43F400886DC75D73BB86B526B36572389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219041, "uuid": "2e2bd2a8-6b1a-442c-9a7a-73e4b1d4e3db", "value": "1536:+EwAfNtg2tf2vCapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvd:+Hijtt2v7mU9j7+XFWtYe14hbOjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219041, "uuid": "73c509db-424c-41e0-b217-2e0c6258d8a2", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219041, "uuid": "33a1eb22-377e-4d4f-bbd3-a0e3324be79f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219041, "uuid": "caab6d59-13d3-4920-9f53-c83bab43be9e", "value": "catalog-185838274.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0726f875-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221977, "uuid": "43636eb8-7dd5-4d02-b20d-f3885ffda7bc", "comment": "Malware payload", "value": "cc06ebfc4f98626ad0e72455c9104136", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221977, "uuid": "7feac63f-d1e3-4823-8268-79e0a77afaef", "comment": "Malware payload", "value": "32af960ef9de541db22d1cf69b5f6c44cbf642e4c38589ff577288fb1459f29c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221977, "uuid": "c04fd25f-526d-4639-9441-4e9c80bf563d", "comment": "Malware payload", "value": "4cddc002cc9696279667ae320cb04c9482dcec15", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221977, "uuid": "15ff5980-1dc8-491c-bf0c-d084d2e3b52f", "comment": "Malware payload", "value": "dfd3cb3c4b3c4e2620f6e0a5a1c38ce57d2ace39f3aa6867a82d9128d90904508bcda9fafc9749b582a8a64fb6d8ec03", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221977, "uuid": "5611a41a-6503-4002-93c8-9f384af0e7c8", "value": "458312A1A87CA15F638ED773D0777757E88009E5512C1F9B538222393DB8DEF8827229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221977, "uuid": "8a154249-fdc2-4f91-8654-79cb3be67c01", "value": "1536:staLgbb9ZvjL3+xnxv5ZUS8CWb/bLCDxxp/ERd9QnGlRTH7qrelc5:sZ1ZP3+9xv/UHnfLMZERQnGnTHMe+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221977, "uuid": "3b20bce8-bb90-41f6-9666-6a0d7863a272", "value": 86799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221977, "uuid": "c537294f-aef9-49b0-b87c-976640342a9b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221977, "uuid": "bded83eb-26df-4865-8d87-4b4b81d3ee9d", "value": "info-2025461135.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1952c09-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219337, "uuid": "75894863-28e1-4e49-a642-db0d7bef64e4", "comment": "Malware payload", "value": "f6920ea4b5c98785e01ac8d2e527ef98", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219337, "uuid": "e079d861-713a-4a6b-b511-c8ed6fcec092", "comment": "Malware payload", "value": "32b6b266a87b78d3396f36c5d88e489533a0e8b7da6fe803741098ba0feb2e78", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219337, "uuid": "9694e55a-3825-43a1-82a2-03670a930879", "comment": "Malware payload", "value": "79adf6066ce1dcde7008140f94195eba90b206aa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219337, "uuid": "f9543d8e-9b27-429b-8dea-e2beeda09f1d", "comment": "Malware payload", "value": "a4f0374f05ef31bc36bfede4914b0db3086353e41cab7e116fd81e8e1ea0a44bcf899bd2df1b3e7c0b07714c577a0a06", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219337, "uuid": "8c869ace-2322-4dab-ab4b-78371f9409dd", "value": "C683028BB4D8433ACB3523F658AE5E4426B1A47F140CC6DC75973A786B53672A47238C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219337, "uuid": "52233639-7681-42ef-95d1-b50cd928f6e2", "value": "1536:rEwAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvv:rHijtuPmU9j7+XFWtYe14hbOjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219337, "uuid": "1efa6da7-6d12-4ed3-aceb-794af2bbe1b5", "value": 86930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219337, "uuid": "c629723d-b011-4c4b-b041-8b6328be4e66", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219337, "uuid": "ce5b858c-b96d-4d00-9c13-9f00380be721", "value": "catalog-202547841.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d615f2a1-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218029, "uuid": "8fa6f9df-3b1f-41e4-a2e6-a4cf1360a378", "comment": "Malware payload", "value": "3e413c147d17fd09075a15cb525600eb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218029, "uuid": "f54019b9-d664-49ae-9edc-b849600a1674", "comment": "Malware payload", "value": "32d203c03ecb91269f521a0851e4f2de26f78860d798683fa1f3685f8a488101", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218029, "uuid": "39841556-3e2b-488c-bea3-0e803b183393", "comment": "Malware payload", "value": "103ceca5450409f101bd9e15e9e2dcd97ce559ee", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218029, "uuid": "c78e7d9c-8502-4156-a043-0cd0f8f5bd0a", "comment": "Malware payload", "value": "5d45ca317849b99c6a706a59291e7c309bb8ecc6a3b1acf351bdc59ea48fcf6447407c25077ca76bbd296360c3c20aef", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218029, "uuid": "173619a5-3d12-45d7-885a-1a22c6bc3f32", "value": "84830276DE8F8289C016B23103787EAA1F286B7146A1141E5AB0747B2F5B9BD4C85FD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218029, "uuid": "d3c13a17-1765-4419-b053-3e31998089da", "value": "1536:aElHCzlWAXdZ2rQD2aCvdyWxaqQ6Rxt5AB/aqPwL3VbCbr:aSCzh2QKmm/Qwt+awaxCbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218029, "uuid": "c1361f32-292d-45fc-bce1-871ba14890f8", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218029, "uuid": "a3a2c57a-dc8a-4b42-9b17-48ad75319e68", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218029, "uuid": "f847f77d-5aab-467d-a443-40c1f0dd1d49", "value": "catalog-1303957506.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6679b0ba-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217842, "uuid": "f8da3924-45b2-4b4d-b870-ff7a917e231c", "comment": "Malware payload", "value": "e182e7388882e2d5e02192c65389c282", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217842, "uuid": "10076606-40fa-4757-963c-a3a8dcc28d60", "comment": "Malware payload", "value": "331bd30668f39ab6cae38abb9802c503fca20b7ccdb72f2fefd3def7a81a83bf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217842, "uuid": "5b7accdb-48f1-401d-989a-a691253162ad", "comment": "Malware payload", "value": "c0332c0d9e6e68e772b08d3f159e7d09971581bf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217842, "uuid": "3dcd09a8-b3e8-4149-9a9c-747d6fe48f22", "comment": "Malware payload", "value": "e5844aa930acc892b2c14c9bffaa9c06c1bba8675fbbeaa94eb02a585e90b7325756d22e6f53bf97d03f62a474e1cf23", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217842, "uuid": "3b92a39e-4205-499b-8ef7-1f0b0dbf1f5f", "value": "91830268CB9F8D948005ED0ABB22F8ED75505248716973ABAFAD1134FF478D5A2328F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217842, "uuid": "f4691b60-8089-4c49-a793-6ff5d6da8b3d", "value": "1536:bA6P7EGmwH1zVQLQDYflSJXvoDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnz:bAY31zVQnIJXaM25NfuQjMCYNBwltD0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217842, "uuid": "c68ba191-c667-4051-8ca3-a546405752da", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217842, "uuid": "c2bd1d4a-fddf-4f73-a1db-86447c155485", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217842, "uuid": "1721fda5-726f-4f8f-bfbe-ea9e4e4731f5", "value": "catalog-1194982856.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8943872c-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222195, "uuid": "9900fbf2-5749-49c4-b3b3-b754f498e9f3", "comment": "Malware payload", "value": "34076e6944f72cd3aa3fd50f7c26edc3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222195, "uuid": "865f5305-abc3-42dc-99bb-e2c3e8d0014d", "comment": "Malware payload", "value": "332caff1b4c5474ea429e96bf84f7feef31a5fda06d2ff857892f9fb8d46d112", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222195, "uuid": "e7c7ee6f-f339-4011-9cbf-6130ee6db132", "comment": "Malware payload", "value": "4c7dedecf858a2b8777104d3857d1d0687382cdd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222195, "uuid": "2df70b54-b783-42ca-bf9a-edfbfab86574", "comment": "Malware payload", "value": "4f83b59cbeca21fa702c2c6309ba202be2e09f4f3fccf738846897d5c442d8416b19c1dc5783308be736d60d731168d0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222195, "uuid": "a103f12f-c12c-4e36-92da-34d6340820c1", "value": "2B830207896158FDF16ABF01273DD8CFA64ECBE1E92519C0F20E6B65D2A3399325440B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222195, "uuid": "c6a2477f-f82b-4508-ab11-070c445ae108", "value": "1536:CfHZbN5m6RtLlLHfAkZ8kISNq7xWgwMQZL197v7UZoctQ2kPo+4mpRlDi1nUSUqI:CfBm6XLFHfA210wN19T7YptKRNpoUSUZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222195, "uuid": "15ef6881-4e89-4b2c-b7dc-f27ab9a28f10", "value": 86794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222195, "uuid": "fd258ddf-c9f2-45fe-a8ac-e90ed99034bc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222195, "uuid": "bcc2625a-b820-45ba-af43-c4bbfcc48058", "value": "info-246343707.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384b89a7-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221630, "uuid": "4b5d86ff-f69a-4a14-a683-86a95f5d0bef", "comment": "Malware payload", "value": "161e56211e98044848f5421aed675735", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221630, "uuid": "5d3c3935-2d62-439f-b35c-a7c7a6e6ae84", "comment": "Malware payload", "value": "333620aee6196ea32d41d9de6cf736f07ba1787e9463febb241160f376ca3018", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221630, "uuid": "66707fa0-69d2-4e1f-969c-745a3e5e04b9", "comment": "Malware payload", "value": "5fa981fc34313d8864a77872d323b91bc0030c55", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221630, "uuid": "31bb1c33-883f-4ddd-a344-ba04d5ea7611", "comment": "Malware payload", "value": "81f8e9fec545bc1aeeef2fe815b8f0dc644fcab708e56f3522323c6f1999e12e0a4da5f83c6e0b428e113343c3190ac3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221630, "uuid": "bb4afee7-c010-48ef-abac-afdc520e4897", "value": "818302E6AC779C1D818ED2F5403F5E146BF464C1A4B8E39AE95A7E49DC23DC90D0882F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221630, "uuid": "c82b3e23-c80d-43f6-abec-974b834ec013", "value": "1536:7xKzlSo7mgV3eG17lbkCOUT7oqlaHvvbFq9GHocnoe1RqfwSOJrpMEIpz2PD:7xKzlSoSCn12COUT7o/v096oiBkwPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221630, "uuid": "b0e22ef2-58b4-4fb6-b194-06695e8fd2dc", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221630, "uuid": "2e850e95-d3e7-4dcb-8582-cca3f1fed543", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221630, "uuid": "a0d003a3-4e2f-4a96-a9f5-ff707572b2d2", "value": "info-1785862589.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b1961c8-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222171, "uuid": "fae2fec2-568d-4d62-9f59-9e7a14dd4380", "comment": "Malware payload", "value": "8fcd9c85d0e95770c512288251ab764e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222171, "uuid": "f77b98b4-ea84-439c-9b1c-aae7d8c7de5e", "comment": "Malware payload", "value": "333ad2ee206b0ece1d2c6f570b22b1c3ed6f6ab63655bf4620436c3ad5b93ff8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222171, "uuid": "15e2b0b9-bf8f-41f0-98f8-c100ac06e2e1", "comment": "Malware payload", "value": "ae25b310872e866918b0c1a168c2792f333e333b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222171, "uuid": "88e80ab5-f3a4-4465-8721-b1a53d3a33c2", "comment": "Malware payload", "value": "a6f065e382aeeb79848eb3e3b0585ec4692adb5089c5f3001facc3901d487dda129cf1e340d3e63718ac5bc9885ea182", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222171, "uuid": "5af6413a-ae6c-485b-96bb-3a77873fa070", "value": "AC8302E6AC779C1D818ED2F5503F5E285BF464C1B4B8E38AE9167E499C27DC90D0882F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222171, "uuid": "c0128536-f30e-43af-8651-fc4f3b2675dd", "value": "1536:wAqAxKzlSo7mgV3eG17lbkCOUT7oqlaHvvbFq9GHocnoe1RqfwSOJrpMEIpz2Pq:wAqAxKzlSoSCn12COUT7o/v096oiBkwS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222171, "uuid": "92b97565-8bd1-4097-85c6-31eadb30966a", "value": 86795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222171, "uuid": "37b40e87-cdd9-423c-863b-08c738f21292", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222171, "uuid": "4bbbed1b-8670-42cf-a3f2-11910c9e35ab", "value": "info-231648435.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "526454e7-a44a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1619192468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619192468, "uuid": "59a85a4a-1c5e-491d-aee5-578de04019bc", "comment": "Malware payload (Formbook)", "value": "fb3e44ead09ac81d65413dd918b01fac", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619192468, "uuid": "f73fecb9-f145-4867-9444-8a06236d86e4", "comment": "Malware payload (Formbook)", "value": "33540c87b4a370480b1c9d2961148c88edd7289107970105300ee9497f6b0cfd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619192468, "uuid": "738a188c-c988-4066-8174-670d31c307f3", "comment": "Malware payload (Formbook)", "value": "36c1108df81c5a77fb5a6122fde9ed6547456784", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619192468, "uuid": "dd4123f5-2faf-4c87-b15a-2a130bf692d6", "comment": "Malware payload (Formbook)", "value": "aceac920a883a77dd15d621e51d5cb2a1d52c7d62ceb0cd0c6949f23794c0f68259b123908563d294444d5bc4018c157", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619192468, "uuid": "465e9e0e-34c8-40c9-8f7a-15a23dfec769", "value": "22C42363ED9DF5382739DA7CE60C5E43C719429A1680694FA39FE2B0BE1027B142B7D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619192468, "uuid": "677848d8-bf84-4812-a760-acb314c921b5", "value": "12288:RiMW089pxGBibR3J2sqvDez3JVi4NH3xg8dGR9k7q1q21gbcLXxOIKD/Y:s0epxJ5QZvDez3Xi4lhdik7qta88IyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619192468, "uuid": "b004b2a9-838e-4298-b3bd-0beb1cf883e3", "value": 590234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619192468, "uuid": "a451c02f-28bb-4465-ae44-407a4ca31f6c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619192468, "uuid": "4c344829-f76e-4518-8b4c-a7fff1dbc290", "value": "Zahlung SWIft pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b0c9e2-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221355, "uuid": "7f09428a-aa75-4f4f-808f-e5a7c5979a49", "comment": "Malware payload", "value": "3fbfd0eba73bc74d00a063a734753ed8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221355, "uuid": "22d5573a-7292-4b89-ae15-a529058e05b7", "comment": "Malware payload", "value": "3362a4cb024c6753728dd63e044cd0f25c7aa7c76ba4a8a4490e34c747f0254e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221355, "uuid": "98038758-8222-4930-94c8-2f3ceaaefa5c", "comment": "Malware payload", "value": "f54ed25a567548adc84146461c3cb564c9329d1a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221355, "uuid": "08c6d87d-49f2-4e35-94d8-6372097fddef", "comment": "Malware payload", "value": "4ae8538e121ab976871c880d32781c8335d55c12aa726fc17989873c492a5fa2a2e9ec05d5b5df954aad14b14fdccf3f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221355, "uuid": "1443c5a9-6993-43a7-a5db-efe1575d2bd6", "value": "9083121A99BD2CDDC0AB13F00D72484D4860EF6D401C8449E11AEB8F78AEE45DEB7EE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221355, "uuid": "70b26207-7f90-42b6-be33-69e232b3dcdd", "value": "1536:W1QVGeGig5dwSp6yMvBjqq1PGLuhCWdHsh1oSFWsfEFhHqLWT:kAG7i8l3MvBjqqdOsZdHAO5hKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221355, "uuid": "77b39234-0a61-4b61-9828-7e40fa3304f8", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221355, "uuid": "5a27246d-2633-41b7-81cc-9bc6d161e450", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221355, "uuid": "77e942ab-f345-4a07-8c1a-406b1fc2d61a", "value": "info-1630748555.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c843cf3e-a45b-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1619199967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619199967, "uuid": "f74f08d5-8bcf-40fd-a9bb-5033c468baab", "comment": "Malware payload (njrat)", "value": "66b4a92c9fc61f5db2756d287621c768", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619199967, "uuid": "bb826153-40bd-477d-a349-d1d67d16b806", "comment": "Malware payload (njrat)", "value": "337a895245dcdbe522c4320dbe1dfd62e346aecad8246f9b895a5460211865b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619199967, "uuid": "79afd446-9ae2-4145-9aec-7af70f0d2152", "comment": "Malware payload (njrat)", "value": "76e8f6f17e7074fd7b92ea24b3fe712be752e4b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619199967, "uuid": "befbf529-d2ff-43c5-a294-cf026fdd225a", "comment": "Malware payload (njrat)", "value": "c7f3edd7528320639668080a8b61a853fc6f20db3820d4c59dba7b19fce3603f98b93e4eb90bd6e78d6d1b7813b938cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619199967, "uuid": "7f52bffb-d3e2-47ed-a10b-7cb6886d3514", "value": "88D24B80F2465D57D826793541F27A0427B6FAD13E5AEA2B7F4C88E0B9033C7894C6ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619199967, "uuid": "89fd18b8-148f-4151-9da4-a86535ed6de0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619199967, "uuid": "60617d63-a33e-46ab-9eef-2da3b1c46525", "value": "384:qI13TOP/2HZ9T8KOCESfo3iy2mN8aBnK28fMXb7OI+YEjuyDZtKg6Wh:h3TOPmZxWH4s8aJ9H7wYEyyDZjjh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619199967, "uuid": "d4e897c3-6fca-49e9-937b-2654eb3e1695", "value": 28832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619199967, "uuid": "d5ac0e83-d206-40b3-a6a8-9c5fcc39c3b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619199967, "uuid": "5d6fed98-a10a-454e-a0ae-2c58912c00ee", "value": "66B4A92C9FC61F5DB2756D287621C768.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3796aa-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218096, "uuid": "28ccbd54-4514-42d2-9ef0-b52cef39a734", "comment": "Malware payload", "value": "a902a030c35b848bf00b0af9e680b3a1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218096, "uuid": "4c4f671f-f0ec-4463-9d65-2b21c0fced33", "comment": "Malware payload", "value": "337fb75bc664c3b16d9c2dc0f1d02ad428890c65cbe51814c3c3a2dfebccfe13", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218096, "uuid": "94af47d4-ca04-47df-878f-b86ad8152a4f", "comment": "Malware payload", "value": "978f3e249e624678a6d5e9b8f04137a89c1f8c4f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218096, "uuid": "30968ea3-45b7-4e7c-8e05-ee08af59a8f8", "comment": "Malware payload", "value": "85a685fe321e57f5dd69656bea255af3cea3cd774884116ca0665ae864e8692c14f637d3c54ba6b52b78c039619ae0d4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218096, "uuid": "83fbde3f-8a4e-43c5-88fc-623528ab51ba", "value": "2F8302E8765AC792D370434DC6BDB48637A68EE8900EE053BC0B7B3FAC126BF5425564", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218096, "uuid": "53b19fe0-0dfc-41df-bdad-d10596dea647", "value": "1536:ZFNCZ2i7uJeZQ72ZTYzqcIkUjoB8+wXdpUna5ahL2dmTLUVVvk:ZFNCISue6IkuXinakEmEV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218096, "uuid": "b929c72d-d9a5-41ac-bd1e-2c84a8ba40ff", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218096, "uuid": "97c69af5-6323-4956-999e-ad90a38f4fe2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218096, "uuid": "cc70baee-c9b8-4350-885c-b7fc4e0b3c9e", "value": "catalog-1326849880.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e408fa89-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220200, "uuid": "67095bb6-de3b-41e7-8150-9f63047e0dd0", "comment": "Malware payload", "value": "76ad65374684fd17328d10b1197d9955", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220200, "uuid": "bd03b638-9684-41e2-abf9-64765cb3908c", "comment": "Malware payload", "value": "33916c63744bc91f8be16f0f9c4ab98aff0d9e5d09209d09bd3d0349d55af49f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220200, "uuid": "4fc5b86a-e409-4eb2-a0d8-a5cc1edade79", "comment": "Malware payload", "value": "9d402fe022bb757ad4564059a18b5d554faa7dc7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220200, "uuid": "4f1b85f2-016b-47c4-95f7-14022807f61f", "comment": "Malware payload", "value": "4033e336279bee12fd8642ef45903f609396d1e2afe70a4214bb680b080782a01f3ebb89f4dbb6e1ce310d418662547e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220200, "uuid": "8eb5549a-75e6-4f65-b9df-22803c3033f9", "value": "0E8312ABE5376CF9C19DF2D7A22FA25C36EC85C0B0358286F61E2E06C599AED150480D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220200, "uuid": "8e80c275-4731-498a-aad8-06b23ec99db4", "value": "1536:KHZbN5m6RtUlLHfAkZ8kISNq7xWgwMQZcUT7oqlaHvvbFq9GHocnoe1RqfwSOJr1:OBm6XUFHfA210waUT7o/v096oiBkwPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220200, "uuid": "fbd539b7-44a5-4f70-b484-541725f2b4fc", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220200, "uuid": "a797aca5-3099-4a31-9fb4-0e714cdfd6a5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220200, "uuid": "97a6086e-54ae-4acf-86aa-b4f15c5d228b", "value": "info-1006060811.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5426f0ca-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218240, "uuid": "875b875a-e6b9-4dc8-aa06-16a95661a4bc", "comment": "Malware payload", "value": "0d704c9610ad53142655dc3cec2e6c48", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218240, "uuid": "2c62ba0b-897c-48d6-8b6e-54e39fad7e07", "comment": "Malware payload", "value": "33e6d848e2edfdc9483ffb7736d557962f3ea49f8dd75010bda00567aa38a83e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218240, "uuid": "17674474-1190-4f92-ab86-a514ac102e9c", "comment": "Malware payload", "value": "81c413830501dada5b4d800bf0ac4796e4d5b444", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218240, "uuid": "4f4021a6-96da-4275-9875-ca31446fed2a", "comment": "Malware payload", "value": "a3a289cad36a6ed13d4a6b7d8cbe58080490009e3ec9d0211336d05ab8d36ffe6229219944bfb3e4ed227e6ee5582fef", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218240, "uuid": "13d73839-b46e-4527-a884-1e7095ecb522", "value": "2C8302E9654236BFC8FDA51D206F3D402EACB2E56E2212E7D207D93770F5EA894D0718", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218240, "uuid": "00cfb419-9ad7-4a2e-86cf-b1bab27cf981", "value": "1536:oF5u1k94TfvqBuKXxLG1ZQUcDwiFALqCJI3+xOtGkwdO2eDiFXJ:oF5fsvaXxLG1ZQUcD1FALAOxeh4ONqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218240, "uuid": "0ee7f50c-b27f-404e-b3fe-01bdebf44d22", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218240, "uuid": "8cfb81d1-a742-409c-89d3-1813a03e0c43", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218240, "uuid": "1ad04642-4bd4-46b2-9c02-aaa2c5e3b633", "value": "catalog-1408064852.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2329c463-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220735, "uuid": "6690c824-1626-48d4-9cda-0a6865145c21", "comment": "Malware payload", "value": "2722f9c54bd20d2d05c5b72b80e80de1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220735, "uuid": "47657101-f5a2-4855-97f2-9b92a80b618c", "comment": "Malware payload", "value": "33ea456cc30d550312b0f819de881862564ffbe159c6fd707dc9dbd42f86dc04", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220735, "uuid": "786d67a7-274d-42ea-824b-bf1a19b69364", "comment": "Malware payload", "value": "de3e8063e1874a5611355917d786841cf055f35f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220735, "uuid": "6c3c49f2-5200-49a8-a40f-962ae7bf4eff", "comment": "Malware payload", "value": "bdbf46eaac03074bb31c8deea046fe0e29a7d9e2d811391632f775ccd62713371dff639fac5d11cca810b93e2456ef3e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220735, "uuid": "583307cb-a36d-41f0-8c9c-76ffbf54ebd1", "value": "89830277F0B6A95E829CD0A1901E3A1839F875C3B435978EED1D3A17C426DDD691081E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220735, "uuid": "2b804f1e-156c-41ad-8857-1da48c59ae94", "value": "1536:7BJs4DkjRjDC+ramyNIPjLxx7mgV3e27JWgtrQZcUT7oqlaHvvbFq9GHocnoe1R/:7zLoNfPrG+vxxSCxIGUT7o/v096oiBkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220735, "uuid": "91b31007-d456-4153-ba73-7f3591fa57f9", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220735, "uuid": "383fd4f3-fce5-44d9-8829-51b271ec541a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220735, "uuid": "10c55687-66ef-4bd9-a843-68f91c6a383c", "value": "info-134469429.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a37842-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217922, "uuid": "72d0e31b-ead7-415c-970a-a163df59826f", "comment": "Malware payload", "value": "102753550f1d5a7a944089e33dea381b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217922, "uuid": "7d5af225-c8f5-43a7-a8fd-e07b5e1fef7a", "comment": "Malware payload", "value": "3410944d6da9fa1f99aab8734257739b0e78c88bb2e230c0df20569a634485e3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217922, "uuid": "78998448-d3c7-4dd6-828f-cb9157ac1288", "comment": "Malware payload", "value": "b6fbe06f76808003c21a1ed7f380ba54b7d7f1e6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217922, "uuid": "d347036a-02fc-44fa-ba22-5a2a26f00d1f", "comment": "Malware payload", "value": "ab8e07125257f71574022cb6b5e37466cff308994a0afb00b1835c434603c9b8f345527cc85b2b967e4e117146d3db62", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217922, "uuid": "c80308b1-1726-419d-bc3e-a31df1489763", "value": "1983028BB4D8433ACB3523F658AE5E4426B1A47F040CC6DC75D73A78AB53672A57238C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217922, "uuid": "c86a38c6-113b-48ab-b3da-5b73015d6a56", "value": "1536:cEwAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvx:cHijtuPmU9j7+XFWtYe14hbOj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217922, "uuid": "4ac2e6e0-bcbc-4d93-ab21-f1fcb96100e0", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217922, "uuid": "8d25d566-d424-49f9-a223-53b28acfb4e6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217922, "uuid": "20c82bf2-336d-462f-bcd9-2e86728460bf", "value": "catalog-1237870205.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70853672-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219577, "uuid": "2b72df76-0925-47aa-b65e-8cbe2872012f", "comment": "Malware payload", "value": "4a00fbc0851a66921aac8ffa8b41f3f8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219577, "uuid": "302f13f3-ac60-4b45-8949-59eb2fcb05b0", "comment": "Malware payload", "value": "3468f9f876f3120aa25f06c8edab4c588cb5958ea3f3dc9a960f9faf603c96a2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219577, "uuid": "d6501c84-d65f-4a5c-9dbc-d4d17e82d7db", "comment": "Malware payload", "value": "025a2043084fcb7b40fa43d13c3060be3abe2217", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219577, "uuid": "36bafc80-25a7-4ba3-81fb-a344eee08580", "comment": "Malware payload", "value": "8454903b3384a22bbd0710b89236902037a4f0d7853ee8a43c0801322b07b082f2921020a63de04a7eb0d7f8c2cf8caa", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219577, "uuid": "77f4086e-f425-44af-afb3-8d0789c24f22", "value": "008312EC70238975637345E6DD7E90C32B6B8BBC442DB056A82B693649307FFE111531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219577, "uuid": "00428f58-4c86-42e8-8611-c0874f6a28fe", "value": "1536:1zKTWDE4Qgl8LS4v50FC+p7UjoB8+wXdpUna5ahL2dmTLUVVvN:1eKDPKLRvaFjp7uXinakEmEVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219577, "uuid": "2d9458f0-5819-4a86-bfd4-46ef30ecf579", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219577, "uuid": "625c5e45-eb21-494d-8108-dcf710706924", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219577, "uuid": "50fd633b-dccc-4a37-8a3d-545eb537d63f", "value": "catalog-215485593.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c1f943-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219641, "uuid": "9ed36c19-86d6-484f-af71-6dbef1d4e083", "comment": "Malware payload", "value": "3787e7d3b1ddeb2fe002c63aec60e065", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219641, "uuid": "f19cd344-8fde-42d7-a6bc-d9d4cfa7c622", "comment": "Malware payload", "value": "34720e33c969e200653455d04d8ea7704e8edc17233ead324003f85edcb11082", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219641, "uuid": "bd8e6602-b1fc-4d11-aa99-9c6c3763dd85", "comment": "Malware payload", "value": "7185a8402c7dd931f7829a076de4b7cf7dac58c6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219641, "uuid": "e5dd375a-8204-4ec4-bde9-b63264183939", "comment": "Malware payload", "value": "39babe2a724034efbdfd8f1b5298a0753c5d5a0bb226f05e078c640b2af95a9e6fd82ca6b32f98d538635fbe570be1c0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219641, "uuid": "5b43783d-e420-4a1a-9005-986d8c3a0c43", "value": "E9830268CB9F8D948005ED0ABB12F8ED75505248716973BBAFAD1124FF478D9A2338F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219641, "uuid": "6ac66dc8-afda-4a96-afaa-440c3ef4d2e7", "value": "1536:OA6P7EGmwH1zVQLQDYflSJXvoDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrn5:OAY31zVQnIJXaM25NfuQjMCYNBwltD00", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219641, "uuid": "1c54636c-4fa9-4233-89f8-e7e2f32a3272", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219641, "uuid": "0fed7df5-fd4c-473f-8651-e9afcf07c666", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219641, "uuid": "3f6acd74-1760-4f71-89b3-73e3c71f721d", "value": "catalog-254326762.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3dcab58-a3fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619159104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619159104, "uuid": "9d99c897-4f37-4041-a1f2-db82a9b201d2", "comment": "Malware payload (AgentTesla)", "value": "b8623e305bac6f64bc9500d9ff2b89ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619159104, "uuid": "0b18daf3-10da-487e-9050-35a72c37c464", "comment": "Malware payload (AgentTesla)", "value": "34e58d7b85e1e1747926f184448f0f395911016aa2f6542e7a41e7976d90b03a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619159104, "uuid": "f13bbedc-6e65-4aaf-93c1-51eaeff8c737", "comment": "Malware payload (AgentTesla)", "value": "e2e92513e75bd7fb619194744296245b736abf4c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619159104, "uuid": "872aabb8-32a7-46f1-9031-5065b054b833", "comment": "Malware payload (AgentTesla)", "value": "fa58fab5ca65b3dbfa3af436a9e41d1ecc5cd7af751b8647dddd72d02b6c557b1e2261d24c281764c8a12ce570881961", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619159104, "uuid": "2420e5b7-b2cb-4708-9ff3-705c489b1f85", "value": "66358D9D365071EFC867C972DAA82D64EB6174BB930BD203A02311ADDE4D99BCF144F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619159104, "uuid": "8464a436-7e36-4a7f-9321-bd101e6103fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619159104, "uuid": "ee847092-4b11-45ef-a311-9a895b71e83b", "value": "24576:MYE1v2sWyHJvzGcMgQzcbRXLJOoV7OquDU30N+G:MYE1RtvzPV08RXLL7OquDU30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619159104, "uuid": "e8d6f142-5281-4e9b-9133-3a89dba83f9b", "value": 1148928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619159104, "uuid": "075efe71-fd36-4884-a592-b79a5884ae16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619159104, "uuid": "3a91d8f2-8f69-4364-a869-9bb49b5eedb6", "value": "b8623e305bac6f64bc9500d9ff2b89ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a7148d-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218677, "uuid": "5dce53df-1254-45f0-b33b-60bc9537abfa", "comment": "Malware payload", "value": "5d18439fd80b2307e4d0b81ead4c2172", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218677, "uuid": "046309c9-b2ad-49b7-a5b9-f1df3d1a98dc", "comment": "Malware payload", "value": "3501e133d20e37eaf1f9cfbf6372ff8700cf3baf6ef204f31922be87250257ae", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218677, "uuid": "c7efa910-6fe1-4a73-ab9b-59d4b5f6cb6d", "comment": "Malware payload", "value": "5e4ee30947796ad143df69aa74f623f447695615", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218677, "uuid": "b3be1f1a-4fb4-48a5-bac9-5685e7d9f7a0", "comment": "Malware payload", "value": "76c5c11101e92e95f52ba10d4e71c4e8dddd3eb3d80ca97b5bdf95470c69484d1fbf0c8957a9a0b1e844594db48056c9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218677, "uuid": "6316c032-80ed-4621-90e1-8f8e363e3da1", "value": "AF8312EBCFEA4D984202BF0673065DBBB454280C6118BA7A7EDD21506F524A0F4B7DED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218677, "uuid": "0f21c456-5501-46ce-899a-e45142161d2a", "value": "1536:kZKLWkP7EBmnbRARpNdZ2rQD2FPdo1f+5ff9fuQjMCYNst+IHClPLqkwD0DCuADW:EKLWSFbkpwQKW25NfuQjMCYNBwltD0DV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218677, "uuid": "9db9895b-abb7-4faf-b23d-1f3f83a24ca8", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218677, "uuid": "4a472601-8bd0-4181-b5ac-eef6e75b9b01", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218677, "uuid": "cf65832b-9c06-43d1-951b-387b1959da0a", "value": "catalog-1665370306.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d0507c-a484-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217364, "uuid": "1430fac3-3620-4632-a526-cbba2c554b5b", "comment": "Malware payload", "value": "17990b0715569737c042ac8950c28bd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217364, "uuid": "9fcdb1df-7270-4c64-9861-d187d57829ac", "comment": "Malware payload", "value": "3518427b268d76ef6045ff735c46c4b9bced21b4ec69bb55d76921d57af05981", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217364, "uuid": "29658102-0f66-4307-8331-cefc7ec0eabf", "comment": "Malware payload", "value": "6f63914beb3fb4bf240cb137d2fb022f33f18196", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217364, "uuid": "27ea5dbc-9e64-40a7-a526-a9f83b424449", "comment": "Malware payload", "value": "1bf6d312f3e4b3130f0bd0e9986fd24366a4418976bebae7fa8f36ca882add348b8da99dd7976b570c094e108b1da237", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217364, "uuid": "a7b36c6d-f76d-4f08-9292-377f0cd68a1c", "value": "9683021F7B8B7932C057A7718F352E0DA393FAED240C6159EE9E47A4FB2600A58681C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217364, "uuid": "eb8de41a-a71c-4735-a919-2490fd86c494", "value": "1536:IRn2h1Uf0IzwZQ72ZTYzqcIxxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZiZtL:IR2hszG6IzJ9a03fjwe1moYpoH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217364, "uuid": "9513e005-87f2-423d-ae77-4818e0d877e6", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217364, "uuid": "105087dc-b6d7-4d4e-b25a-fcfce8677cdc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217364, "uuid": "acb90aec-b7b4-4903-acea-d30cc5278a73", "value": "catalog-1014258486.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee785b3-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221345, "uuid": "3b1df990-f85e-425c-9c53-76d4e034282e", "comment": "Malware payload", "value": "eb412f9e28f3a6d29f2a726ef78af7e8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221345, "uuid": "70abbe70-8382-4bf7-8861-030dccf50cfe", "comment": "Malware payload", "value": "35191eaf5ce920486a9ef1ff3e3c1aa628b70e57a05db1989591cff355ab3a05", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221345, "uuid": "9a2bd780-4f6d-4b0f-ba30-81afe407c190", "comment": "Malware payload", "value": "564ac03770ede5b8e730a792d3e4f99f82a50ee4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221345, "uuid": "339491d4-a6dd-4223-87f2-97a2e0d7d3e2", "comment": "Malware payload", "value": "5e56fc629273d5cccd90dc00a6f7a75507e88fa7d2603a5362637889f98631caf241c3adc3e50d028436ba3b155d08be", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221345, "uuid": "3e4928a3-d45f-4bdc-8231-095d9e80d882", "value": "4D83121B667F3DD8C21DA5E45EB31F2D2D600CA9805C80AD514B64FE21BCDE24E638E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221345, "uuid": "f13b4cec-405d-4634-9522-a568a0bdaea6", "value": "1536:BtaLgbCL+q1zmW7WPGLuhCWdHsh1oSFWsfEFhHqLWo:BZG+xW7qOsZdHAO5hKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221345, "uuid": "a1a5a41e-c474-4b26-abeb-0f53284b445c", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221345, "uuid": "e00ec86f-f97f-4df8-b4a5-ddb6eb5e6d13", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221345, "uuid": "eaf59722-3375-4b40-9a67-d57cd309f17c", "value": "info-1627964532.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b525de48-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219692, "uuid": "1ac88486-ca57-4477-8c7a-02e3461e1e5e", "comment": "Malware payload", "value": "d4a0fe4638a5bd72698febf98df604f2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219692, "uuid": "528b5085-a846-4401-8aee-219e5850f04a", "comment": "Malware payload", "value": "3519b337bd17c937aac5199946937e97fd16ae960f2f137a8f7837a5621bab03", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219692, "uuid": "af472163-2cbf-4a14-89a2-408f9f8736c9", "comment": "Malware payload", "value": "1fd41464287fcf1dcac25dd4bd74125bde0be613", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219692, "uuid": "21d49ddd-a519-4072-ab28-ce204fa1eb28", "comment": "Malware payload", "value": "75533af1ac2085073f43c26c2933aae7ace0696706c4e480311849d1cbe4b4433176f3b3fcc72d21c1582077fe9f1903", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219692, "uuid": "86129acb-69e6-40f5-b979-aae36f524e2b", "value": "128302588B9F8D848015ED0EBB22F8ED75106248716973ABAFAD1124FF478D5A2328F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219692, "uuid": "1aa4ee4b-cfb8-4c96-a125-0505f23f97db", "value": "1536:jA6P7EGmwH1zVQLQDYflSJXvoDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnL:jAY31zVQnIJXaM25NfuQjMCYNBwltD0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219692, "uuid": "10ded856-5b64-4a21-a87e-395e0cb3aacc", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219692, "uuid": "ff54f62c-086d-450a-9926-8fa45ae882f4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219692, "uuid": "b8273956-73c0-49a3-8754-07c92ccfe7f2", "value": "catalog-285047752.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "406fae4b-a42c-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1619179553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619179553, "uuid": "fa2c0a42-6529-4c17-877c-256c95daa380", "comment": "Malware payload (BitRAT)", "value": "d1d1db1a452df12d691318d84d74a548", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619179553, "uuid": "3671a69c-a355-4271-bd39-07cfa49b090a", "comment": "Malware payload (BitRAT)", "value": "352079b5516356dae554a0373e989019253b4ccc75975ddf7962e6ce17d47f4e", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619179553, "uuid": "be94c83c-a5c8-4ae3-a976-105461028b10", "comment": "Malware payload (BitRAT)", "value": "7ee8ebaa193d8d68914e9b0a089aea87a6ffaed9", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619179553, "uuid": "e86e2c9e-0a62-4727-9fb7-2228b015f454", "comment": "Malware payload (BitRAT)", "value": "547365890863557284b5f13efcd1721c957f5c966d8e088ca18bff34827d63b8d14483e6d78ccef1aa7a4569e8d5054c", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619179553, "uuid": "421bb91f-6b95-4a68-aacf-b025e623641f", "value": "49952331574A6FF0E83ED77E2031054453F5F610F366EA4ABEAD10EA9553F0A4A33A86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619179553, "uuid": "a0c9a368-efaf-46ff-a667-84d9ac4a31dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619179553, "uuid": "5ff8dfdc-4080-4579-a787-115a6f5a969d", "value": "49152:yB4nl2/WQNtEmcHc9LkwImv46bJWrdTkiHw5K:6EArNtEmIc5XI+ce8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619179553, "uuid": "526203d7-622f-47fa-9500-28479b868b82", "value": 2036736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619179553, "uuid": "f429189a-6b5e-4e49-8b3b-a29971e885fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619179553, "uuid": "1f4ca2e4-d0ca-403f-997c-135d109d1ee0", "value": "Scanpdf04232021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b4162b-a43d-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1619187049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619187049, "uuid": "a1a5ff45-a1bf-441f-ac7f-ac0019480f37", "comment": "Malware payload (ArkeiStealer)", "value": "7433fd2b3d63979d7c6a68a5d31ce674", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619187049, "uuid": "99cd4b68-ec69-40e4-bbcd-ca5ad076e811", "comment": "Malware payload (ArkeiStealer)", "value": "352bbcd8b2bbf4a422befb73314b8d477191d48caa369f982d2559fe4a0df3e1", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619187049, "uuid": "f0cb980b-5a3d-437e-a08e-64e3c64d619b", "comment": "Malware payload (ArkeiStealer)", "value": "9d27749755faaaaef56a96c883e15ead3e37f8ed", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619187049, "uuid": "2a8f694b-bbd6-4fd6-8aaf-dfbcb2375440", "comment": "Malware payload (ArkeiStealer)", "value": "b78e7f99b187beac71383438df25d00ba8ea6fc9f14f1fe590c5a2e1c7b18247003c8cbae9495dcfbf1a876dfce5ff22", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619187049, "uuid": "0720881c-58a8-4064-82a0-8adabf08b2e9", "value": "E6D4F1923BD9C032C1A214368258CBB04F7B7871E9655A4FBBF456BC9F247A1FA1131E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619187049, "uuid": "c20da23e-ad6d-46a8-a065-bdf2698ab3cb", "value": "686ce540142df8f3c2826977a1e5a824", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619187049, "uuid": "e52d9910-12e1-4fb3-a3e3-50c159bcf1a8", "value": "12288:VmnG7/hNOo0FyrpJK6oOmGJcY23amp1RmxMAiRqOIUutZhh2:VyGDfOLcK6oQJcJAeR7IZhh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619187049, "uuid": "756c8eea-bfa0-4672-8dc1-ab3dcdbbd573", "value": 650240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619187049, "uuid": "dfcfe3bc-ad33-4bae-b084-9fb2347affd7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619187049, "uuid": "6104baaa-0451-47f6-9679-fe7f38a68abd", "value": "7433fd2b3d63979d7c6a68a5d31ce674.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d27d2644-a41c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619172926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619172926, "uuid": "f3f735ee-f99d-4f03-a99f-0daa25c77cfb", "comment": "Malware payload", "value": "9ed8d64c8a89627274ed8c9997dab5ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619172926, "uuid": "519af3d0-a5ae-4896-90a5-0b8b730534c1", "comment": "Malware payload", "value": "354ea3fc68c4c745d67417554099d0fa523cd6028ce6d9bac66e67c9739a4325", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619172926, "uuid": "00b6b3fa-e825-499c-841c-88c676c87cd7", "comment": "Malware payload", "value": "1648a5aab33b07c77dd01cb232da73c4fc5e1e68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619172926, "uuid": "a9cb4044-a9dd-4677-ad0c-c9d62f24d07b", "comment": "Malware payload", "value": "6459952eb6760fd3a9e2a580926999e030cd56a8d8c1bbff554b0d8296f6f36f8f890d9305f3b4f209056d90153bb9d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619172926, "uuid": "cd714245-77f0-4788-bccb-c64b6a651a24", "value": "EEF2D03D050A06E6CE79C4BA07FC5BD42C598BB99543C84FBACDE6908E41481F976CF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619172926, "uuid": "6f729634-253f-41ec-8bd0-654fa19d6f6c", "value": "768:EL+NKBfPo867WhBYcqDVrW1QsBLwYWRgRPyq6ozWJgGlzDpxYsOZ/:ECNK++vqdW1bBLw/KCVrYT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619172926, "uuid": "01aa8cde-853d-4d06-bfec-db5cb0763edf", "value": 35660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619172926, "uuid": "21333e22-99f9-4ac3-8ffd-40a9d59391cb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619172926, "uuid": "7c31c509-4f7d-45fc-b721-3d11a1d87de5", "value": "MIPS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d9f71a8-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221182, "uuid": "b99bf60b-edbd-4d15-aaba-6aec97652861", "comment": "Malware payload", "value": "46d8e6b7778a15755e3b0e0f33033b9d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221182, "uuid": "c614cf58-8d69-486e-8192-d5f7153ebc1a", "comment": "Malware payload", "value": "355c2e426a2541ae9f706a4db8b4a6f9a2e661f07f3044b89fd32a7bfb7974b9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221182, "uuid": "601d5d46-b02f-42b7-8708-9d1586ba3d53", "comment": "Malware payload", "value": "d4959f685257dae3ddaef88e48fd79ec467d3580", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221182, "uuid": "a7cd3da9-20c5-4d5d-9e69-4ddeb0f8e616", "comment": "Malware payload", "value": "e853cf4acf09455caf7176589cd87229dbcc5b5ca98b3b3c6f54503ce90b0df389f1e821f747f9223562ca0984bf243a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221182, "uuid": "dc6165a6-6118-44e3-b7ac-4654bcd7ba2d", "value": "D98302A198BCA15F638EEB73D0777757E88009E5512C1E9B534221393DB8DEF8827229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221182, "uuid": "b76e4753-e1e7-4937-8c03-d5511ba7339c", "value": "1536:ttaLgbb9ZvjL3+xnxv5ZUS8CWb/bLCDxxp/ERd9QnGlRTH7qrelco:tZ1ZP3+9xv/UHnfLMZERQnGnTHMeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221182, "uuid": "a412e8c2-7442-4f7d-9ec9-b1e674454d98", "value": 86799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221182, "uuid": "ad855f9a-7b8e-4709-80fa-108862ff1fce", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221182, "uuid": "d94252e0-c27b-4f22-bf18-88916b60a25d", "value": "info-1540622828.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7653cfb4-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219586, "uuid": "be2bcead-43a9-452c-bcad-f3cf7820fde2", "comment": "Malware payload", "value": "486c508e4b2dd961fa1b5131e644d7d5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219586, "uuid": "21320d32-38f2-41d5-8f4d-f08194026759", "comment": "Malware payload", "value": "3584a509949543bb534e354b3f4b8d63bd00b228cc153ec2783bcf312b0bf47b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219586, "uuid": "6f7d1e9c-b917-4c66-a0ff-eb3e11b527b7", "comment": "Malware payload", "value": "a0404790bcbead2002e6a589b7ca2ca17a80094e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219586, "uuid": "1deb587a-d8f8-4aa3-a15a-97d0414bcdab", "comment": "Malware payload", "value": "52a2586ed43a36c3be853ba7a8a6f394a1c6c91c1be7e3a5b75c715e8686be5ad44174dc5d34946c29fef98cd04c736b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219586, "uuid": "6a1c0328-8c89-4510-aebd-25dd459fc545", "value": "29830227FAC725A28046E9F35B323B292A4379D9745435968FBC03C0F63615F2DAC1D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219586, "uuid": "8b672f43-7ff9-4909-9d40-296a275bcad0", "value": "1536:9qmy0pi0wOQMP4gCQZiwotTCWxxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZiZtg:xy0pgOQMPEvtTCWzJ9a03fjwe1moYpok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219586, "uuid": "0bb770ae-540e-4116-bb6d-5df558dc98a2", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219586, "uuid": "7a15d704-c525-408d-aae2-a81541807ceb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219586, "uuid": "4e4ac62c-4599-421a-bd6e-2101b4cfb7ad", "value": "catalog-219166238.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bfc7e21-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217690, "uuid": "421c1e73-5eef-4bfa-80f6-e2737b209e73", "comment": "Malware payload", "value": "2e9f305c580e62ab8f600e4c0c1f1d89", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217690, "uuid": "09429bd2-c967-4be6-b68e-18aadf9bff1a", "comment": "Malware payload", "value": "358e5dc244793852a33bc15be5c9f2aafd07b6277ea0664c49264c1fa8ea9fc3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217690, "uuid": "f4f0fc7e-a7f1-48e1-8849-137dab2eb43d", "comment": "Malware payload", "value": "b1f3c8b586c6556070e652e382a59dc9593431f2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217690, "uuid": "f16da74d-85be-4d16-94ff-8eab7e98cc49", "comment": "Malware payload", "value": "e1fab558acc6b50a320030d97a280c8a3bb62043769669b0201b8a0cb875e161f542e79d85346afdbd5456c9d79122b2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217690, "uuid": "15336a0b-7ed4-42aa-a2fd-46f710f451e6", "value": "39831266FEA52BE44C18DC61E42ABDF005A7CC998347325465393C71248A7BF9B01EFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217690, "uuid": "21bcadec-6b45-4159-97d2-b11658af1a5d", "value": "1536:gl2ooDy3RpsZQSiwotT5FUAAWB9Te87VqINbtezgVRxr9AiUrQTKXs8FI+bK:r+XvtT5Fpe8JqmdIrLjFRbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217690, "uuid": "1d1fdc99-94a1-4fa4-a2e7-ddbfb9e3a12e", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217690, "uuid": "b1f615b6-abed-47ff-b7f2-da08cc1fc6f5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217690, "uuid": "4f1ee4cc-a135-4302-b624-0609848c696a", "value": "catalog-1104650634.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bc63dc4-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219944, "uuid": "86143baf-0b67-45e1-a778-76315c767fd8", "comment": "Malware payload", "value": "9365911a4da1b462c49e710511ef4579", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219944, "uuid": "e83a0ed2-bc7f-455e-a96a-a0a373f21ebb", "comment": "Malware payload", "value": "35c6de0cb5f194f0818fd4e60b15fcb9534a67a854a34d7747896fbca0b5f50b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219944, "uuid": "8ad79bbd-5eee-4f01-974f-aad4a731f6f4", "comment": "Malware payload", "value": "279024541e3c0aa261089175fc962b73f8e004a1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219944, "uuid": "dfbcef89-d7ed-4228-8fcc-6c2d76cebe0d", "comment": "Malware payload", "value": "cc9e384e1ff5f575ed9898307d1d4f8093f854398dceeba1debf1312b527a1f54779076aa02b4f33e81aecb5c3cfa8bf", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219944, "uuid": "83a940ef-71b4-400e-9200-0aa4cbfb09d1", "value": "1A830298CB9F8D948015ED0AAB12F8ED75506248706973BBAFAD1124FF478D5B2338F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219944, "uuid": "c18c2514-8f8e-4503-b12b-c31fbc4827a2", "value": "1536:MA6P7EGmwH1zVQLQDYflSJXvoDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnY:MAY31zVQnIJXaM25NfuQjMCYNBwltD0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219944, "uuid": "36950ab8-bfe2-4a7f-852b-41c7ca09cb55", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219944, "uuid": "da638319-7c39-458e-ae58-106220e8ca4b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219944, "uuid": "54162e02-e0e7-41bc-8f73-d2078595fe33", "value": "catalog-430883671.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6402575d-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219556, "uuid": "34811e71-2dec-4d35-b134-90b607bab881", "comment": "Malware payload", "value": "e7fb9778e05740bd5a68168f0011042a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219556, "uuid": "4421006c-3004-4191-994c-fccf511810c1", "comment": "Malware payload", "value": "35eb9bf721b70ffc9ebf8d492517c4e787ccccbb8b2d31e7f567bd86ca982b5e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219556, "uuid": "12734b9e-d685-4ce5-96f2-449be682ba51", "comment": "Malware payload", "value": "340a189d0b7bfbcfbad5a17308d4acb23993a556", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219556, "uuid": "ab6063ff-e4d3-4b41-b5c3-7be82d8cbcf1", "comment": "Malware payload", "value": "a69e92b8aa639ff224af7f24380883135ad96f7c4d9e71fa3243cc1509e831d838250f672b9a1b2f102337ded7f1113a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219556, "uuid": "67c9c905-5ec7-4b7b-8182-e82934962b53", "value": "598312E87D2B96D9A7B04A4AC5EFF4C61F954BECC46AF0631909BE3588306DBA115034", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219556, "uuid": "74f38437-7ae5-4c85-91a1-1a3e7df6be49", "value": "1536:eYAUAlZ2YmkLx3wRBD7flmTUjoB8+wXdpUna5ahL2dmTLUVVvb:dAUAlIYmANQwTuXinakEmEVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219556, "uuid": "662aa43b-e6d4-4fd0-8bed-81d06f5844a2", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219556, "uuid": "7f1eda53-6b15-435a-a350-7016331f7c04", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219556, "uuid": "737089b8-8684-40ec-b7e1-90a876c82b07", "value": "catalog-2141812016.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c2f517c-a484-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217449, "uuid": "b6a74323-56a4-4c53-b6dc-b0b73b3d1866", "comment": "Malware payload", "value": "6e3aa606cb9e16bd78333b077c063ba6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217449, "uuid": "5283895b-51a9-4302-91f6-744f4da59e03", "comment": "Malware payload", "value": "362649a8a5db8ab4cbd383ad8325a407a425458613e6508f6fdf10c5fd13da5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217449, "uuid": "754a40af-1a05-4ab8-bb4e-37c48ad69a75", "comment": "Malware payload", "value": "775de8891eff070b9830701f3424b864f6c35f30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217449, "uuid": "4f17421d-9a13-427b-9b56-38f571a6fa60", "comment": "Malware payload", "value": "ab58963ea0ffdbc77ae22541f72cffdef0af662e38b1e7538ff61e6804daaa4c817c5898a68a572bb78392e600975d38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217449, "uuid": "68bb366a-20f2-452f-b5f0-d9165de89443", "value": "F68302467EF90F9C1819EC2185174CB50E67CF6EC1872229B268247668486BE7E075EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217449, "uuid": "ab796b26-eaba-4850-a6de-44624e788a72", "value": "1536:mL2dSRV1UgF68rh4Khs/9qDUAAWB9Te87VqINbtezgVRxr9AiUrQTKXs8FI+bL:mL20RNrhDagDpe8JqmdIrLjFRbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217449, "uuid": "f9376b52-f8cb-464a-8fb0-55d00e87e7aa", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217449, "uuid": "232df3ad-23bf-4574-afac-3a94edfd2d40", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217449, "uuid": "c25b00fc-64c9-4b9c-bbb3-dc99276960f0", "value": "catalog-101660541.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5fe4846-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219666, "uuid": "3f4b85f3-6e4e-4857-b852-25e7c4766e94", "comment": "Malware payload", "value": "413b29acc7d3773f05596082836feacd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219666, "uuid": "f3bb0e5c-bda4-4c7f-b8f9-215b50605b1e", "comment": "Malware payload", "value": "36297a4be9f2a3f3b15c9e6cd143ef030b0a3841d4453f9ff2a6d43ac20dda81", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219666, "uuid": "e98c96f6-fd74-4317-9955-86bab416d156", "comment": "Malware payload", "value": "75c933ee8f932c65b0964302e944c30347d23cb7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219666, "uuid": "3460271a-ca25-483c-b7c4-425bb9ba52da", "comment": "Malware payload", "value": "9aa7fa55e2092c88a3737c1faccb56df297ab21443bed8ef78e51c00fcf05f3b2bcd013abdbffbc1eeebc02d4f4b5720", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219666, "uuid": "ae6a5f98-1fe8-4b16-91a8-d736346776fb", "value": "B6830276DE8F8289C016B23003787EAA1F586B7146A1141E6BB0747B2F5B9BD4C85FD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219666, "uuid": "606c3cf3-1a80-4602-bd4e-2a1689b4215b", "value": "1536:SEcHCzlWAXdZ2rQD2aCvdyWxaqQ6Rxt5AB/aqPwL3VbCbM:SVCzh2QKmm/Qwt+awaxCbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219666, "uuid": "15230653-02ef-4c74-b5f5-d0387fdbb21f", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219666, "uuid": "8eb3e360-bbd2-46ec-af1e-80a89f98f018", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219666, "uuid": "7fe743bb-841d-4957-bc92-74e4d47e2f96", "value": "catalog-271699655.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6184b2f-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218888, "uuid": "e4823c60-abe0-4b08-916d-29b3a71d1e23", "comment": "Malware payload", "value": "bd6395fc5c922319cb17f6e6e05b2283", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218888, "uuid": "3d52d573-41dc-452c-b79b-7ab03c1848c8", "comment": "Malware payload", "value": "364bcd3b0a74ff15848f1e2c286922fb84ac88a85785e7821544b0539f4e1ff9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218888, "uuid": "0e1b28d0-92a9-4a2c-b816-96cb492b8786", "comment": "Malware payload", "value": "1ea4f09525f98f6d2eac29c3c97e55868831b119", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218888, "uuid": "acb44d22-189d-4c7e-b18a-3f69d104b68c", "comment": "Malware payload", "value": "b2ac3b22dfb30bc617a19900afb11ad9689f9331b64c31e63b676ea0a3f61e2871c56ea51222ab9c7336e040ef4ae706", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218888, "uuid": "606739b5-c5be-4eae-ba0e-ba5f981d034c", "value": "3E249DC1B680C173C016357185B39BBCA634A933EB19D1C76798B66E6FF33D1263264A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218888, "uuid": "db5b6d98-40ab-455f-b3a1-865cefd4d886", "value": "526fe4b73ae0b7c8133f48c9bbea9505", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218888, "uuid": "76d66102-5c4a-48c6-92b2-27048251ee8b", "value": "3072:b3jJSNXR/z1Fkzn1Tn5m8FhSD3Y1ofT5PAaGoUn+L8TZltkugTA:bMhcZYmn1ofhAaGo5LebkugTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218888, "uuid": "a5d3c0ab-a7eb-4b56-a4eb-66720a054c1b", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218888, "uuid": "d3b47fb3-7f3b-400a-ab90-fceb093e9b71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218888, "uuid": "4c1148b9-348a-4c9c-8d7d-cbd3aee9e30c", "value": "9b3d7f02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d976d54-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220377, "uuid": "193287b3-53f3-440a-90a8-cf872a8408aa", "comment": "Malware payload", "value": "05fb39205428a7120d7f313b40befd03", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220377, "uuid": "5535aac0-6197-41a8-9169-2a56e1637b40", "comment": "Malware payload", "value": "364d116e7bbcaa427fcea76b3a0915e281f9fdbe8a84afaa7a8a34625a523ed0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220377, "uuid": "3e308a27-bacd-4e95-8007-da3e4db71ef8", "comment": "Malware payload", "value": "16a5b6ce6d7152f63cb6e732d38e67f0d8108703", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220377, "uuid": "abf50127-6703-4860-a084-07f3ee6a8375", "comment": "Malware payload", "value": "423adbec9c455305418952e3f6fca961022b55d190939a97cb9607e51cde6e26684892f4b4b57fe2599984daae4e7a5e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220377, "uuid": "41fb8abc-2209-4f8b-8ed8-fbaa763614c0", "value": "C383127F5D2F38ECC615D1A99E3717691B305EA5855C806C12DB389E21ACCC24DB38E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220377, "uuid": "ddca1e0b-263f-4aab-9687-3ff556f77508", "value": "1536:yNZdYvANUL+q1zmW7iPGLuhCWdHsh1oSFWsfEFhHqLWT:IUJ+xW7WOsZdHAO5hKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220377, "uuid": "3e43d29d-78b5-4694-9ae5-7f7455940cfe", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220377, "uuid": "b8e85e55-43bd-434c-8d0a-7e1d3129e475", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220377, "uuid": "6f2cca1c-52ff-4923-8699-ac3b4392ca5e", "value": "info-1121561874.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a62d4a-a3f7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1619157036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157036, "uuid": "e4a7766d-dde1-473c-920d-7185594be95c", "comment": "Malware payload (Formbook)", "value": "50c94832166b699ad3dffa96421a628d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157036, "uuid": "5deab68c-b5d8-4421-8015-b880a85c3f1b", "comment": "Malware payload (Formbook)", "value": "366d4dc60f4193e354e6e77677ac545c0ba20c675bb509cccdc0a3939611d808", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157036, "uuid": "a4366bf7-faa2-4261-9d6a-99ef35c77399", "comment": "Malware payload (Formbook)", "value": "8a980d0d67fc0d0b91a96f86d27b33956d1639ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157036, "uuid": "700cfd55-ea93-47e4-a730-a385b2150e67", "comment": "Malware payload (Formbook)", "value": "34fa1f7e59c11343f450c2f09512daec8c76ac28ff9d81545879146bec6b1d00ad2ed47dda92e8d52b4cd873c859aa60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157036, "uuid": "0289ba9d-3920-4b7c-a687-72e9e1fde50a", "value": "C4158C9C7650B69FC857CD76CAA42C60EB60B4BA470BD303A05716ADDD4EA9BCF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157036, "uuid": "ee99ad6d-1f65-46d5-852a-1a4b40de91a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157036, "uuid": "3bf7a522-5076-4b1d-a166-04d76855f2ff", "value": "12288:HahMM6Usg6kkS6TQ+ITwN2bAnYCrWpKiX9csIFH1AtxkT8R+lgDlTsS8Y3Bp6p//:2sv6wN2byYCipKiXNI81sXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619157036, "uuid": "ef4dbc48-8aa8-484c-bc1a-dd3c4067e1b1", "value": 899072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619157036, "uuid": "73d257bf-a5e1-4f5e-b07d-c5b6150f8af0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157036, "uuid": "cf65d4ee-3eef-4bef-a5bd-4f4d67653781", "value": "TSVINCCU21021642.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "629cdbb0-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221271, "uuid": "8c777624-5beb-4256-9065-c3ee550ae3a5", "comment": "Malware payload", "value": "1eb96d1b313ea58350a407200fef2fa4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221271, "uuid": "da14ac22-35bc-4dfa-aa02-52b077952c12", "comment": "Malware payload", "value": "3672530f0dbad7d345244bb8ff3f16a1de83d76598bc7542e7aaaf29d7d3df14", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221271, "uuid": "e155eb22-c6cf-4cd9-9358-c9d667c6853a", "comment": "Malware payload", "value": "9a01aa62f2b8ec69dafa2ee8683538e38a38a5d0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221271, "uuid": "c6fadc49-51f8-4d5c-acee-ea96d5215640", "comment": "Malware payload", "value": "1da6e108481da23cb294f1f539c71b7d567e8c18531c8bba193f2c7aed024481953a9ce281874cfcd10d8cd6ea699f4a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221271, "uuid": "d18508b3-e6e4-4aa6-a048-622287da0a67", "value": "B3831277F076E96E829CD0B1A01E3A1839F875C3A435978EED1D3A17C426DCDA91182E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221271, "uuid": "87a065b7-89a7-4a69-873a-eee874cee425", "value": "1536:msJs4DkjRjDC+ramyNIPjLxx7mgV3e27JWgtrQZcUT7oqlaHvvbFq9GHocnoe1RY:DLoNfPrG+vxxSCxIGUT7o/v096oiBkwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221271, "uuid": "6d7d84c2-72c5-4308-bbea-eae330633152", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221271, "uuid": "2faebaa9-da45-425a-8319-96c8fd861a5a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221271, "uuid": "328f1b11-4e67-4a92-9d83-3b1c5beaa84e", "value": "info-1584679025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c05e87-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219689, "uuid": "e0da31a3-8cca-4066-a143-16e33b93b61b", "comment": "Malware payload", "value": "a438637f0bc775dfdada8b424e604b62", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219689, "uuid": "c18da7be-47ea-4281-8858-be50f1f24663", "comment": "Malware payload", "value": "36d1553fd8e48fda6d590db33a14dffcd84c99f55f69fa5e39613a4397554324", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219689, "uuid": "7d7357eb-5294-4a41-8156-4c83acf64ff7", "comment": "Malware payload", "value": "bdff4e27c9684ba5dca3c3075cc9ed38a26bf074", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219689, "uuid": "93adc0a7-94b8-4bf1-afeb-91cb7a59ee96", "comment": "Malware payload", "value": "16e5d451bfea7b4dcd795addb6da399651086fc2a0b2d8be94bc62cdf53eb6cb5369a50c22c625b0dbc186f47557cef7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219689, "uuid": "04c2e3c2-8c18-460a-b9f3-12838e937361", "value": "20830258CB9F8D948005ED0ABB22F8ED75505248B06973ABAFAD1124FF478D5B2338F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219689, "uuid": "1c804385-3bfd-4652-9599-79ddab67355c", "value": "1536:9A6P7EGmwH1zVQLQDYflSJXvoDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrn0:9AY31zVQnIJXaM25NfuQjMCYNBwltD0p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219689, "uuid": "3e4f27a7-8dad-4488-8c9b-4cd2cdfd10f9", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219689, "uuid": "f5bffabf-6a86-47ff-9890-24aec8ce33fa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219689, "uuid": "589bf0f7-aceb-467d-9c52-9435dcd32ae2", "value": "catalog-284278843.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6260f6da-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218264, "uuid": "7ec877e4-0621-4b8a-bc2b-e2355e5e989e", "comment": "Malware payload", "value": "936c42d8e4898e4a13a6b2bf7a2273f2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218264, "uuid": "14586c77-1967-43cb-b245-84a6456731ae", "comment": "Malware payload", "value": "36e7f0b033cefd43702ae1521236aa6a1a69cecd4d810012fc4335f042ca1539", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218264, "uuid": "abdc7fec-eae0-4af3-8d73-4bfd33b0f263", "comment": "Malware payload", "value": "f87a4e1bed10856b01056614888917d1f9a2021c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218264, "uuid": "5ecf4b87-5e56-4740-97c9-405d58808662", "comment": "Malware payload", "value": "9aa7d09d8077d7fd507fdb64ca9b598a66368b3a8be8715546ba6b334da44f63c06d474fd5225c3be9bee77f263cc211", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218264, "uuid": "5d5b52b7-ac10-4363-83a8-232ec22de965", "value": "25831277DE87A28EC002723013782FE64B2C6B719971150A16B0747B2B6F9794CC7AD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218264, "uuid": "c5dc6436-9e51-4b5f-8f4d-4931c40d9628", "value": "1536:ZuRWAXdZ2rQD2aCv0yWxaqQ6Rxt5AB/aqPwL3VbCbS:Zg2QKDm/Qwt+awaxCbS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218264, "uuid": "5c2affc1-ecdb-40c8-9a16-b72ec8eadef9", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218264, "uuid": "e3538ee0-07cd-412b-a350-95baf22f9b29", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218264, "uuid": "a8f97431-40cc-4303-b2a0-92267c451bbb", "value": "catalog-1416842846.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d76492-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217683, "uuid": "e825c672-de4e-4545-ab54-dea192e73414", "comment": "Malware payload", "value": "20d1940422afdc3b8a3b044d015a3e48", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217683, "uuid": "d57f9153-ca9a-4b42-8223-35e21624043b", "comment": "Malware payload", "value": "36f104e2cc1c99d73f23db4c40501ba44b600ffa55037245501a0158b01ee51a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217683, "uuid": "28165de4-8b79-46e8-a9f6-51f45a3788d9", "comment": "Malware payload", "value": "c0e786303a02cdc9d5d2d6be9ca0ba2a9709efd0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217683, "uuid": "83b400aa-964d-4858-ad80-d59f2e011bdb", "comment": "Malware payload", "value": "d05062941b695aea7fccabf909669750f1fd937d5993d4c9a384c4f37ad5b0c2a9c659dc202a2f02961830e55b86cd96", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217683, "uuid": "7821b728-e2eb-4bde-aa68-ce4b4ad1ca08", "value": "F083028BB4D9433ACB3513F658AE5E0422B1A47F1408CADC79973B786B53672A472388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217683, "uuid": "761b0f70-c930-4d97-bd07-f75dac3c8937", "value": "1536:zAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJv0:zijtuPmU9j7+XFWtYe14hbOj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217683, "uuid": "a6f7f255-db26-485d-9635-cd9c92cb0379", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217683, "uuid": "3dc40bbd-dc1c-4861-a1bd-df6a91cc8b4c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217683, "uuid": "8279a945-6f02-49fe-9a33-7d7219734c12", "value": "catalog-1101177020.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2437ce6-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218371, "uuid": "450f6973-eca6-4b95-bc8e-af489456a99b", "comment": "Malware payload", "value": "14b9ede7aff166d5ad96bf8c64c9b597", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218371, "uuid": "fac62c1a-1e2a-401b-823b-9434560729de", "comment": "Malware payload", "value": "3706c61a8e153a69032fd56bcc0b19ba7f9e3098bf2ff164e46e14dd5cde2e75", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218371, "uuid": "3d5e0372-e19b-4d8a-84e3-9155e55237da", "comment": "Malware payload", "value": "334e0e8f1efc8e027976b504e812916d2d05d8e7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218371, "uuid": "899ba847-a3b9-4a3d-97a1-ebeec100695f", "comment": "Malware payload", "value": "f4d614f8311b2d80971b049b36ce82b2dea55774aa0a281f1ad70c14bb2c2e573d2dcc9c0da3ab5b7b1454292d13fed1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218371, "uuid": "c99a7b17-a783-447a-bc7b-d419289479a8", "value": "B98302ED3A16C666E2B19319CD3D88C533A2CEB8900EF0526C4F7F7A7D215AF9411634", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218371, "uuid": "c4ff9866-ea74-475b-a051-ed411bf7128f", "value": "1536:eRn2h1Uf0IbwZQ72ZTYzqcIcUjoB8+wXdpUna5ahL2dmTLUVVvv:eR2hsbG6IcuXinakEmEVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218371, "uuid": "b87bbaaf-4f40-4329-812e-bded8468a5f5", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218371, "uuid": "64e42189-4c56-4591-925b-510e25c39933", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218371, "uuid": "ae2993f3-f6fb-4d6c-8ba2-f28a2a223baa", "value": "catalog-1462989919.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8727b537-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217897, "uuid": "63f024ba-6837-4040-aef1-22652a6d3dc5", "comment": "Malware payload", "value": "977e13d336e375f29e26593857af34a8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217897, "uuid": "6944c7aa-5b48-4ea1-8641-302ca9c84976", "comment": "Malware payload", "value": "370ace036b3da482b85775132dec7907a7ac4c96787d9c274dc675ad7d84571c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217897, "uuid": "be6975a8-d971-4682-96e1-256700474915", "comment": "Malware payload", "value": "9eb3dfd1fa16dc9739de0cc4ca3b3b218bc0566f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217897, "uuid": "088b49cc-8328-4a4f-9820-abd4de2adad0", "comment": "Malware payload", "value": "9b4fc666cd18b0657de67bbef217b067acab145f44fa54cb914d92f74b5b8a42b6dc967c7898982cf18c9041d4940755", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217897, "uuid": "a8cc4c99-d880-434d-9b25-1bdea580a369", "value": "9F831277BA752DFC1922E930E128EB9E29FE2F43B164445DC67C143351422EE3ED42A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217897, "uuid": "a42e43a4-31cc-482f-8571-205fc9035f60", "value": "1536:YLeaAK6Vo+OWNqQaiwotTqFUAAWBO3SNZzTJAsB0Ic6DMADMt5zC/IDIz10K:sVAPobWxvtTqFKCNBJAIlcAGIz1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217897, "uuid": "78cfbc11-4dad-4cc5-b916-810e0571302d", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217897, "uuid": "0ee5ce74-ded1-4da0-a8b3-a72feb02d9a0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217897, "uuid": "74b8a758-a3fa-42e7-b05f-f0f06ac7c902", "value": "catalog-1227437547.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a3833f-a3f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1619157385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157385, "uuid": "bd905857-21a7-4411-9b53-8592f481085c", "comment": "Malware payload (BitRAT)", "value": "d94f97fb0f07e63481d8dfaa4f3f80a8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157385, "uuid": "ade5bd9c-597e-437a-a4f5-e5cbc027c363", "comment": "Malware payload (BitRAT)", "value": "37168d1f470d7c1dc33ef38c570a0bab4657e16a46c60dc88ac23e051dc6d849", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157385, "uuid": "ee5d6f67-1ead-405d-956c-0d6e14da8fea", "comment": "Malware payload (BitRAT)", "value": "b9cbce9188505d961435a5288d3c419fd231fd56", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157385, "uuid": "34488ab6-f32a-4bd7-8a42-82955f52837c", "comment": "Malware payload (BitRAT)", "value": "ec0e90c8c740c0a7828c3d521b9c66119b30f80d75d0ffe5755a6e81bb0df1de6ece9c95284817c86c22ffbc2cf7ad20", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157385, "uuid": "4b34d5de-6700-4949-b5e6-0af90a351844", "value": "B3953304EADEC808616A834A0876DF4364BCDE25E076D837BDD19B8B53EF5D5E0A5C0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157385, "uuid": "1d9dffca-ee8c-4cca-ae0d-955346c5124e", "value": "24576:6VNhI+VQsPAEwBniPb5uKlK7MwQO/iBJ1Pdui63x7iaV32KdY3mWAfKbi8QP+SCD:CietK7Lw1PZauksWtqQP+NEyOnxqtMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619157385, "uuid": "a85f28d3-45b7-468f-82da-ca4151c49769", "value": 1999022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619157385, "uuid": "785b6c5d-4dec-45a9-bd89-c8309b2bc4ae", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157385, "uuid": "c671c12e-28d0-4ccc-a49b-1a8af4e46c6c", "value": "Scan_Orderpdf23042021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0035aa78-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221965, "uuid": "00e4c922-3e64-4ce1-b652-ad14d904decb", "comment": "Malware payload", "value": "980d7f6663858635b550186a50d0c671", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221965, "uuid": "2094b939-beb0-4c03-bff3-90c6338ee480", "comment": "Malware payload", "value": "3719a998d6b8718196e97e0ad1447e9d1057312386f755d46203dd1b75f11ece", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221965, "uuid": "1053f119-946b-432b-b5f4-9d13bde3cdac", "comment": "Malware payload", "value": "5eed0df293efd8764deb808e7f3bf837fa28e071", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221965, "uuid": "ecdc89d3-8456-423b-9312-82a6f9b395d8", "comment": "Malware payload", "value": "b7f37f891a928d6766c91ffd0f3450dc8366e78c9cfc7946260c01fa40473228afdc50147f96d615b9104f9ac4564b07", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221965, "uuid": "07b978a6-6e3a-4384-b1b1-b235272f2f71", "value": "0883124D35EDC040E17F7D6053AAAD5901B86F4BEFFF9264CA6961329801963FA0368F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221965, "uuid": "69f60baa-b527-4442-85bc-427c49e557f6", "value": "1536:EwJNfD6jITxi7UnLkb/Yw3LCq1GeOuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbc:EwzOEliUne/L3LCq4kO6xoKDShicdBMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221965, "uuid": "6cd8dbce-b396-4e84-ad28-54727f322ae1", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221965, "uuid": "4da79975-d786-413b-814f-1b8f7bd6b2f2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221965, "uuid": "5d5123e6-2b25-4f2a-b96b-209ed00f3b6a", "value": "info-2018239948.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daaec724-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220614, "uuid": "b4dd35e1-f9a2-4dd0-a34f-07773f6e4f2b", "comment": "Malware payload", "value": "7dc841a872ab5ec5780ca601e5234e84", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220614, "uuid": "17cf221c-0b4b-46a3-8785-47e9ec4eba5b", "comment": "Malware payload", "value": "3726f4ae43b43bfe2972ecb048b0b43943ab52db16622bbcbd93126b1818c51f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220614, "uuid": "dd7c8a6a-ada4-4770-81a7-39c37949730c", "comment": "Malware payload", "value": "d7ed40716462b812c13ddd798e863ae821faf09d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220614, "uuid": "6130eb4c-a809-4854-8341-898247f6ba75", "comment": "Malware payload", "value": "882da3ba5e88891c2a5ea9d64fe2750e8923a3f72db43410ee3cf442af3f726a5dc1b941bfe08df06557a83ea5ef941a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220614, "uuid": "a92874fa-070b-419e-b3e7-54ad0522ff61", "value": "F383124D35EDC041E17F7D6053AAAD5901B86F4BEFFB9164CA6D61329801863EA0368F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220614, "uuid": "02e93f52-839b-4ec2-855e-3f7124abe9b7", "value": "1536:dwJNfD6jITxi7UnLkb/Yw3LCq1GeOuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbb:dwzOEliUne/L3LCq4kO6xoKDShicdBM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220614, "uuid": "2c105bd9-69c0-4b56-9c53-2a213deae655", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220614, "uuid": "96d4b523-cf5e-4300-b6b4-f4ecbfa69c42", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220614, "uuid": "80d83daa-644b-40bb-9752-8b5e6a3d4a8d", "value": "info-1272322874.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af6f229-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219836, "uuid": "4eabea0d-5afa-4ce7-af9c-f47e266708ad", "comment": "Malware payload", "value": "c454d0f4c4e774ec13ec1f7f8a958ca1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219836, "uuid": "8ffe6785-3146-454b-937d-70546659b6f3", "comment": "Malware payload", "value": "37670151dcc8d362eb13302786e6c76368cea31db19cb8b23dd1abed02a95a88", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219836, "uuid": "6bd225be-11a0-4b72-a042-cc8b6d8fbb0f", "comment": "Malware payload", "value": "88634795ef59c2b23ea213b21b20cd80097773e7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219836, "uuid": "c5e8f28e-ad06-4ef3-a02a-db39484462cf", "comment": "Malware payload", "value": "b5e7dbb2d0b04f131d38716369b5d94614c60f880684f942d13db7ac0930929f6aba3c4b34fc079eec33a2cfa3d89649", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219836, "uuid": "f2e33b02-e1e5-4d47-86b2-d959ffe5a89c", "value": "2E8302E58BDE8814C4019D0C7E39BDA57560692C700EF2E6BECF0B50BB5349AD1F2A75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219836, "uuid": "7babbbe7-567e-4997-bdf3-eceaca915c29", "value": "1536:+LYnBKjsMlbCIv4DhQ72ZTaNqhJXvoDLf+5ff9fuQjMCYNst+IHCkPLqkwD0DCuV:+LYZIvU7JXaL25NfuQjMCYNBw0tD0DCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219836, "uuid": "2344cb6f-2f31-4e19-bd60-d392e348b7c7", "value": 86930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219836, "uuid": "59dc9397-d331-45a7-a6fa-eef026f8b76d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219836, "uuid": "83e59590-582a-4111-a060-01833bfd4f2f", "value": "catalog-368492467.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2675c73-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217996, "uuid": "460b3a42-96cb-49fe-8237-26e9b106be8f", "comment": "Malware payload", "value": "74d0a23c3fd6fff8e966d1e81e3762b4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217996, "uuid": "ac9b9a36-d673-4ec3-9457-1bfd74a3492a", "comment": "Malware payload", "value": "379bd46c8dc1bb9349007a9e729b6721210d43c9c456494e89efb302420470f9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217996, "uuid": "8132c0dc-9a9f-418e-aa60-15f86d20ed02", "comment": "Malware payload", "value": "304981163de26aee79529657ec93ffed8fe27670", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217996, "uuid": "94989488-afa7-4996-843c-43afce3b8a9a", "comment": "Malware payload", "value": "ab0ac98a2ed96e8e641996aa7f6054d36bf4ac7fcc7852d80c3184555b271f6673596827a2905a1b4bb8291e40c06245", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217996, "uuid": "62c2f867-11cb-4639-b7ed-6dc5243f45e9", "value": "978302EC70238AA6637345A6DD7E90D32B6A8BBC441DB056A82A693649307FFE121531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217996, "uuid": "fcbea050-f16b-4fe8-b774-3226f15802eb", "value": "1536:lzKTWDE4Qgl8LS4v50FC+p7UjoB8+wXdpUna5ahL2dmTLUVVv3:leKDPKLRvaFjp7uXinakEmEV9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217996, "uuid": "9d70ec04-b815-4dfa-9f22-c17623e95bed", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217996, "uuid": "2c730f8e-a30d-49de-b802-d00943fad9a4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217996, "uuid": "e9267444-7f26-4f5d-b20b-4f5fd24ffc32", "value": "catalog-1279037041.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f53ba2-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221780, "uuid": "0e284000-c76d-4d56-a5ad-aca2a1b27fd0", "comment": "Malware payload", "value": "ffb2826404d354df8d0105377a62225a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221780, "uuid": "c8fe0bc9-4a9f-42cb-a998-00b89b8a7d38", "comment": "Malware payload", "value": "37f7f935a561572c89c6580aa8c113054eb319d6e9e2bd87a648d16868c22b02", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221780, "uuid": "6df7bf56-b569-41b8-89a3-256b758433fa", "comment": "Malware payload", "value": "39335793db67e494dcfa1215f88fea35ffcd6415", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221780, "uuid": "55e1cc32-2fba-4a1e-bc88-4f2ec0af47d0", "comment": "Malware payload", "value": "50086ca2695c8dcea18beba2273e975fd2e2413918aa3d8b747bdd64fc1fab931d45aef271ac1d108b61d163a294c5cb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221780, "uuid": "84118618-d187-4c22-ab17-1d756ad0a380", "value": "488302CE31EE01486A7B386470B7F54B50FC5F5B7D73B6288230A570EA114B57A126AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221780, "uuid": "949e6a5d-eeaf-4e13-922c-06b70a7e2620", "value": "1536:UwJNfDtI/W4UgUlrZKFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbXYZTa4hpT:UwzpIpUhlrZ6O6xoKDShicdBMM1/XPQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221780, "uuid": "230df6ef-4a9b-4de7-9379-70f3b6f6fb3a", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221780, "uuid": "606437d7-424d-4694-8c76-f626f7387549", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221780, "uuid": "dc510b63-9793-46da-883c-b633d587da58", "value": "info-1874438054.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0723d649-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218970, "uuid": "7a7acd0c-27b0-4b5f-b0db-bf3651bd19d4", "comment": "Malware payload", "value": "d30092edc8e278d6fbf105edd4982963", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218970, "uuid": "6b082229-d7f4-411a-9f2e-ef14c1ea90e4", "comment": "Malware payload", "value": "37fb1e3ebfb27bc04d8ac73e3b7efb04f4bafed335807c1488c184875e6179e0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218970, "uuid": "9e262087-d7ea-4fcc-8f10-6d62e009b53f", "comment": "Malware payload", "value": "b9e1a16569b134e9aeea2548d7837a9c10059b26", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218970, "uuid": "badfda40-e09f-4104-951a-1a87e04df68f", "comment": "Malware payload", "value": "cbe3f9e164772244fd1ffb52988f7f8bc0d1def9fc972f5d62f4a00ee266cd0ac68a8f3a92931c9bdd87bf90a5e31e3f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218970, "uuid": "198ad4bd-5134-4d67-b1e4-5a33029f8025", "value": "B3831277DE87628EC102723013782FE64B2C6B325A61150A1774747F2B6B9698CC6FD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218970, "uuid": "87e655cd-9368-465d-9db3-ce43fcbb9001", "value": "1536:3uxWAXdZ2rQD2aCvdyWxaqQ6Rxt5AB/aqPwL3VbCbM:3A2QKmm/Qwt+awaxCbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218970, "uuid": "e9012b96-42e4-4906-8556-ea5d4e8672c5", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218970, "uuid": "ff35ec00-4071-4bdf-87c0-68d570bf2dbf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218970, "uuid": "679eb715-2e70-4412-9027-3d1ce0e9c1cd", "value": "catalog-1816773969.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bff72bf-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221153, "uuid": "ed88d2b2-d54e-41ed-8dbb-5814ae370b12", "comment": "Malware payload", "value": "9534109600f84bbd38b2adc2b628410e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221153, "uuid": "6afc1b32-5dee-4d21-8f54-cf8b1f229a9c", "comment": "Malware payload", "value": "381267587dff0006c054a79ae347ea93468e5f32c0a8bbcaf9e32a4d23f4f114", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221153, "uuid": "2f09e480-9661-4bc0-a14e-33ef6930fd94", "comment": "Malware payload", "value": "d3b978ad60059c985692dacd8e4e4c980ee1f77e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221153, "uuid": "f77872b0-f216-4345-a6a1-48e278462d00", "comment": "Malware payload", "value": "993ac3bc720dd8144395f406572bd76423be3a89311799d80db392ccb838b113fc989cb24e6693f462ce9a18ef63f4c1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221153, "uuid": "5668dd36-7c02-4bea-a938-afd0edca5a1b", "value": "38830277369DC6FEC14EF05E606FF1BDF055A91E8E2EE614A7B428103837429A41067C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221153, "uuid": "627d7209-763f-47c6-813f-6d88ae22bf28", "value": "1536:+vwJNfD6jITxi7z9ZvjL3+xnxv5ZUSzhhcBrasoi8vQMwdjV46CTi:+vwzOEliRZP3+9xv/UGDmrajvIM6CTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221153, "uuid": "c00a43a7-6288-425f-8765-20e1f30c8a69", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221153, "uuid": "67f19f40-3fdb-4ab4-848e-b12a41857109", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221153, "uuid": "35c985f6-d464-43b4-b611-21ab87b8ced4", "value": "info-151316855.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8060d277-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220462, "uuid": "fbc4dc98-bd3b-40ba-a37f-a40627270c1f", "comment": "Malware payload", "value": "27adeb16d9852a1e843ec11711e8b5db", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220462, "uuid": "2866ebe1-6523-4ee8-a422-f33c1f351af3", "comment": "Malware payload", "value": "385b49810af327179212d4722f9b8cfebf84e11445ccb55b2a5f65cf7ef2ea0b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220462, "uuid": "3f7875f2-dc0d-416e-a598-2a8b927c9644", "comment": "Malware payload", "value": "ae021b0eddd90454871c58e30b04e28fa19464ce", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220462, "uuid": "c5930932-dd79-4143-8ee2-da1e428311b9", "comment": "Malware payload", "value": "971835ec7f1eee1a6d837a412b215c33dac817be0bed2ff5d4c17917df31db27b4ef5eecc0f777ed81cc8e4465f80dce", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220462, "uuid": "9b5733bc-12ed-4af6-8dd0-3f130fe96875", "value": "BE830215A4BC86A780F315A22A307BC78AD0EB97984DC043F1348E27E4E6B65857BF5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220462, "uuid": "91508a7f-6954-48db-8984-a62c43dfac53", "value": "1536:Qt1QVGeGug5dwSp6yMvBjqqxM5Y2VXw1QFsrGq9ZMlmZQTQdi:IAG7u8l3MvBjqqqXw6Af5di", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220462, "uuid": "69e4170e-78b9-48dd-aa91-18eaf3d4d3ac", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220462, "uuid": "589b54a0-e41b-47b3-845e-b05c05321f00", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220462, "uuid": "30bd02c6-5838-41d9-9dc7-aed9fcda76fe", "value": "info-1176740806.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd8a679-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219840, "uuid": "3de6dada-c30c-49ce-bff8-cf89e80f1a03", "comment": "Malware payload", "value": "db5d63211fdf2cbd257f38efa1e4ad87", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219840, "uuid": "c7ab362e-d77d-44fa-9851-87248aab9798", "comment": "Malware payload", "value": "3865442cdc228197d00921262920e433766c8f18576f2c0aa2c91fd0553c18f1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219840, "uuid": "33fbacbf-6fce-4843-874d-3520012bcb19", "comment": "Malware payload", "value": "265b3354888aac9b83ccfbcc0422ad42f3aa590c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219840, "uuid": "a673497e-9562-45e6-9184-6a8fd1dd1d87", "comment": "Malware payload", "value": "af774cf6d2786f8432de4d513faf88cd432b69d84fb0ded2ecf0779325f45bbb8cccf0f056a24038829401bbf58f57a1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219840, "uuid": "34f0aef9-603c-4acc-b04f-958db4200456", "value": "D98302E9654236BEC8FD951D206F3D402EACB2E56E2212E7D207D93770F6AA894D0718", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219840, "uuid": "7b1a329d-d022-4ac3-87bb-5848b7c5e9b3", "value": "1536:4F5u1k94TfvqBuKXxLG1ZQUcDwiFALqCJI3+xOtGkwdO2eDiFXH:4F5fsvaXxLG1ZQUcD1FALAOxeh4ONqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219840, "uuid": "399dee6f-9eb0-4536-a0bd-04e753307cf5", "value": 86930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219840, "uuid": "488eb9e0-6a32-47e6-82e1-ef6cf9d959be", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219840, "uuid": "f4825905-b398-41d9-919a-21211e9177d7", "value": "catalog-373941401.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34cd0a36-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220335, "uuid": "7cf781c7-9a9a-401a-8f8a-32aeef51031d", "comment": "Malware payload", "value": "5cbb80118da7fcf342601dcb7d3f7104", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220335, "uuid": "f68885c2-f0bd-429a-87dc-5c56e5dc032d", "comment": "Malware payload", "value": "389a5ea24d356341f19221fe0e667011aceebdbde04318b0aa48cde153fcff6d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220335, "uuid": "5eb77a26-4cd9-4a98-b008-1c6fb2b16a36", "comment": "Malware payload", "value": "5e6f3d917fab3a2b98225b817c6a11784bacd4a9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220335, "uuid": "bfab0688-5a43-43f1-8ec8-e44946bfdb81", "comment": "Malware payload", "value": "2bf7261a8817341955750c82102cb0dfbd704d4811eb0a5c632b35ce2129325afdda8ce06eb5c77a95110f21b641ed9d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220335, "uuid": "e9f554dd-b4a2-4fbf-8065-eb365a015c70", "value": "AC8302E6EC77CC1D818E92F1403F6E246BB464C5A4B8E356E91B7E09DC66DC91D0882F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220335, "uuid": "9adb0138-0a75-4e83-bc94-8a96194dcb84", "value": "1536:pxKzlSo7mgV3eG17lbkCOUT7oqlaHvvbFq9GHocnoe1RqfwSOJrpMEIpz2Pn:pxKzlSoSCn12COUT7o/v096oiBkwPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220335, "uuid": "10ad926f-338a-47f8-8043-4ec5a086c346", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220335, "uuid": "a8e91bac-57d9-440e-862a-b8e64c3674bd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220335, "uuid": "29d9757b-af46-475f-ac30-9f235f2c711a", "value": "info-1094385239.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0bfd63b-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221885, "uuid": "90271ae2-9924-4175-9a0b-be1e23dc7281", "comment": "Malware payload", "value": "ffa8365e2193524f7855452e320adce8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221885, "uuid": "7c63619f-0a2b-4eb6-9382-c6727e4f0839", "comment": "Malware payload", "value": "38a8d50cb3894d4e0f020049767c5fe351e1275ef71cd07cfad0f35ecb8ad4a4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221885, "uuid": "73f4e04d-6bde-4b03-891a-e3e67973661f", "comment": "Malware payload", "value": "0f10e3507ef7857248678b4f5e0857191cb15186", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221885, "uuid": "3f2ebae4-89be-41f9-981c-bb37e0ab6c7f", "comment": "Malware payload", "value": "ceee03f8c8c684948b7773b0a53640d313f5aeebb0fc9106b0f47917e80c407e29857561e2c88bc4535d563a60609ed3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221885, "uuid": "14a44c14-a75c-4f50-9f22-c7f99d97fbfe", "value": "468302B7321D0BEF904AB89B50DFF5F9F155693E5D2EE510B3642D20313143AA411EAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221885, "uuid": "88f3bbc9-6a40-4050-93db-1927643f7611", "value": "1536:hHQBAV8QI/AATZvjL3+xnxv5ZUSzhhcBrasoi8vQMwdjV46CTa:h18QI4AZP3+9xv/UGDmrajvIM6CTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221885, "uuid": "92970fc5-90f1-461f-88ec-fa861a678702", "value": 86795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221885, "uuid": "8c15569d-8d25-42c8-a2dd-bcdcfc010e62", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221885, "uuid": "6f7dfc3a-e518-4f57-905a-16f113d30536", "value": "info-1944861409.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827db7e6-a447-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1619191260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619191260, "uuid": "9f54f096-7552-47f0-8cdc-a9efac6da7b6", "comment": "Malware payload (BitRAT)", "value": "3637510bbd489ee4bae39f8c603a07d0", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619191260, "uuid": "79c878cc-faf6-4071-958e-57609567898a", "comment": "Malware payload (BitRAT)", "value": "38c91081f6d55ec69c142d571b35538d8db4509866de7fa6ea46836e2db4087b", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619191260, "uuid": "f7e8c41d-028a-42cf-92f5-a870494c7b51", "comment": "Malware payload (BitRAT)", "value": "425521e9d39f868ff96be8f9b54543583f0803db", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619191260, "uuid": "8c1285f7-10eb-4946-aac3-bf480a69912d", "comment": "Malware payload (BitRAT)", "value": "ac648cfdae5830d75f81bc095d9b7c4f8a4f052ee52251001ddc394c15e07b3d1e2e4a7f918b97a7c1055b4d22ed00c9", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619191260, "uuid": "1623d726-0938-4ea7-a40d-fcc5ad340f41", "value": "2106BF02FA42C562D2170230AA6E77BE057CF5344B2085C3B3946E6859B66D17B3BF7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619191260, "uuid": "a25cec18-bd37-4344-a554-54824c6de343", "value": "71955ccbbcbb24efa9f89785e7cce225", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619191260, "uuid": "0ec57855-713f-466b-9e7e-422b3cfe88a4", "value": "98304:qtY1Lbh9UZaSLvdgccGLJT6y8kv6EE7kd:pj+Zzlgccp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619191260, "uuid": "bce03ec1-89ea-4707-af30-993c260f56c1", "value": 3942400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619191260, "uuid": "e11252b7-f598-490e-9a60-0a669771bce9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619191260, "uuid": "4c1e643b-fe22-4697-aa84-a1f676cf3812", "value": "3637510BBD489EE4BAE39F8C603A07D0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c79a9b-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219605, "uuid": "663b54af-16dc-4ebe-a224-e86f5374578b", "comment": "Malware payload", "value": "19d77ba0ce184a6888ac5fe890463238", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219605, "uuid": "35481eab-cf44-4a19-bc94-e55eea7434a1", "comment": "Malware payload", "value": "38d69c07703987e365280d7d89e5d9829187ce47616849acc49c05b00167a34c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219605, "uuid": "a0cc2432-a709-4b4b-85b0-097df65e8609", "comment": "Malware payload", "value": "2e92d07719bb4fad3e0047433cf36b88e189b511", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219605, "uuid": "8398222a-869b-420b-b550-9db2df00fc45", "comment": "Malware payload", "value": "326cb4f0113a596caddfb80da193582d397435da4e0298c68aa7ab5f646081d94bfd97ee9557bfbcc878af06a6b1aade", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219605, "uuid": "08a19d23-be4e-4ee1-b771-fb87af605151", "value": "7E8302EC70238A66637345A6DD7D90C32B5B8BBC441DB096A82A793649307FFE111531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219605, "uuid": "5fa2f01d-d7ab-4ebf-b081-d89bfdcd1618", "value": "1536:WzKTWDE4Qgl8LS4v50FC+p7UjoB8+wXdpUna5ahL2dmTLUVVvG:WeKDPKLRvaFjp7uXinakEmEVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219605, "uuid": "001ab7be-d4ba-4341-90e2-c8ed4deb3d00", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219605, "uuid": "cd865486-4089-4486-a026-4f9299bcd208", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219605, "uuid": "1fc145f4-9a48-4468-a1f9-c03ab90c025a", "value": "catalog-232003482.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd82e586-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218471, "uuid": "ca8a612a-7688-4a07-b4ef-35eec656a893", "comment": "Malware payload", "value": "1291b6bf5bea5b3ca542b3f2c4636903", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218471, "uuid": "9be8df11-f3ea-4afa-9ce9-442853ce3372", "comment": "Malware payload", "value": "38e1ae63144b0523dd2faef1249af46af28ef4e26d146428c9e4924d5c62763d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218471, "uuid": "87773efb-a000-4690-8ec2-cfb06e33574c", "comment": "Malware payload", "value": "cefc1c052f61043b23f1e126496d2b7dd0d4e7b2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218471, "uuid": "b2966dc5-4eb2-4d5b-a850-adfff8683106", "comment": "Malware payload", "value": "9b1b832be53e5d78d7cf30060e4ff711529f96c75329c59642d6760408fc3ea33049ffd9236a3be3bf3580b448fc870b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218471, "uuid": "21f7d8d3-5e65-4da5-804e-6b66cc6de61f", "value": "948302CBB4E9433DCF3527B748AF1E046261A43F440886EC75D73BB86B426B26576389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218471, "uuid": "c01feaa4-7eaa-4dc4-be88-87f6b5f7857d", "value": "1536:gXAfNtg2tf2vCapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvR:aijtt2v7mU9j7+XFWtYe14hbOj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218471, "uuid": "d3cf6000-9b09-4e37-8f3e-ee56b322a3b1", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218471, "uuid": "152f7027-2ad3-4a0d-8705-bbe82b8033a1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218471, "uuid": "d7e482d4-9a34-4ca5-bab8-1ac6784665e0", "value": "catalog-1519062961.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69287357-a422-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619175326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619175326, "uuid": "5092556c-800d-49a4-8f70-ecc1004e0599", "comment": "Malware payload (AgentTesla)", "value": "66ebd4caf5c1aca882796f5b5fca9fab", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619175326, "uuid": "82658951-d658-46fe-8ada-894df1f7106b", "comment": "Malware payload (AgentTesla)", "value": "39331dd757cced7aa1668d6f313f91b1f951d1ad0a33a94ed4023c746a530e2b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619175326, "uuid": "99f91a63-f8c5-47ba-9488-8d0afa05304a", "comment": "Malware payload (AgentTesla)", "value": "e085e11516e630229c3598171115cdade1e70579", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619175326, "uuid": "cd20e4b5-5579-43a4-8e78-fcdad7c3f985", "comment": "Malware payload (AgentTesla)", "value": "65d7abfbb6621b78cd020b2a24ab269b3d12fafa1781ef4abd74169bae3e059f8a78d0aa8bad0f86d45f2802276af3c1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619175326, "uuid": "ab5cd324-78c9-4f58-a607-9a941ba2b193", "value": "29C42312589CB2A5604EED4AE7344175BE0C999630315762BDC5EC2EAC4E28CE7CE73F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619175326, "uuid": "bd9f12bb-b254-480c-9179-1e9bb7f655ff", "value": "12288:5BV1xde0Eoy1eceVrIMQsUn5WQFd995RynIP2dievwXtQ8Y0R9Gn9Q+v:Fde05jtFIUU5WQFd7XynIP2dIupvD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619175326, "uuid": "d9eace50-46ce-40a9-a591-f354b0d3de1c", "value": 551232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619175326, "uuid": "13004f3d-0762-499e-87a2-d9a60c532c48", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619175326, "uuid": "6fc60b53-cb2d-41f2-9d85-edec67627053", "value": "_FOODING GROUP LIMITED BEST OFFER.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "345f51e2-a3f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619157199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157199, "uuid": "c98216de-2e6c-4a61-8859-4fe1a0bb1dca", "comment": "Malware payload (AgentTesla)", "value": "339ff89cc7037738730b40061f3c2390", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157199, "uuid": "0c294db1-1e3e-456d-958c-6ef6d680d0e1", "comment": "Malware payload (AgentTesla)", "value": "395134c2f545e2eb9a07fc2fd91a89084baff766973628ef2cf9f0cc489dc4e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157199, "uuid": "685fc407-beca-4b51-9ce6-90de463d9ba8", "comment": "Malware payload (AgentTesla)", "value": "bb9de507bd97bd617a86ed07afb5a55b94d77575", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157199, "uuid": "c7ef671f-0d64-4cea-85af-acf411813cbd", "comment": "Malware payload (AgentTesla)", "value": "a1c4d8bd721d93a584e5e25897ce53b38d2c803e7db2a4506e3ae97e10ce67fa5c8f826ae38d889b46f805df74c8a39f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157199, "uuid": "479d6f19-b73c-4cda-b7cb-a0b1fd8ca53e", "value": "F615D0813184DC9BD55718F2A8AFD0A052B46D9F8164DB4D3F83BE6B64EB342205B74F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157199, "uuid": "e3c9f8ad-f9aa-45db-9929-2ff6417defcd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157199, "uuid": "0c963a34-273c-4f87-b425-37e6cfd2e40d", "value": "12288:RYF5iJHAbZ+0+yNL6UTxxGhhL7WFybXsHTdJ/zcUwkbGBacsdrFOjC1sWTi8CCSj:uF5qHAMy4YxVybmJ/zc8QgJeGsqfd8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619157199, "uuid": "91f380b2-367d-41e1-a86b-be439ae87f1a", "value": 934400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619157199, "uuid": "3951654e-503b-4286-a92b-1166c0c8acea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157199, "uuid": "689388a9-9c2a-4eed-b678-bfb03efdccd5", "value": "PO#ODER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f4a7f1-a484-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217359, "uuid": "03eabe37-28fa-473c-99b5-781747b203b0", "comment": "Malware payload", "value": "4f719dd6324d10510ae6a6fdc0397f47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217359, "uuid": "c0095f57-cc8d-4a01-ad7c-a2e680577a8f", "comment": "Malware payload", "value": "39611c8ec0601b51a40450cf8c4258456c487cf0eb18665f8ff04ab64c6ff014", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217359, "uuid": "3318cb28-17dd-4394-af20-1f88fffa4f2e", "comment": "Malware payload", "value": "0c216a1c3658a82674d38329ee2840fb23665a5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217359, "uuid": "42458610-ab93-44ae-b7ab-e6038083dd63", "comment": "Malware payload", "value": "caeeb06fb9eaa4a8e9d70e8e6a196f8a692a7d1b0dc0b6363166f626e67c78612a92fe0030495deb08691d1bbd99cf18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217359, "uuid": "128c280d-1970-490b-aa89-8e64a0bf11e6", "value": "57831277DE8B624EC002723013782FE64B2C6B329A61050A1770747F2B6B9698CC6FD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217359, "uuid": "33fb5289-a904-4643-9b23-8dd8399b58b1", "value": "1536:MuxWAXdZ2rQD2aCvdyWxaqQ6Rxt5AB/aqPwL3VbCbU:MA2QKmm/Qwt+awaxCbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217359, "uuid": "ce3580a6-b974-4be4-9731-cf2fc30fb7e9", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217359, "uuid": "cdb11ea8-b5d7-40ac-8894-4451da97969a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217359, "uuid": "26a2ecae-2cd0-4f80-9a44-b38772544f0b", "value": "catalog-1010774804.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb511a1-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222283, "uuid": "2e73fad7-c7e8-46b7-aa31-0dbe672d346b", "comment": "Malware payload", "value": "3dafca6cf7cd8310853c658b662d0d4c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222283, "uuid": "c3abba3e-986e-4a4c-8d3e-c6e136c26694", "comment": "Malware payload", "value": "39661d92f80a9b8d2413326e2545e8e01d19c4e89358afbfe65b9e0e097c55d3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222283, "uuid": "4b1fbc34-b332-46cf-9986-b4b8311f2577", "comment": "Malware payload", "value": "d21bf1f3f424abbfc6ba12ca4febb1042f7ef001", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222283, "uuid": "5bf1343b-5305-4870-bbab-50687e9fd422", "comment": "Malware payload", "value": "10739be4677acf57c83775c7ca9895806a0b39d1d18baae5fd3976add3d4723a9cbeff49ea6618def7efd5977b85c8c7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222283, "uuid": "0737885e-cb11-4c7b-a2ee-12c1bb35c40d", "value": "F883124D35EDC040E27F7D6053AAED5901B86F4BEFFF9164CA6961329901863FA0368E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222283, "uuid": "91e7f531-db31-4caf-b088-2c939b4d7b5b", "value": "1536:hKwJNfD6jITxi7UnLkb/Yw3LCq1GeOuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzf:hKwzOEliUne/L3LCq4kO6xoKDShicdBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222283, "uuid": "87a3da94-9238-44c5-95b0-554a4084856b", "value": 86795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222283, "uuid": "f0dd509a-a4d6-4967-90d3-a69ea6172a86", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222283, "uuid": "0c05c623-c548-492b-8e59-f3ec3ef798f7", "value": "info-304924571.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8daea57f-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221773, "uuid": "a71634bf-156f-4676-8c6e-8eb7388d9e47", "comment": "Malware payload", "value": "bc139e7355cc72e41100a43bb3fd0502", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221773, "uuid": "0d7e7bc5-7c4e-4d47-a36f-9b854f02524e", "comment": "Malware payload", "value": "39b29fdf2923778ffa1c5232fe1503309600a0b8fb3ea3527158653754c97c13", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221773, "uuid": "a7a38ffe-33ed-4ea2-8caf-d656ee9c37e7", "comment": "Malware payload", "value": "8380f0417609081c9f5d45cdf7fa74f7d44c0ce4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221773, "uuid": "cf5be458-4b94-4ffa-aba6-cd1dc297d5d2", "comment": "Malware payload", "value": "0a9f9a391505c99ec093108131c060d753e02749b204d6c0d455d51d5553db07ea3563ee1c7b4b36a6f2998c5dc57a19", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221773, "uuid": "480ae74f-a831-437e-b7f5-2f6f5f732a31", "value": "828302F12CEE15BA83896676A07D1603CC9C1FE016686F9B631112283EB1CDFC43B676", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221773, "uuid": "538f9ccc-f824-4f1d-8fdf-487d9fd113a0", "value": "1536:+r7l+KIkejUgUlrZcCWb/bLCDxxp/ERd9QnGlRTH7qrelcs:U7l+9UhlrZcnfLMZERQnGnTHMer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221773, "uuid": "378525a1-db81-4f02-91c5-c5d851a5f928", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221773, "uuid": "b313092f-0576-44a9-a73d-8b0a95b6e29b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221773, "uuid": "8a1ce773-d2d0-421f-8ec7-c841ac868c44", "value": "info-1870644668.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb3e4a8f-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221876, "uuid": "36c30b02-5339-40e3-a778-535cd8f57fe7", "comment": "Malware payload", "value": "8ec3fd7d17eccae0c85942a9495b1a1e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221876, "uuid": "3a9fe392-a7ce-41ad-8c17-b4256ecfd4b2", "comment": "Malware payload", "value": "39e1dc64f93ec4b6497d5ee0aa55a0bebfe0a5a879fd9c499f0155487b42d298", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221876, "uuid": "6d2c754c-fe77-495b-adf3-a6e90e5ecc6a", "comment": "Malware payload", "value": "6cd33bde5aedcda08b5f0ea85fb51e661db236f1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221876, "uuid": "c945abb2-b616-43f0-b895-9ba91cb137ee", "comment": "Malware payload", "value": "40b53c05ac3c896ba88eba5d9542cd62f006ba0a9b18921dcaa92c773abab6e20f8ee0c21fa72159b0fdb94667645bbb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221876, "uuid": "6a97dc96-26e6-42d8-97f0-232504a0e8da", "value": "DC831209A0BD4FE890E21D813D347A8BCAF4EFD229869443F1345B6795B1F364179E2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221876, "uuid": "ff882b0f-6c51-49c3-9393-8aa7fe9b0fe8", "value": "1536:fqHyJmpq7rWVy+qBDkq7M5Y2VXw1QFsrGq9ZMlmZQTQdK:iQmceVy+qBDkqUXw6Af5dK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221876, "uuid": "447f52b6-c377-4358-8198-481d6a4be884", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221876, "uuid": "c06e5d4b-0141-479f-9155-7d57c2bc106b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221876, "uuid": "a4f93871-84fe-4a68-802e-203f5d9cbcb5", "value": "info-1942263200.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79fe72f8-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221740, "uuid": "9dc734c6-c3ac-4ea7-8efb-452fcf66d4c5", "comment": "Malware payload", "value": "54c946b6d88a2c109a1ed8a30c50b2ca", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221740, "uuid": "371190f7-9ce6-4c6f-8fb8-9a3a337ff23f", "comment": "Malware payload", "value": "3a40a215f32dc9f9b2f775d29231265fd4d7f5e676d35e62572c667accf8d1d1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221740, "uuid": "f5fabab9-3120-49dd-af57-11142ddeb946", "comment": "Malware payload", "value": "5b47add8549cec63551601ac475c77cbb9e385e4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221740, "uuid": "b8c26033-eb09-44bf-84ff-0c949c2af6a0", "comment": "Malware payload", "value": "af52f352deee5e813f8a1abdbf8b32ec840ff5ead4caf327044276ce170c4bc64417f9e42417b71099d87e75d0106822", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221740, "uuid": "a5f1541d-4ce1-4e9d-9789-c3df716bf19b", "value": "6283121699BD1CDDC0AB13F00D73084D4860EF6D405C844AE11AEA8F78AEE95DEB7DE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221740, "uuid": "a9b2a678-22b1-4224-9ca4-15595a65dcec", "value": "1536:nZ1QVGeGig5dwSp6yMvBjqq1PGLuhCWdHsh1oSFWsfEFhHqLWd:nPAG7i8l3MvBjqqdOsZdHAO5hKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221740, "uuid": "9c0fde4c-df94-4207-b871-44183a2a2019", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221740, "uuid": "37a9c286-81dd-4b8a-8edf-c0f81fa6cf25", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221740, "uuid": "05117032-1e45-411a-80db-8bdb83370bc5", "value": "info-1849304141.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94596345-a42d-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1619180123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619180123, "uuid": "e29462bb-12b7-42c7-80ac-bb7152942139", "comment": "Malware payload (GuLoader)", "value": "4b7687321980c96093c8e6a43b764728", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619180123, "uuid": "86decfe9-57aa-42e2-91f4-b0e351e3f1f9", "comment": "Malware payload (GuLoader)", "value": "3a51813adeabd17d4939280137288152b2a3f25f7bf9e738c8f25df5ef49be31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619180123, "uuid": "5f44d6fb-2878-4844-bc9b-a35a77fbf516", "comment": "Malware payload (GuLoader)", "value": "5e27cc0eddb8646e26b72a7ff4f608df45c0eb8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619180123, "uuid": "38c73c98-7925-45b2-bc95-42bfc7460121", "comment": "Malware payload (GuLoader)", "value": "1bd3495ba12abccfbd27936dc4db1d90b8ef89910083672b3ea5ec1fd13ed3756189e9ca3f2ffc248381ba2d44e4d318", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619180123, "uuid": "345fc8f7-498e-4f28-af92-6d52c47510ce", "value": "C9A34B7A3740F43DE14AC5BDABD802B860DA6CB45748850FD082290F2BB97F466767A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619180123, "uuid": "2c8ed7a2-16c5-4f3c-bfd9-fd0f39cbfc36", "value": "f401ad1c560f85eb5aae8e91f258deba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619180123, "uuid": "64c84077-8e26-475a-b586-15e3693d5a03", "value": "768:kd2uNErYGMJDKf0aJxvOlu/ir5SGM7YMTdxIXX5ewWYOW75CZ8ZngsCBf1lC8Ym1:nd6VivjvO3IYCdxmL5rnGf1l/Ymas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619180123, "uuid": "b5554719-57cc-4caa-9da6-ae64c84c4fdf", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619180123, "uuid": "335323f4-f395-4d6c-a622-b464a4887280", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619180123, "uuid": "62c94d27-33c1-4736-9c7c-338aff3b6d9f", "value": "4b7687321980c96093c8e6a43b764728.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6641b25-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220526, "uuid": "4ab8f440-b657-47fb-9bed-37624c228303", "comment": "Malware payload", "value": "7110140fef02ddcf12ec5f3e6550d3a3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220526, "uuid": "4657f6af-d21f-4cfb-baa1-1d5dde92991a", "comment": "Malware payload", "value": "3ac6255116d767824c5e1a3dd077ec43a6b3da50c22809e6a8343ead2b5017e1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220526, "uuid": "0e813ab8-ead7-4cb8-9a0a-7f5420c6e761", "comment": "Malware payload", "value": "8d500e6b8bc1cc4f9b2e84760fea229b2ca001d9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220526, "uuid": "fe45fe5d-c7a2-4278-9b45-fad2dd25b5a9", "comment": "Malware payload", "value": "267df4e72b31833eb60da52a0cab361bff8f282dee32c555e07cb0f3daa0d51d9571fef9c04a1e49a803fc3b4edd50d4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220526, "uuid": "6fb5cb67-7721-456a-9c0f-ec6c98b9fc8f", "value": "EF83120B996168FDE16ABF01273DD4CFAA4ECBE1E53509C1F20E7F65D2A3359225440B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220526, "uuid": "f268a0eb-24d8-4d56-9d9c-e8aeac021039", "value": "1536:qHZbN5m6RtLlLHfAkZ8kISNq7xWgwMQZ2197v7UZoctQ2kPo+4mpRlDi1nUSUqxi:uBm6XLFHfA210wI19T7YptKRNpoUSUqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220526, "uuid": "0511156a-ed92-4224-82f0-26f0e03c546b", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220526, "uuid": "e356bdbf-e87a-46dd-b168-1611db3cd203", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220526, "uuid": "48d269d7-baac-4d5e-bf7e-df532c1795bb", "value": "info-1222959070.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60dd4a40-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217832, "uuid": "c0338e94-6a82-419b-b111-dcbec94e1c9e", "comment": "Malware payload", "value": "aed7648d343e37e19e7ccd1327c24892", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217832, "uuid": "b6db7527-69a0-4d2a-836f-ba5f9662dc0f", "comment": "Malware payload", "value": "3aec01372bdc64ed3e0f0c9cd666a8c06ab3cba07caef310e21978ae630c6086", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217832, "uuid": "ec92028d-25d6-4646-aa39-fbfadc4c4628", "comment": "Malware payload", "value": "4a6806c529724fb268fdeb836af86e3591bdca2b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217832, "uuid": "4a55deb9-057f-4bc4-b4eb-e071c9e0cb8b", "comment": "Malware payload", "value": "40e827c969b88debdc108ecc2b8d200b4045cf53bb81bf840f85e43a9f81d54ee787da2fd64fd1ddf04c2779b7c56b96", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217832, "uuid": "b7880dd1-ace7-407a-8fb1-3c2e1dc26a9e", "value": "F08312595B1B7DA7505F3CF21B322A5ABA03BABE0C0C7496CB78C2C0E73995E25642D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217832, "uuid": "bb87d553-b384-47bf-951f-c09c65609688", "value": "1536:df1lwtMJDrsPSpV8LS4v5YFGrfZg6kxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXy:FcQ8PjLRv2FKeJ9a03fjwe1moYpov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217832, "uuid": "fab61380-59e0-4eb3-8bec-ad802b02789f", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217832, "uuid": "70804563-4d5a-4767-a5ed-b3b8c6ba262c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217832, "uuid": "a299151b-a60b-44df-b937-8e93157ad9a1", "value": "catalog-1188132908.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a94238c6-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217954, "uuid": "75d2b99d-5e8d-4ccd-9a2e-3c03b4a4c448", "comment": "Malware payload", "value": "b408f71d108c0579c371e34bd5f96cc2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217954, "uuid": "c985ee3d-ab6c-41fc-8178-e25983f0c4f7", "comment": "Malware payload", "value": "3af784666dee0558472786594b2994588057567b7ba8722457398ea11848778b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217954, "uuid": "435c6438-7cff-449b-9bb1-038b5763eae2", "comment": "Malware payload", "value": "57ebf5b086b0629862c0ef8e017fb5e8a5bbf9a9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217954, "uuid": "23a7efc5-6c2e-47c5-8557-85eb39611c63", "comment": "Malware payload", "value": "496b9cfd367ab5e5a88fb8254f4f0afa13313fb8f7ecd5e75bef72dc677085ebe5c61732d74cc208fbb0588f945fd9a3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217954, "uuid": "fc4d3311-aa0e-45cc-8056-b90a90b5dc43", "value": "48830268CB9F8D948005ED0ABB12F8ED7550524C716973ABAFAD1124FF478D5A2338F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217954, "uuid": "7b46dc67-5986-4dba-b4d4-ed4e965b0702", "value": "1536:yA6P7EGmwH1zVQLQDYflSJXvoDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnA:yAY31zVQnIJXaM25NfuQjMCYNBwltD0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217954, "uuid": "d7c43519-9fec-4411-9687-d15526899f34", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217954, "uuid": "c4e962f4-ef2e-4b22-842a-6ff4a7cfdee2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217954, "uuid": "ad72f62b-2517-4c44-8e40-e5581da6db52", "value": "catalog-1252828374.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c53dee-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221921, "uuid": "70568e24-dbab-4bdb-9d7c-b71840f068ae", "comment": "Malware payload", "value": "e5b263de5565001ad33ac46d9990cb4f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221921, "uuid": "901e5970-96bf-423d-8c75-f265097b06d8", "comment": "Malware payload", "value": "3b00308e6e799f7ffbb29aa28f300f53d8753fb0618800897ffa4b3026bd5fa9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221921, "uuid": "509187a9-d0a8-420b-bfde-a42ad7be3448", "comment": "Malware payload", "value": "2aaa776fa8aef82ed15d17ecb3c35458f5044ce1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221921, "uuid": "2ff1d837-851f-49dd-8460-2c0c9ea2ca8d", "comment": "Malware payload", "value": "e5f648293c877e206ab4fce1d7e5addf4958eb39c42d0eee32318816f641132dbed47ac3b3dfd39ebdfb9c24353b1b7c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221921, "uuid": "57bfa9a4-f3a6-4f76-9b3b-5aeecb5926ac", "value": "028312F02CAE15B9838D6676A17D1643CC9C5FE116686FCB631112282EB18DFC43B676", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221921, "uuid": "38b8e5e6-18b9-4a7e-bceb-195fe8db4dd1", "value": "1536:kr7l+KIkejUgUlrZcCWb/bLCDxxp/ERd9QnGlRTH7qrelcV:+7l+9UhlrZcnfLMZERQnGnTHMeC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221921, "uuid": "b3f73cec-e428-4204-b98a-925e8c3b8896", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221921, "uuid": "acb0f80c-4b0b-4a46-92df-401bd6babdff", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221921, "uuid": "a3898f53-4ef4-4d58-8b18-fa098db54480", "value": "info-1977049342.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5b48d7-a3f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619156806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619156806, "uuid": "f42930c5-6678-44cc-9ea2-91a9b5a8d2ea", "comment": "Malware payload", "value": "93cbd89510b610159f828d604e3a8810", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619156806, "uuid": "b4e0450e-fce4-4969-be1b-c55e850ec16e", "comment": "Malware payload", "value": "3b2d035abb68d886184704927870aaeefc853d94b7747906c7889edbaa7d4eab", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619156806, "uuid": "6955798a-ba77-402a-9b05-78aa2a2cf853", "comment": "Malware payload", "value": "47d9cfe2710a222c3863089bcef6ed6c557bf6db", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619156806, "uuid": "87325157-7161-4caf-aee3-48b54e754b34", "comment": "Malware payload", "value": "70310348100d8a013314b9e0071b42345852d4c632e574d584050e4e58c86aa45cf2ddc096a8d78207319e53d6953848", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619156806, "uuid": "41a28a2a-591d-409e-a5c8-5578cf2a058a", "value": "8C25158A1AB95F2207A3E4344A41E763EC71E9D018E6F5D5ACC8BFDF70B0C584D6DA24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619156806, "uuid": "b226ad59-7ce8-447c-bdba-f00d38c0afed", "value": "6144:Lw+n1bqOmADFhTCweLDe5rqv2qQIiuQ8eqsQZEV3uz1XpkdnpSYDIL+RoGNzHSr3:owVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619156806, "uuid": "56e66f05-4c66-4252-a152-77d0c833aca1", "value": 1034300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619156806, "uuid": "f74f489e-fa4d-4cbc-8eb8-2285dfcdda53", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619156806, "uuid": "73b12a43-92db-4172-8020-04dd991423f7", "value": "CITACI\u00d2N LEGAL FISCALIA GENERAL DE ECUADOR.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1235ac-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222143, "uuid": "8d32620c-a6e3-4b5b-8012-56b17b077e3f", "comment": "Malware payload", "value": "aae4ac60cf14d58efa8a82bcdc41b83e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222143, "uuid": "931eb5da-e2ba-44d8-9f2b-bbecb34498e0", "comment": "Malware payload", "value": "3b8f21aaaa223d7e6ca8e3edae7ff82c0311074bf92a96ea95415a3c3f87885f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222143, "uuid": "0787a710-770e-41cb-877f-8c90774ce65c", "comment": "Malware payload", "value": "4f62984f47d0cfa69d467a3019c5a6705f91d0b0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222143, "uuid": "6bdc2dfb-1192-47de-921c-59f0919be13b", "comment": "Malware payload", "value": "e77fdf806f2c54448c86862d9d7a70368c264adaccb46d8e7a1d87ef04f91bee1b5ab87a329dde4d4c20e403b0de9ec2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222143, "uuid": "fc0feba7-9f3e-4e95-968a-1ebb9f33e2e4", "value": "FB83024B599828FFE295AF10232CD98AA50FCEF4D9705514F20BE75CD0B7B29727041B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222143, "uuid": "cc240a9b-a342-4ad2-85db-c03cdbc275c8", "value": "1536:sn6sEDF9MwsqZSCzfAkZ8kISNurvd197v7UZoctQ2kPo+4mpRlDi1nUSUqxuur:sn65R6wsqZXzfA21s19T7YptKRNpoUS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222143, "uuid": "6253a2a4-e742-4206-8ff7-a07e2215596f", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222143, "uuid": "1cf490b2-1340-4499-8ac6-78ae9aa710d9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222143, "uuid": "48a04f9f-e463-4b1e-9704-3f2379a94232", "value": "info-218041611.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c894e4-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218250, "uuid": "958d9c27-52e7-425c-aa68-0ec54b403316", "comment": "Malware payload", "value": "ecb0c40be56f059892906057d3994041", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218250, "uuid": "b4230a28-0758-4bcf-90aa-bae26f9469d0", "comment": "Malware payload", "value": "3bec799bc026dd3f1de3be45d6da185aafe8ab037f7cdcea82e5fe163104d6bd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218250, "uuid": "43526d6d-2817-403f-b567-3adc75a26e55", "comment": "Malware payload", "value": "72aada644dafe12fbbe057cecd610ec4b98e9452", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218250, "uuid": "0a20e0e7-3fbb-4b67-9740-5605d902be04", "comment": "Malware payload", "value": "c17f8aa3d1a84b4544b722ffb3fbaf02110cd1d9962fbaf1c54e80a4b634e78363f4f7500252f021f76ed045db0ea446", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218250, "uuid": "85092b22-9d89-4105-b6a1-e8387f81c0e4", "value": "F98302176BCB71328046E7B14B353B09A653BEEE640C6056DBEF4778FB3205968AC1D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218250, "uuid": "5302fd03-3b37-4205-bfb7-639adcc91be5", "value": "1536:PRn2hxVTZQ72ZTYzqcIxxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZiZtq:PR2hxVB6IzJ9a03fjwe1moYpo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218250, "uuid": "8e91a25c-fa89-4c08-9ecd-445adb86e9f1", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218250, "uuid": "9ff51931-98c2-4086-9ba7-085585b5e328", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218250, "uuid": "689dd2f1-cdf0-468d-b696-0bbaa375cda4", "value": "catalog-1410493976.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39347ec-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221944, "uuid": "10a53c5d-c7be-4948-a61d-f8e0bf8b223d", "comment": "Malware payload", "value": "ee04e3f2f9c47e04321c77ac015a7230", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221944, "uuid": "516572f8-b8ab-4012-b4ac-a3f5932489af", "comment": "Malware payload", "value": "3bf59de95721d527c3f54f7958712a4f17e6b7fb16aedca93593c72fddc5c8fa", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221944, "uuid": "8559654c-b1bd-4e95-b183-b86076a5255e", "comment": "Malware payload", "value": "a67f71d604ec60f3c16e59ba747b8a16907757cd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221944, "uuid": "363cdb1e-ce2c-4e71-96a6-d0014584e6e7", "comment": "Malware payload", "value": "28d4fbfc4be213d676eb10432258cc0a41002ebbf6d60f166343e211a00641df808252f65129966be8c2079b2ffbbb68", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221944, "uuid": "337a1a8d-0283-4119-b5b5-58b4264500e1", "value": "6683026EF462586E41AEE0F2913F275825DC52C1B434DB9BFD2D3D0A98779CD2C0581E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221944, "uuid": "961b2c27-09f5-4b6a-b6b5-e438df3accd2", "value": "1536:K/VtmQNt5s5t7mgV3eE7JWgtrQZcUT7oqlaHvvbFq9GHocnoe1RqfwSOJrpMEIp1:KtAQzS5tSCrIGUT7o/v096oiBkwPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221944, "uuid": "b69e8515-bc67-40e6-b862-b9733f18a91a", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221944, "uuid": "6648dffb-6f2b-4882-988a-2910f163fc1c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221944, "uuid": "d286e28d-7105-42aa-8b17-79f45d733246", "value": "info-1993111022.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a5a4f7b-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218331, "uuid": "86c503cd-b632-4178-b950-240c64d046da", "comment": "Malware payload", "value": "19d46dac1a3ce6e9e10c255a90441224", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218331, "uuid": "7c92fda9-511d-4307-b410-abe2a2de85d5", "comment": "Malware payload", "value": "3bfa506a0904e53fceb7ffea013d789be01a71c729b75744bf0ac0c3ef25a492", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218331, "uuid": "c11c37cb-4212-4a48-8ae3-5337a3e28871", "comment": "Malware payload", "value": "43bf64adb33486ad7439b07800f200c92c3cdcd8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218331, "uuid": "35ce6fa1-9942-4b94-b1ae-f78dd86b66c1", "comment": "Malware payload", "value": "42470b2ada8840c381c5e89d5a33bb07477fdd9cd13e13c08e7a6b42fe2e70f0c88af87a365f55fc693e4e8a2be10e32", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218331, "uuid": "5eefd7e8-65da-4d80-9565-a43185488410", "value": "49831277DE87624EC102723013782FE64B2C6B329A61150A1774747F2B6B9698CC6FE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218331, "uuid": "2145f0d5-e109-47d1-8318-37e7fddc7136", "value": "1536:tuxWAXdZ2rQD2aCvdyWxaqQ6Rxt5AB/aqPwL3VbCbJ:tA2QKmm/Qwt+awaxCbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218331, "uuid": "7553cdb6-92ad-49ec-b7af-3601bb299638", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218331, "uuid": "3042eff8-a2c6-419d-a8a6-26e1b69d70ca", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218331, "uuid": "a5765801-d4c5-4baf-93b3-6e64c3798f64", "value": "catalog-1447550727.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cdccd84-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217906, "uuid": "d6999a96-2fb4-44cc-9ac3-d0ed8440cadb", "comment": "Malware payload", "value": "c7050458d8539613d2b54ed38cd01fe3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217906, "uuid": "c03ef2ef-be56-4c7e-b75c-e9c36e424fe7", "comment": "Malware payload", "value": "3bfe50232f336cc0078ec3d21e54eaaac284ae6d4dd0b0f22f5bc7e5775f9161", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217906, "uuid": "6534ce79-df32-4def-8c93-b9bfbc8261e1", "comment": "Malware payload", "value": "fb57b0af5296b4d2831df50d8b6b5e356fddea4a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217906, "uuid": "77172857-bd9b-444f-a5e0-e172e447a5e2", "comment": "Malware payload", "value": "31a3e9384b510b1f03b6f78d98ccf4e8880460042864ec5930385b0366c12f1e13c33c34deb125892205f0733ab1c047", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217906, "uuid": "a9e47896-dbe1-4515-9b16-2898a42dd14b", "value": "B5830298876F4C9C8005AD0ABB13B8ED75505148F176B3B6BF6D1134EF468D9B2738E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217906, "uuid": "c7f61e5d-7fcf-4390-ad5b-18a619fff2ff", "value": "1536:PA6P7EGmof2vtQLQDYflSJXvoDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnL:PAYn2vtQnIJXaM25NfuQjMCYNBwltD0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217906, "uuid": "de7c7aa1-21ea-4cc3-b9d3-58882d6ec2dd", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217906, "uuid": "31cea90c-5554-4867-8d5c-004446f49967", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217906, "uuid": "8e723ca7-7429-4b5f-a2c2-988d786af503", "value": "catalog-1233137088.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb58929-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221991, "uuid": "2641b93e-e5a9-4852-807e-80d03413bf2b", "comment": "Malware payload", "value": "8ce88edce00d41d5dd0054534a8b1ee7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221991, "uuid": "47af46b6-00e0-4090-a2b6-49be497766ed", "comment": "Malware payload", "value": "3c2717482026ee2179c768fa57210dc40d0843572fd43e0d4516e65b10ed188f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221991, "uuid": "65048ead-bb7c-45c4-b429-5acb51b61a63", "comment": "Malware payload", "value": "f019c858a0644138935dcccab983ed9e09267f0c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221991, "uuid": "f679c20c-282d-4a8d-ae0c-a43d33da7aeb", "comment": "Malware payload", "value": "c8af1571e328054f6e89ed92269455b331ac8d6ebaee84eb99d7c44d1caea1fd9c21433ffc3a919ac32eab419ea24968", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221991, "uuid": "6f6bffdf-a510-4d55-b830-7dcfa6d512c5", "value": "7983121A99BD1CD9C0AB13F00D73494D4860DF7D411C8449F11ABA8F78AEE85DEB7AE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221991, "uuid": "6cbe7715-4bbd-4313-9637-31c8441db87f", "value": "1536:dt1QVGeGAg5dwSp6yMvBjqqxPGLuhCWdHsh1oSFWsfEFhHqLWX:dAG7A8l3MvBjqq5OsZdHAO5hK0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221991, "uuid": "bf9ba107-65dc-4a2b-a7e8-b9960dd81983", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221991, "uuid": "69197f5a-7877-4443-a766-8aa1b30181ed", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221991, "uuid": "e1b6abbc-2957-4298-8340-0cc8b161ac96", "value": "info-2046912016.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8707e3a-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221442, "uuid": "7f609962-ebb0-457e-9c9e-78d8bd8bc3b1", "comment": "Malware payload", "value": "bc32074188b86247c7ccfea127d5aa06", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221442, "uuid": "5147e36e-d70b-4c23-b656-280d37f86755", "comment": "Malware payload", "value": "3c35b601ca26798ef0596c1ab893a6b653907acf45aafdbf7f21f83bc27ddef9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221442, "uuid": "75c54f41-2e2a-4556-9414-a44df4f2be15", "comment": "Malware payload", "value": "a48816430db12ab46c7867a914590199f2f8c6e1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221442, "uuid": "1f269fac-51a1-4574-933c-4de94d44f15d", "comment": "Malware payload", "value": "4452fd751efbf7ce6a27f26a450b56f7accb69052a9ed421e815077d6a98545638a90f1d272ab0b8546b6bbeeaa43e21", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221442, "uuid": "ba7af0c3-1a58-4604-b8f7-f7a36c6e36c9", "value": "9783124D35EDC040E17F7D60936AAD5902B86F4BEFFF9164CA6961329901863EA0368F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221442, "uuid": "1fd2fda1-bb36-4d78-bad9-9c2cf3d244ed", "value": "1536:QwJNfD6jITxi7UnLkb/Yw3LCq1GeOuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbI:QwzOEliUne/L3LCq4kO6xoKDShicdBMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221442, "uuid": "0ecb0301-9832-4936-8a45-394eaac69658", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221442, "uuid": "c0aa30d7-5352-422b-8acb-e7e2a0e9742e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221442, "uuid": "e8dc2ffd-e1a9-45a9-ac8b-fb525016f9ec", "value": "info-1687370543.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a20bf810-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220519, "uuid": "862c4281-8642-487f-b10d-0e63869ef8a0", "comment": "Malware payload", "value": "0e6664a2a57f1bd86cddec1dd6c0b118", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220519, "uuid": "6ef6efd6-9c31-49da-8f87-88c5fd6d1f07", "comment": "Malware payload", "value": "3c39dd950c67f038b9e679cc6d88675498db0a3758c54786165a52967037e979", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220519, "uuid": "cbd8e228-668b-4f7d-afee-c55346b691b7", "comment": "Malware payload", "value": "1819e8bc63f1f929e83ce003511a70089a72f043", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220519, "uuid": "faaf3c8d-7b7c-442d-a626-3671c7e1149d", "comment": "Malware payload", "value": "4dcb3e122335a180251fba4028e24eee97523e52eb28e6725b0e8dc0609c38c1a42a12b19384e3b092bce15ae0d97cb4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220519, "uuid": "e1214fd6-96c0-4453-a719-cd3225630950", "value": "F88312078A6158FDF16ABF01273DD4CFA64ECBE1E92519C0F20E6B65D2A3399225440F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220519, "uuid": "071ad6ae-e2a5-4af0-825a-fb162465f37f", "value": "1536:hHZbN5m6RtLlLHfAkZ8kISNq7xWgwMQZL197v7UZoctQ2kPo+4mpRlDi1nUSUqxf:ZBm6XLFHfA210wN19T7YptKRNpoUSUqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220519, "uuid": "04324be3-ce4f-477b-87c0-a2aaff582cb1", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220519, "uuid": "d11fa905-0821-49b9-81cb-e7cd9f0479c2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220519, "uuid": "4089ceb4-77ef-4ec7-b150-12195f4ab935", "value": "info-1220058509.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5cf5af2-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218055, "uuid": "f15da554-bb42-43f4-9ff4-7a60c1a9afee", "comment": "Malware payload", "value": "06ee225fad28010a9190c39ccfeec371", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218055, "uuid": "b1af2963-f99c-49b9-a56f-029a34778d70", "comment": "Malware payload", "value": "3c496d37490e100ca5ebd53175fe5be896e66a8ce50f4f0343ec98dd5e737a2b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218055, "uuid": "2e14f964-4a1f-4221-b46d-72767b5f4fde", "comment": "Malware payload", "value": "c49445f6c2c91697e89a02d7e53f0ee4a19159fb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218055, "uuid": "8677c729-83d9-459c-947a-d7dc2f99464e", "comment": "Malware payload", "value": "a8329f60712f6334c3c99b0f2b852f3f4c6d1621d703d489e2eca4f9af401977e6e9651c350140e5679551b926f7e156", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218055, "uuid": "42441624-9b5a-49eb-850e-5973cee2604a", "value": "3D8312E4C79E0CD4C1558E0D7B23F8A8B901711C3118A5E7FAAD58B56B538E8A2B3DF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218055, "uuid": "6a5b171e-db3a-4a40-bc02-f986969cb222", "value": "1536:CEGf1lwz7up/vqBuKXxP8JXvKDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrn0:CZcvuBvaXxP8JXoM25NfuQjMCYNBwltQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218055, "uuid": "5d8b850b-31c9-4440-98b0-5e1c3e799b37", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218055, "uuid": "fa38f8e6-1e4b-4e92-bbcf-a7ec557f6c83", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218055, "uuid": "86ea5d41-dd9b-4d5b-9f1e-4eec9bc74cb4", "value": "catalog-1317792588.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede8c44c-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221075, "uuid": "5904371a-2ff8-47da-adb8-52a01c265836", "comment": "Malware payload", "value": "a220313c169797810cd4f236b05d0e90", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221075, "uuid": "683cbd14-72e5-48b9-ad48-d3654c2037e9", "comment": "Malware payload", "value": "3c4d7dd1bec984a3e48803000313a26cba595d0dc611950cbbb355f651c0f4c1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221075, "uuid": "813d97af-56d4-45e0-944a-878a5b327ecd", "comment": "Malware payload", "value": "e3acfa6854cf995f715d3b859669836d08d2586c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221075, "uuid": "ada4d77e-d76d-40da-be01-429d9ad226e6", "comment": "Malware payload", "value": "bbff090f71b41b88810be647b0ffa81d532f8339535940ecd8a4ddafce44261c6c1bc0ed3639f3bca3c0c98f9500528b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221075, "uuid": "c05c3bbc-76d0-4162-8cdd-136f38858263", "value": "A48302E6AC778C1D818ED2F1503F5E246BF464C5A4B8E35AE9167E49DC27DC90D0882F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221075, "uuid": "b4a3c9ea-b4f7-47c7-b9a3-9ed90c579f93", "value": "1536:/xKzlSo7mgV3eG17lbkCOUT7oqlaHvvbFq9GHocnoe1RqfwSOJrpMEIpz2PN:/xKzlSoSCn12COUT7o/v096oiBkwPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221075, "uuid": "873252ae-bbb2-4a79-a5ed-db324015e009", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221075, "uuid": "d12f7c66-b980-4e5b-83e9-3063900fa6fc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221075, "uuid": "6eee81d7-4b60-47b9-9bbf-0d833c75dd65", "value": "info-1475643701.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fd3000a-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221803, "uuid": "1ee10ef1-b7b6-4528-b9eb-dab7a7335e8f", "comment": "Malware payload", "value": "a7e974b4b71d9948f3c90bf14ff1ca45", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221803, "uuid": "56d1990d-faf1-4883-9977-25b8e5bc9a13", "comment": "Malware payload", "value": "3c6e517c023cab4ae88600452ba83ce663938f9e5bb62cc919380f5c9bde1716", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221803, "uuid": "39649266-3209-4252-b3cc-931e2c3e8f70", "comment": "Malware payload", "value": "d7a6b2d8c46742978abc100eb08b2f59eeb67ab7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221803, "uuid": "2e8a14a6-678d-4c53-8bf5-76037ce6102f", "comment": "Malware payload", "value": "3a125c69aa80defe27d06b3c6eab79ac2aa2b5ada226a0b5254a47522a43edd8e30ee36709fc20011de0a3e2543e7180", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221803, "uuid": "9fcfa439-7fe5-4cf4-931b-3eb0b09dd891", "value": "8F83121068BDC36A50E31A5024703E57CFD0F752988CD043B2A4AB77B5E0BA5467EFAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221803, "uuid": "3000c210-fb78-43ed-96c7-0022a220d07d", "value": "1536:pxKzHWdwSp6yMvBjqq7M5Y2VXw1QFsrGq9ZMlmZQTQdX:pxKzHWl3MvBjqqUXw6Af5dX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221803, "uuid": "c3675bb7-f9e5-4942-9600-81849edcadf7", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221803, "uuid": "0780c2f0-1cd9-4ede-ab1e-054f169b2ae3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221803, "uuid": "d3444970-8317-48cc-a95d-0e3830ee4eac", "value": "info-1892766524.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb2289e-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222389, "uuid": "6438c897-6a30-4d90-ab15-326513e27efb", "comment": "Malware payload", "value": "31a4537e7081ea53c25d50dfa670f6e8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222389, "uuid": "896d397d-c95b-4be5-bed0-fffce9655e46", "comment": "Malware payload", "value": "3c7105d2bff349d731ca09e8fdf9bdeebeded430d3709968f395d997e492632e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222389, "uuid": "45b96a8e-9f12-469f-ba7f-db8f5126302c", "comment": "Malware payload", "value": "6e578300295c88b652824078475a495761bbefb1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222389, "uuid": "00e2e647-553c-4820-afcd-a988fd06ee1f", "comment": "Malware payload", "value": "6cb2d9c83b43165e7fbefe44a2405cabe63ac3e7c6935b0d0a958d15713a76542c6f02b28a45351311d6c13a82cc8e58", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222389, "uuid": "2f3afff8-a67c-4c16-b31b-94b2bc3a1615", "value": "3483029C30FF0144967A6CB8613FE80750FC6FDB2D37B74947208574AA114EAB62399B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222389, "uuid": "7cc9da8c-6ec6-4f83-b0d7-54f8b7af6b94", "value": "1536:pvr7l+KI0ejUgUlrZKFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbXYZTa4hpst:pj7l+NUhlrZ6O6xoKDShicdBMM1/XPQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222389, "uuid": "6135a7ef-0f67-4feb-9aef-d6a1bba1ce7b", "value": 86795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222389, "uuid": "b5575731-514f-46a2-87c2-67fcb2b59a67", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222389, "uuid": "0caf4bd3-3359-42b0-9e9c-71c715580142", "value": "info-361867703.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd715fb1-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222309, "uuid": "31dea2fa-ce58-4690-9ce0-d2e48afae7bc", "comment": "Malware payload", "value": "c82c467e848eded6acc93bdda5a14ee0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222309, "uuid": "179e4243-dbe3-4eac-a695-4486237f7d40", "comment": "Malware payload", "value": "3c78a6f5e961833ad566329040674d23de5e6d71929700c37dea0fbe6fcb5a38", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222309, "uuid": "0fd1bfe5-9582-44a5-80b2-4e4f0186e8da", "comment": "Malware payload", "value": "cca51988766488d8d970c0faebbde6c42f412a98", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222309, "uuid": "c9203208-75a7-4447-a73d-a334c4230ef6", "comment": "Malware payload", "value": "68ead23747393b97b9c739f46d38436afded54f7099cdee833a6c793dc3e4cebce9e8d680a8f7142cf8b12e3ad3479ed", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222309, "uuid": "3f54dad9-fb16-40e7-86ba-73d2bc182ea8", "value": "90830297E09B6E7EC28DD065901E263C25FC14C2F8759B9BED4A7D268836ACD6C04C1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222309, "uuid": "3a09aa19-43da-4ae7-846c-a9ecbc8987f9", "value": "1536:3BDzeCSrujL5x7mgV3e27JWgtrQZcUT7oqlaHvvbFq9GHocnoe1RqfwSOJrpMEI8:3BfYrS5xSCxIGUT7o/v096oiBkwPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222309, "uuid": "a9ffac67-5f75-4e8e-9181-612e65b441c4", "value": 86795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222309, "uuid": "44621773-9668-44f4-9e49-84d08118364a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222309, "uuid": "a2ecf3f9-2c0e-46f9-8d36-ee34518fdc1d", "value": "info-317952287.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f4a5d2d-a427-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1619177430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619177430, "uuid": "b37dcc86-e6bc-44fb-a4a4-72ab61175d7f", "comment": "Malware payload (Formbook)", "value": "ebe8ef871f84657be2f412dbca7c2715", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619177430, "uuid": "22f91c99-49df-4c31-a5c2-6e588a6f5110", "comment": "Malware payload (Formbook)", "value": "3c9d93174956e0e238fc4463838c1e2f2e5b63e565081690f8e25a6e2157b40a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619177430, "uuid": "373a93a9-f0b6-43ed-9a97-0e71f566428c", "comment": "Malware payload (Formbook)", "value": "648e75cc5561c23b32e53ddf6c0fa88802ae0b9c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619177430, "uuid": "765f9d01-65f1-45d5-91e5-8065330584fc", "comment": "Malware payload (Formbook)", "value": "aae41d8d6bfdbf51ef90336bcb8bb938ea1927e6fe51565283593fc54b845cd1e464730b3cb98d84cd70ac5d37ac04f7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619177430, "uuid": "550aabd8-ef92-4664-8a9c-45dc338b8eec", "value": "F0D423C06127E2C9E2A4A5EE025F5EF90E2F4C0D08D8ADDBBFF43F16554C162A64687D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619177430, "uuid": "dce19175-be6b-4538-b9c1-586c64b666ea", "value": "12288:Ez5HziLNdWJxSGKaZKumX/QUeyYXnTnTbr2vahpwTCjVtvbS9L9U2qfuu:ofI/QTnnTTbnsCjrvkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619177430, "uuid": "ab5b199f-42b7-43e0-9f7d-02b531be968e", "value": 644542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619177430, "uuid": "39c7805e-4eda-4e14-b3fb-27fc8b67e0cb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619177430, "uuid": "3dc62f17-4217-426b-adf5-6d3c06cbff02", "value": "_Transfer Confirmation (39.750,00 USD).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbc078d9-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218414, "uuid": "4c4e2ffe-d9ff-445c-83f9-76198212d325", "comment": "Malware payload", "value": "13155acfc916bedaaf9953faab7b0298", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218414, "uuid": "79500e07-cd59-4de9-8c89-1f7f7c5cb640", "comment": "Malware payload", "value": "3cbc181bae884da57c7f5d9cefbc0dd282bf05735913b5631faf61193b24a84a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218414, "uuid": "689d21a0-794c-43ca-b69a-9a4c3df5fb4c", "comment": "Malware payload", "value": "24258c063637697544ace1dec21aa076a1b538c7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218414, "uuid": "227f3d40-99ca-417b-9449-a91fb810c41e", "comment": "Malware payload", "value": "e67a1cbef06ce9297ebe69cdfadf73ae8137c906b15269de7189cc3f698f6502b112bce0e78f5cd35635500645a9ada4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218414, "uuid": "47c43b1f-34b4-4204-9132-ce0afbfe800c", "value": "D4831232FCBA2BCC5C1DD820D0256DF40A6FCD9A959323B859682D32208D67D6B419EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218414, "uuid": "b0963f83-3db7-41fe-bcf9-b20b91271c4b", "value": "1536:Jg2sNyMfHfrqQaiwotTqFUAAWB9Te87VqINbtezgVRxr9AiUrQTKXs8FI+b1:TM3XvtTqFpe8JqmdIrLjFRb1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218414, "uuid": "48cf5f1c-28e6-4342-8d3f-1b43f4f8756c", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218414, "uuid": "dda02c14-8207-4d5d-b7ed-e5d116004737", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218414, "uuid": "fe51f6cd-40f4-40c5-a8bd-ff7d9784313d", "value": "catalog-1488940961.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91de3f30-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221350, "uuid": "7d3996ee-6429-4edb-81c2-5e9ad4241358", "comment": "Malware payload", "value": "4be6b1fdb66ae1f978c3e318c740e5c3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221350, "uuid": "a7c32a38-71a4-4377-b38e-0658d6693f6c", "comment": "Malware payload", "value": "3cd7e65a4e0183ddb5ef83e9d4c608142de0f6e2b8ba1bec6df29f5913b6a546", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221350, "uuid": "e8cede3d-1827-4eb4-ad87-f45669c34b01", "comment": "Malware payload", "value": "aa07f079e1e10ea382751177209e116dc2a271cf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221350, "uuid": "6184b83c-efec-4466-b330-ef95698f1a72", "comment": "Malware payload", "value": "37cc5714296f6fcaa35b2dd6895befa011e10d1a220b9ea52847535bcd50ae485ad249a05a01628e008cbff4baceb605", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221350, "uuid": "13ce966c-d6ed-4438-933e-5084403213dd", "value": "7883121068BDC35A50E31A4124703E57CFD0F792988CD043F2A4AB77A5E4BA5467EFAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221350, "uuid": "7b3f854d-25d5-4f43-a94d-0bc7d94467e6", "value": "1536:JxKzHWdwSp6yMvBjqq7M5Y2VXw1QFsrGq9ZMlmZQTQd4:JxKzHWl3MvBjqqUXw6Af5d4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221350, "uuid": "d54fc2dd-249d-4795-8680-42110b98b1dd", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221350, "uuid": "75d37353-f7d8-4bfb-bad4-2404a41406a2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221350, "uuid": "05c2fab7-a9cb-4c07-9c35-31b5f6215294", "value": "info-1630057915.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8055a292-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218744, "uuid": "71e81d4f-021b-49d2-877d-0bf742d42f87", "comment": "Malware payload", "value": "9cde3f58218dcae208f9d4cf60fed3a2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218744, "uuid": "c5a7a774-3827-4d3d-8009-ca8d3f1fa82b", "comment": "Malware payload", "value": "3ceb369994e990909f3b5bd219646d1f710b6f87d36cfd21c31f6206893c0922", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218744, "uuid": "2530753f-5c49-4d70-8966-b414aa42a294", "comment": "Malware payload", "value": "1814900c93ab83ebe063c5c6e13eb74c7f332cd9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218744, "uuid": "e938753b-743d-4c8c-83cc-8f4544513f9f", "comment": "Malware payload", "value": "ab2438029c24f5c65058474c6cea8ddb2afc54cec686b3f702dad31ab440ff2908486d070d51b68f3f2754bfbaa5fe84", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218744, "uuid": "f71488f5-123c-4ced-83f7-f76fd4f67174", "value": "FA8302CBB4E9433D8F3517B748AF1E046261A43F44088ADC75D73BB86B526B265723C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218744, "uuid": "796ac009-9c2a-4f8a-b9e7-81ebea2eae10", "value": "1536:o0AfNtg2tf2vCapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvr:hijtt2v7mU9j7+XFWtYe14hbOjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218744, "uuid": "a02997be-d275-46a7-8f8e-38a67fcf943c", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218744, "uuid": "f3beec93-8f16-46f8-b57e-044f0ab81862", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218744, "uuid": "a396c4b3-52c8-443a-8643-41737d2aeca4", "value": "catalog-1693106007.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb98a6b-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218043, "uuid": "ee353cb6-d711-4472-9dd7-541b40637c95", "comment": "Malware payload", "value": "c0f52de787281026315a463b875f21b0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218043, "uuid": "38100c63-2e1e-447f-b318-84e50bbca97f", "comment": "Malware payload", "value": "3cf241669f966c9dd45042a09521188cee16944b4761081f08202707cd5dc5eb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218043, "uuid": "2872c102-2d56-43aa-b5ff-95930f255b77", "comment": "Malware payload", "value": "bf1468c721201624536f65b4f6511614e270e0fb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218043, "uuid": "93ab096d-3f50-4dd5-b1ea-7a05b128a5ec", "comment": "Malware payload", "value": "f0b894ff534fdfa8612007a22ba06d0578c882de9e59a935300a16df0749ec816c7f85cb009076a55ff50be66eb77aee", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218043, "uuid": "610075f1-8d80-4d0a-bf27-2ef178e694b2", "value": "57830227FAC725A28046E9F25B363B292A4379DD745435568FBC03C0F63615F2DAC1D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218043, "uuid": "25458147-151a-41ee-b854-2fdcea904cf6", "value": "1536:Cnqmy0pi0wOQMP4gCQZiwotTCWxxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZiZj:C7y0pgOQMPEvtTCWzJ9a03fjwe1moYp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218043, "uuid": "066fa41e-70a5-4824-98b7-1523d2f660d0", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218043, "uuid": "9ce67533-7ddc-469a-b432-004c070be15d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218043, "uuid": "463f9a14-aaa8-4027-8351-b9a523b329d7", "value": "catalog-1309900342.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43087239-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221218, "uuid": "122edca9-20f3-465e-8ae8-e8c2575e66d4", "comment": "Malware payload", "value": "ef7a05673cf0aa91702d17605794c654", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221218, "uuid": "8b168de7-e7c5-4dda-a877-9bac94268c33", "comment": "Malware payload", "value": "3d0c2d812a23894f365e6eab1c187edc1a162377f79ab1a81c352552134aee2d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221218, "uuid": "578558e0-99c3-45f9-aa77-484369b3a0e1", "comment": "Malware payload", "value": "9f1b57c29d44477c09ab1da4b9f63e20a61d2a86", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221218, "uuid": "9cbc6016-7698-4d38-98a0-ebdd2a81bd12", "comment": "Malware payload", "value": "0261fa5f7d9f11b2dbce54701244e2420f1afaeecf7a69d3eee1f5f498ebf5e7df2b274978485044b990d0c973978330", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221218, "uuid": "f935cb74-ef32-4bbb-812c-2bcd8e4664b2", "value": "9383124D35EDC040E17F7D60536AAD5901B86F4BEFFF9264CA6961329901863FA0368E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221218, "uuid": "b33562d1-559e-4d66-a02c-aef08fbb10de", "value": "1536:EwJNfD6jITxi7UnLkb/Yw3LCq1GeOuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbL:EwzOEliUne/L3LCq4kO6xoKDShicdBMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221218, "uuid": "42eb4abe-0ce3-48ee-ac48-7ff32b30f4f2", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221218, "uuid": "1fa5ff54-08be-4ab7-967a-f97f153cf7c8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221218, "uuid": "7d56d912-70a5-48f9-a2b5-45fede720819", "value": "info-1560453243.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c5fe98c-a40a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1619164862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619164862, "uuid": "e20d8c6e-fdc8-4b60-8e03-fe82a11bc344", "comment": "Malware payload (Gozi)", "value": "1dfea8467f019282c877ad7188b7c139", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619164862, "uuid": "99356615-90f2-4096-8377-908afb30ec6f", "comment": "Malware payload (Gozi)", "value": "3d1b19b13cbeaedde859f09304ac7c63550879cb97e61efe6f2b06ac6805de54", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619164862, "uuid": "545e705a-280e-402e-8580-fcb2d77b410c", "comment": "Malware payload (Gozi)", "value": "a4477a78972da10380c85391bbdca917952de180", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619164862, "uuid": "e1021137-ed5b-4e0c-8571-7485ae3693fe", "comment": "Malware payload (Gozi)", "value": "91bcc12bc17dc367e5c68fd1f28e26266a0bce20bc81e37b1ecf45909b47f5c8271d711394b2bcdaa9e88c6eb32a9661", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619164862, "uuid": "a676b845-18fa-4015-a714-9a49bc1e87f8", "value": "7915C03138C1C232D573A0780A69D6B04BADB4301D359B9F77DC2B7E6F715A092369AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619164862, "uuid": "c89edf15-06dc-468c-9413-102cce86afb1", "value": "7a79d10b1d4343a18a4f6e25e165b4ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619164862, "uuid": "5a2d65a2-45bb-4fa5-9e3b-d1d1c8f7b9b9", "value": "24576:HQfpzjXPgf+8CJV4X+IBIJ3cazaLwj1mCG9CpNiLi:IFDg6JV4OaIRj150CpNiLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619164862, "uuid": "b24062fe-ff38-4265-9220-d55a7ebf015e", "value": 960000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619164862, "uuid": "153d2d8a-c59d-4c6b-b60c-089bcfda198b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619164862, "uuid": "7c3832df-02fa-45b0-9245-e941c8bcecb3", "value": "presentation.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f095bcb5-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218932, "uuid": "bc6c21f3-edac-495e-a31f-aba3573a29ea", "comment": "Malware payload", "value": "f460085e15ed1be7f465327e26e4ba1a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218932, "uuid": "2419dec1-ac42-4e55-a3bd-634a57734432", "comment": "Malware payload", "value": "3d3095d548795340cc4c9f0bed27de7cd2d46d83ee63146b69ddd754cbbb7883", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218932, "uuid": "950f03bc-d015-4cca-b2c9-6e4de7a1f5e1", "comment": "Malware payload", "value": "2bdbdde1f0603cea52f1946ec76899f8727ab191", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218932, "uuid": "ae8a5cb4-7160-4041-be0f-4e3188f26c89", "comment": "Malware payload", "value": "d532dc90657a578b2e7c80422ac1a018dd35d7c83fb2496aa0ca13b0627031808bac79219d4c8865501f1687b713a2ad", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218932, "uuid": "19c632e3-f853-4d31-8b7b-9344638b77c1", "value": "5B8302CBE9E4432E473526B3986D0F455E40353F4410676C66B936B8AB67A73C89F2CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218932, "uuid": "9a022daa-3baa-4f99-a9e0-95157349713d", "value": "1536:yE4eaAK6VMMJDrlBQNdZ2rQD2FPdoSVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyT:y/VAP71BQwQKLU9j7+XFWtYe14hbOjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218932, "uuid": "0729bf2e-d6eb-4e92-8540-e3d830a00e90", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218932, "uuid": "98133ce7-ffdc-41f8-b3fd-683cb5f5f79b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218932, "uuid": "4e7f82f8-bca3-446a-8cdc-8f9a02c365e6", "value": "catalog-1792724409.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d2f7cd-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218450, "uuid": "67220564-54da-4f58-ad6d-3976996336db", "comment": "Malware payload", "value": "2a0d16e9e655d8e313126e469d35113f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218450, "uuid": "25bf6aa8-1cee-4d88-a88b-b4f022c767df", "comment": "Malware payload", "value": "3d79b01a2981268d1bf70188b9d0d493424fd6cd50b15f2c8af1e12f8bc0564e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218450, "uuid": "150afdce-15b6-4099-ad55-48c610bc701c", "comment": "Malware payload", "value": "a0e573e063eb364a6fda1de62d60ea9d6a899d2e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218450, "uuid": "0dbb730e-b2a3-42cd-9ae0-e9231fcfb159", "comment": "Malware payload", "value": "763ebb4c34ab68a4cb77bd4dc297afdee6253a2ad496c5b5989781c12ef170e147c266df0d1959eafa97c36fa3dce092", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218450, "uuid": "e0ff9d6a-acec-4e04-b59a-159764718e71", "value": "9C8302EC7A1BC69AE371835EDA3EA8C123575DA8C04DE0A2780F7F7B54216FF9120161", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218450, "uuid": "81c7f7c3-2e32-4136-8010-54c4d8c7c1e3", "value": "1536:77f1lwsMJDrdAZQ72ZTYzqcIkUjoB8+wXdpUna5ahL2dmTLUVVvb:Hcbt26IkuXinakEmEVx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218450, "uuid": "047ac542-7911-4119-9a66-caa681de09ee", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218450, "uuid": "2cac2f48-d47f-4ff9-ba48-77fc951e5503", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218450, "uuid": "34f15d1e-d7db-4f43-a0e5-bf7a117422f1", "value": "catalog-1509591073.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6a8964a-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218916, "uuid": "3944ab3d-c057-49ed-b457-83140f73ece3", "comment": "Malware payload", "value": "6abdbdb4509e6434d075741851c70012", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218916, "uuid": "37d339d6-ff0f-4bf9-af42-dba8340244d8", "comment": "Malware payload", "value": "3db3f177fa1d092c803c6fea69ffd1c1925a7e041a7a0d950336ab8449569fb8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218916, "uuid": "0016ee00-341f-470a-97b0-c600105b6e89", "comment": "Malware payload", "value": "50e7638eda915d7f82a2d618d725562f6918a31d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218916, "uuid": "d6d9718c-96c6-4cd3-8815-194ce7724c36", "comment": "Malware payload", "value": "4f62b7ccdfc274eda7c8c88ae834e7a0b2355a0fa08e4023b4250b2e6cd2e58f8aec280fddc9bda931e93ad897a3f484", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218916, "uuid": "071a4b17-fe9b-4472-af86-e73aeb813a1d", "value": "368302E8765AC792D370434DC6BDB48637A68FE8A00DE043BC0B7B3F6C126BB5425565", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218916, "uuid": "14237060-fe70-469b-b659-1ea1ee95d86b", "value": "1536:UFNCZ2i7uJeZQ72ZTYzqcIkUjoB8+wXdpUna5ahL2dmTLUVVvW:UFNCISue6IkuXinakEmEVg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218916, "uuid": "823edaa2-4398-43ea-9f9b-7c7fe6cc89ca", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218916, "uuid": "0b49a8b9-950e-4b59-b319-95e245635c92", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218916, "uuid": "02af8b80-7b87-4cce-a269-b20fdb8ffc30", "value": "catalog-1779406020.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fef06a7-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221669, "uuid": "de536a75-9b10-4659-aad7-7ad258df2314", "comment": "Malware payload", "value": "3a8ef5e44d252fd7719be77833175909", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221669, "uuid": "e485035f-649c-4ca7-a560-17583225a7bc", "comment": "Malware payload", "value": "3e05547961205bbd8ca6478a49a69dca353fd2e5294eeac8aa3139d8e3884a40", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221669, "uuid": "d9fade9c-038f-417e-921e-71f9e7286eec", "comment": "Malware payload", "value": "e4ca5fd34cc54d011621d26e24405da5089fb000", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221669, "uuid": "21c953fe-6462-4b21-bc89-7d60803c3f7b", "comment": "Malware payload", "value": "327a983840b3a4606668595092b1cd0ec54aa05f68f6956abc14885767153c7daac92c68160a9b1fc20948f637809a37", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221669, "uuid": "9fb6e4bf-0841-42d1-b45c-6de53cf90825", "value": "2F83124D2C95E29EDA4879A217DC31A86F942333B7F543EACC5E72227523E36F1041A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221669, "uuid": "a7105cba-7bf2-43ec-a05c-2845c206b328", "value": "1536:TwJNfD6jITxi78nLkb/Yw3LCq1GeOalTJkv9c/EWd8E//nfYRq1o+VCQHeWnsUWp:TwzOEli8ne/L3LCq40VJklMdT//gRL+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221669, "uuid": "aff0d9df-44a5-4300-8be6-22c9d4ee8ad5", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221669, "uuid": "6c041d67-4950-43aa-be7f-2e9909827712", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221669, "uuid": "dbd5d6e7-07b9-442b-9952-558328acb30a", "value": "info-1806758097.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ceb5605-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219624, "uuid": "0def52e7-2ff7-4d94-aa57-b06ea9c8deef", "comment": "Malware payload", "value": "51f27b5711ac729a39b650b51815b9d6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219624, "uuid": "cda92715-8db7-413f-ba71-1c19f856c657", "comment": "Malware payload", "value": "3e22c47a6a37c198da2f3face250502347b74b0aaf07bd4dd7b016fe810f4a31", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219624, "uuid": "077beacc-2c9d-434b-bf07-70e8343c17ff", "comment": "Malware payload", "value": "f4b309f52757a2b2cfc14664eb4a575d7ca8da62", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219624, "uuid": "0ab1c67c-c4b8-4abc-b3f0-18e6e717493a", "comment": "Malware payload", "value": "daa371c5df2db625787af826b143579c49d5c9b79cba240f120147c847f06a268e88e813ea67aa7eee566c2d42e4e61e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219624, "uuid": "c7f8b721-4251-4f16-868f-3f4d47fdca35", "value": "4D831217FBC626618066E9F25B393B1E6A8379DD785471A64FBC03C0F53614E1CE81C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219624, "uuid": "2a133623-da75-4de9-a154-6ac81567e74c", "value": "1536:Kqmy0pi0wcMlbCUN4gCQZiwotTCWxxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZs:gy0pgGUNEvtTCWzJ9a03fjwe1moYpot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219624, "uuid": "a519b917-17b0-4728-a2a5-4222aa740b6f", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219624, "uuid": "c6ca0aa6-301b-4096-9a63-ba4070fc4646", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219624, "uuid": "b5024ab1-d5ee-421c-bfe0-afdf11063901", "value": "catalog-244033873.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02b4c596-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220681, "uuid": "70408b06-67c9-4955-b62d-22a8ffa27d83", "comment": "Malware payload", "value": "1c1b4c37849195d2d25c5f32f58ac651", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220681, "uuid": "7db8970e-23b5-4f35-b200-9a43fa88351f", "comment": "Malware payload", "value": "3e25eb1b2e742f5028f0f318643744fd4c72f68f58b8c1b3fd5a660b86e751af", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220681, "uuid": "5cd11935-675b-4c3f-b734-79ac3fd10953", "comment": "Malware payload", "value": "8a6931679e60805e55ebea8e15cc5ff666eef15e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220681, "uuid": "0521ed7f-678c-4420-b91f-87fa0458b26b", "comment": "Malware payload", "value": "24345b66899e53cd15162e752e1c0bb0cb68c6b3bb2f9cd93020f406c68ccaffb63c37cc5dd0cc0e8295f68fdf3dc407", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220681, "uuid": "8e5df5e1-b75c-4815-9dc6-ce1fed5ff15f", "value": "7783025B599828FFA295AF10232CD98EA90FCAF4D9705514F20FEB5CD0B7B29726041B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220681, "uuid": "97b31d65-a1f1-4723-bf01-bb54a4287898", "value": "1536:C6sEDF9MwsqZSCzfAkZ8kISNurvd197v7UZoctQ2kPo+4mpRlDi1nUSUqxuu0:C65R6wsqZXzfA21s19T7YptKRNpoUSUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220681, "uuid": "95adfa59-cf7a-4cff-b978-b46d9fc7832f", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220681, "uuid": "291b89db-4cb8-488f-99ad-bd45899c09fd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220681, "uuid": "776b0ed7-ab79-4c35-8533-4ad158484de1", "value": "info-1307768313.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d9df9fa-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220028, "uuid": "eea6aca7-346c-44af-adb3-04b7c94e8e96", "comment": "Malware payload", "value": "65b92ce119e13c21ff777214790b6750", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220028, "uuid": "5770f2ff-7a41-4cf2-af99-bbdbe7974088", "comment": "Malware payload", "value": "3e59d80013cea3ce8e28aff26b23f29e6bea6075a04b178a338f376022d94c0f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220028, "uuid": "a7bc9e1d-403a-4c8a-87a1-50805ce52075", "comment": "Malware payload", "value": "02126f94c5eebb22e1b7e54ab5bf3e5bee0f9873", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220028, "uuid": "34eb8e20-6bf0-43cb-b4ef-79956ee94b26", "comment": "Malware payload", "value": "9b4d73f607d0164f8b9eed432a5de12c7680da8f19b809303af798940b1c35fa10b28b26336ee258894c6a871c9fdcc4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220028, "uuid": "c43190ef-9d8e-4ae2-b7fb-376aa7ffa85e", "value": "8D8312E4C78E0CD5C1558E0D7B22F868B901311C3128B5E7FAAD58B56B534E8A2B3DF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220028, "uuid": "a5cd4f86-0d11-45d0-a31c-26a10b909165", "value": "1536:qE2f1lwz7up/vqBuKXxP8JXvKDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnh:qpcvuBvaXxP8JXoM25NfuQjMCYNBwltF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220028, "uuid": "9c10b1b3-4bc9-4127-8825-652058b028a4", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220028, "uuid": "30bf8314-6aa8-415d-ab7c-b3827292ec14", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220028, "uuid": "490cf174-8679-4698-b7da-eae7e92c5421", "value": "catalog-475471961.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66788b1-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221519, "uuid": "38a1a31d-f8f3-45a9-a517-e21a2d34f8db", "comment": "Malware payload", "value": "81496d512840e4bd6c3e8bf5b3d951d5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221519, "uuid": "5ef82d02-df0e-46e6-a662-e5f1f5fbbf99", "comment": "Malware payload", "value": "3e77ec1739352c7e923fa59428a0df585753848e6015c8e3131df82951aead19", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221519, "uuid": "b3def5f2-dc74-432e-a50f-81c4340b9bed", "comment": "Malware payload", "value": "b82795dc95da1494d82960539a8f3e950bc95f9b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221519, "uuid": "0a38e323-a57b-4e87-98ee-3653d7e92f9e", "comment": "Malware payload", "value": "77266053ace48ba64f440cce7a757fe5532f89e959d184e171c0ba4ef46540b384ef298e67881fd00175426889ffd83c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221519, "uuid": "5b6bc368-cac5-4466-b23f-f1087f887f28", "value": "2E83029C34FF0144967A68B8613FE80750FCAFDB2D37B74947208574AA214DAA62399B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221519, "uuid": "99c81eda-edcd-4adf-8585-13cb3d1fb850", "value": "1536:xr7l+KI0ejUgUlrZKFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbXYZTa4hpK:h7l+NUhlrZ6O6xoKDShicdBMM1/XPQTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221519, "uuid": "a3a5c7b4-2a02-442a-8d76-46e76fae693b", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221519, "uuid": "f9a6f4d4-3822-4eaa-b908-38bb6fd26396", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221519, "uuid": "98c4af2f-aa5d-4914-b5ad-0afe86913cf2", "value": "info-1725886151.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e90055-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220205, "uuid": "e95bd7e9-dd79-4705-93ea-29f2aef6a7ce", "comment": "Malware payload", "value": "653c8b0bca8b3c2e47635dc32b700f04", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220205, "uuid": "18e2fdb1-5da8-403a-ae63-46ac798767a1", "comment": "Malware payload", "value": "3ea038ca8a86a72275bdcbcd8d84ddbca37987f0001861cc866d37a882dcc265", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220205, "uuid": "6e1ba762-95fa-4b14-9eab-5d30542e5681", "comment": "Malware payload", "value": "6dc129f3e6ddcc198769bc282754cc5ed28d6f62", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220205, "uuid": "b32d01d3-b5bf-4a0e-8301-bd16123e04c6", "comment": "Malware payload", "value": "f9a05edf95097f91a9f8c635a3814a0ecd0230c77e50d70bf853254c96f79838459787a52df291b8e8327e0e22c082df", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220205, "uuid": "a258ee59-e091-45c2-aedb-14e0d9855121", "value": "57831277F076E95E829CD0B1901E3A1839F875C3A435978EFD1E3A17C426DCDA91182E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220205, "uuid": "76ba9cc7-f8b3-40ac-a013-b1e25e54f0f5", "value": "1536:5Js4DkjRjDC+ramyNIPjLxx7mgV3e27JWgtrQZcUT7oqlaHvvbFq9GHocnoe1Rqp:rLoNfPrG+vxxSCxIGUT7o/v096oiBkw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220205, "uuid": "8383c049-ac3f-4f3c-a723-f9971b491f1b", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220205, "uuid": "14633c58-8907-4206-b0af-a59816238d54", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220205, "uuid": "cfbeb6ab-5a5c-4cf4-8fb9-db0e1f33cb05", "value": "info-1006950618.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c10eac98-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220571, "uuid": "4de3249e-86e6-406c-b34b-9976c4a37260", "comment": "Malware payload", "value": "5fe7cd3fef3483e211a17db286a1b812", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220571, "uuid": "f8f824e0-98fe-424f-a0b4-8ad1f2d50357", "comment": "Malware payload", "value": "3ea33dd7c935e8dfd3409f8e92f1f25d54476dafb42b0352009ea7e4ec36741e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220571, "uuid": "ae9210a8-8fc9-4c2c-abce-53fdc8bf5cbc", "comment": "Malware payload", "value": "1ca6cca2161d21cfc18113fcc205a22d24bc7f34", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220571, "uuid": "d2630b53-3c60-4fa5-9481-eaa0f94148e5", "comment": "Malware payload", "value": "0729df02d6a9402597f03ff4a237000ccf0028355b01bd785c7dbf4c46de1f4dceb93f73866bac8e446c82aec71116fe", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220571, "uuid": "f9bb9aa0-8245-4302-b509-89ab207d8800", "value": "088312B7F9776DB6C15CE1E7A63F122824FC81C07435964BFA0A5E0AC91AEDD9204C0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220571, "uuid": "9af0a206-7891-4fa2-8f30-3de2ec5f9ffe", "value": "1536:ur7l+KI0FlLHfAkZ8kISNq7xWgwMQZcUT7oqlaHvvbFq9GHocnoe1RqfwSOJrpM/:k7l+6FHfA210waUT7o/v096oiBkwP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220571, "uuid": "91c972de-362a-4059-a9a7-d6c84599220e", "value": 86799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220571, "uuid": "3f018007-17b3-42b9-9a96-f9dd23e1e5bf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220571, "uuid": "d8ee5803-6e9b-4ac2-8005-af5221876bc0", "value": "info-1248320306.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ddd27b-a3f2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1619154911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619154911, "uuid": "7ec96300-c958-46b4-9395-58fb380c8ab1", "comment": "Malware payload (Formbook)", "value": "8d0a35b785328dae72ae7d23a3649264", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619154911, "uuid": "bad9a3fa-92fb-4121-825d-3c47687cd855", "comment": "Malware payload (Formbook)", "value": "3eec4a1ee84f46ac0d1bb9109a7dd86366f8128fec3da8de6c29fc5959d3e8ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619154911, "uuid": "6a2ac6ca-d816-4213-a058-37f319f65e01", "comment": "Malware payload (Formbook)", "value": "2a5c32574c165cbae416ceafbcae8be3e3d06133", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619154911, "uuid": "b2ebe44e-b2e6-4285-a740-9d39dbcdfd58", "comment": "Malware payload (Formbook)", "value": "b884f328b904271426b5805e5c92ed650402cd9df36475031c0b7ed9ae2b7a96a08b5cc8328b112cddb41aa0c163b2c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619154911, "uuid": "087ed9a7-f8a3-44dc-9a41-101c4c8b712e", "value": "FA151295768170EDC9169E765EA09C0066703D3FAA23C60FA15732AD5BBE3C28B116F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619154911, "uuid": "804d74f6-50cc-43df-ac2d-d696c7304c87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619154911, "uuid": "b72facc8-1ea3-42e5-8685-2368afcc54a4", "value": "24576:kadjAv5kA4F8X8TmiPTn6hkYeXHjQ0VKAS0QFyH:kkMxGF8XY7PT6h9oHjb2DUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619154911, "uuid": "bd808392-e110-4c92-8fff-05857d8c8ab6", "value": 880128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619154911, "uuid": "02f04303-072b-4fdf-9c6e-0bd30c867bd7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619154911, "uuid": "9291b346-3e3f-4048-9a56-a8a96336bef9", "value": "Payment advice pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a1513f-a409-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1619164589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619164589, "uuid": "d5500a63-7ddd-4752-9116-63a177c38551", "comment": "Malware payload (Gozi)", "value": "e3c8041126764c7e61efce77c83221c7", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619164589, "uuid": "c0edd334-44d0-49e4-b7d0-fc8ed1f2ff43", "comment": "Malware payload (Gozi)", "value": "3f17ee2621c93c479a64e513126c189328122c12936c9af24c5d7b482164c13e", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619164589, "uuid": "1952a7ab-1080-4b9a-8607-52ad34a6e1c7", "comment": "Malware payload (Gozi)", "value": "95f388c87c8b2b7b04234365c1395522e451d185", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619164589, "uuid": "c29d3fd5-bd10-4028-8469-cac574bcafc1", "comment": "Malware payload (Gozi)", "value": "1b319a0b767c9e008ac2220fd2d3ad5cba8517cd399fe6c203b75ce2092f70f66e371fc70748f107b12b20f0b3e2a92e", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619164589, "uuid": "66dea882-43fd-4474-8a0d-21febdbbbb0c", "value": "64D17D0F6E408D35DB6B68750B5FB06B9D28DDF6008AE30313A5085C8F1D465DE57B8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619164589, "uuid": "2cef566e-ca23-4537-ac16-ab0b9a64c94e", "value": "192:gIcqK7AsEhntj5mP3F3fvPjlnqSMvtM60GgyB+Fded9:gIcqKulm/FnPRqSMFaTyQTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619164589, "uuid": "548ffc4a-0a5e-4bfa-83c6-4a6d75428fb4", "value": 6624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619164589, "uuid": "bf0091f4-9bbc-4f9d-9f35-b55ea27390e7", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619164589, "uuid": "cd98d3b7-a745-432d-a337-08de99f26215", "value": "presentation.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bef3b8b1-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219708, "uuid": "f74f7155-5209-423d-9fb7-4f63693fe506", "comment": "Malware payload", "value": "c3b80cebb085470de72bb8a4ba8adb50", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219708, "uuid": "2e110116-cbb7-4723-aae8-c4b1d3c10983", "comment": "Malware payload", "value": "3f2ea4d22b805c02956c169548bc7cde3ebc08b7ec012371c907cab1e60cd2c6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219708, "uuid": "97a22cfc-db30-4148-9639-bd777737466d", "comment": "Malware payload", "value": "dcb74ae0f75b917ea8fc06edc9ca1299c28cbfb9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219708, "uuid": "91067ee9-e720-4f73-9d3b-a06033e8fa60", "comment": "Malware payload", "value": "d26421b59f204ef7e20b9d23121d5e0f892f90d4e100ca7fcd75eae2b3b2bff6ef07a9ce579a3b33fb0301dc2e19388f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219708, "uuid": "d622fe8c-c78e-4cd9-af9d-25a38ad66baf", "value": "F98312E87E27A595A3B05A8AC0FFF4C51F9547E8C85AF0A31D09BF3588307DBA115074", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219708, "uuid": "ca317eaf-d6f0-4ce5-8510-d7f71c54d5c5", "value": "1536:T9AUAlZ2Ymk7x3wRBD7flm7UjoB8+wXdpUna5ahL2dmTLUVVv9:JAUAlIYmwNQw7uXinakEmEV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219708, "uuid": "9aec8722-282d-472e-b9a3-8339adebb50f", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219708, "uuid": "117d7071-056e-4cd1-a758-0ede73fbf99b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219708, "uuid": "5b4779c2-dcd7-4e5f-99b0-66c487a4292d", "value": "catalog-288909016.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "766b3a32-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220016, "uuid": "e78aaf31-771c-4c3f-9869-213c84229ae3", "comment": "Malware payload", "value": "8741d012b9604d469f5318ff2ecfdcb7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220016, "uuid": "fb403db2-2ce4-4511-b868-751e1fcbc66b", "comment": "Malware payload", "value": "3f4c24e643610e8b052ba006a8e16045434245d8d13121a906157ac8e43e2c00", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220016, "uuid": "31777000-5ac9-4755-87c0-2ad1df4df8db", "comment": "Malware payload", "value": "052fedaee934e2d56bea91b95c95584172a63616", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220016, "uuid": "3665df26-371e-4ff1-997c-b52c17d69021", "comment": "Malware payload", "value": "3150a52a2d657cb18eb519c754816a4d8a042d4771dbcac04cb4b7ebfb1e3c22f573682cf079358f507740bdcffeb91f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220016, "uuid": "bb0df37d-58a7-4c6f-9845-807a33556dec", "value": "758302E925423ABFC9FD951D206F3D402EACB2E56E3212E7D207D93770F5AA894D0718", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220016, "uuid": "781e0eca-0ef2-4e6e-98a6-eb7db366ec14", "value": "1536:zF5u1k94TfvqBuKXxLG1ZQUcDwiFALqCJI3+xOtGkwdO2eDiFXk:zF5fsvaXxLG1ZQUcD1FALAOxeh4ONqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220016, "uuid": "e8da8b57-35d0-48bf-8e47-be1c61d56cae", "value": 86930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220016, "uuid": "79442428-1339-4c61-a78b-e641d997a94b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220016, "uuid": "3b4f3765-4971-4b57-b19a-f474d4e70950", "value": "catalog-470889143.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46307827-a3cd-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1619138760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619138760, "uuid": "e68a4a64-2ee2-45a9-83d5-3072aba684f1", "comment": "Malware payload (RemcosRAT)", "value": "7eef4388419871c28b8f36837eb7f090", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619138760, "uuid": "41def997-5333-47fe-bd20-202c76199a3b", "comment": "Malware payload (RemcosRAT)", "value": "3f696b65e7fddd6302252e1775e3186d4a7bc513784a9b734a4d60a7726e7da8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619138760, "uuid": "9ad5d83a-04d4-41a6-8d94-2f6838b5f568", "comment": "Malware payload (RemcosRAT)", "value": "4688ff284afa1cfc570be9905ff91368cdc202c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619138760, "uuid": "9fa78711-2f43-4133-8ce3-87c30a31d995", "comment": "Malware payload (RemcosRAT)", "value": "692bb1bddb37e1e09591601516e5fccc9a4e7787a499c044b5cd38cb30690cae8517f04021b78400abdb5d4b40480fff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619138760, "uuid": "3fb69a25-c824-4caf-8518-31af6690601f", "value": "4B04E7A0F2DCDCD6E81616744C36EC241267AF7CA4B5451E25AE713AB9B3393206BD0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619138760, "uuid": "24eaab85-b4a9-46a8-b70d-89ef5931be38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619138760, "uuid": "66975584-bb66-4524-b217-822130c955f3", "value": "3072:QFr+qEM+NQfqNliqk7jCvHAAwCDKY9Hd3q5P+qYVY2YzY8b80BcY98YtrdYYR3Yq:Qd+RypUvI/p260xsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619138760, "uuid": "62e352b1-b9f7-4162-bfe8-4d5ef5af9f05", "value": 185344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619138760, "uuid": "37ff9dcf-58af-477f-8340-2f1375fb4c4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619138760, "uuid": "f181f64c-9699-409c-8dec-4bed1082bd86", "value": "Factura Serfinanza034712604259512713576096038.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f15ac7-a41f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619174054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619174054, "uuid": "ca3adc4e-c521-413f-8951-eb7c54504acb", "comment": "Malware payload (AgentTesla)", "value": "6051d1962c6b0f2d8604e119e07b0a37", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619174054, "uuid": "f596bdcd-463c-4241-9202-1ac6c93730ba", "comment": "Malware payload (AgentTesla)", "value": "3f8541ddb0945543f5186db54af3caf36d73bffc5c9ba8d1e66df9b17c125a7f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619174054, "uuid": "aaae0cb0-7eaa-404c-a652-4c0025625ad3", "comment": "Malware payload (AgentTesla)", "value": "c5399cb41b541226748dcea02c8dbe3d64e26581", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619174054, "uuid": "5f1e8400-83e8-4cd1-85d7-b2b1af722306", "comment": "Malware payload (AgentTesla)", "value": "c3bd1c48b61d4dc521f94a37934292c8090d84db053fe2169b188ae07f7b0f9aca504bdc05595566be5093c01b368f4b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619174054, "uuid": "2ffa0d27-e0e2-448e-abae-3612a37c19a7", "value": "9B4528D8FD07F58EC41689F1C95CCC2C9651DF66830A9E03A04BF398996969EEEC81F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619174054, "uuid": "46451962-3972-4115-8dc2-6535f7c1174f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619174054, "uuid": "f5bce901-2413-4307-8df0-33192725dc28", "value": "12288:chHN6I3X5UKouBB3zb0ZIto1epZOWwj54tivNTF55YQ2vCXwgQa1jSNs7VHmRd08:cSU5UduBxSeXOt5B51YQyCXnjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619174054, "uuid": "be6b6509-3340-4ad0-a981-7bd99d56fba0", "value": 1190400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619174054, "uuid": "d639ab2d-d1b9-4e32-a5eb-4cfdc68523e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619174054, "uuid": "9a42dfd3-0464-48eb-9d9d-cff23fa23ced", "value": "PO#ZAMELEX_pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37102312-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218192, "uuid": "745cdcb3-6101-412e-b933-9cd976845cf2", "comment": "Malware payload", "value": "228f00b3825586f5cc83fccb6a008ef2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218192, "uuid": "7eafe796-1f96-4456-a40b-9edb23ae650d", "comment": "Malware payload", "value": "3f8e9111eeae5b907ab93d3d10fbae94d07ec019a9d4cb2b73a82bc5bcab7c23", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218192, "uuid": "7297ce11-9248-47df-9018-4faca713d175", "comment": "Malware payload", "value": "df4c631f15b7d20d080270139f82b6cff5cbf31d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218192, "uuid": "f385880c-6046-4003-8cdf-8f91ec7139bd", "comment": "Malware payload", "value": "95bbee81a973cc22740a6e0247c324a8874e70eebe7afcb6d5f153f041694d2ab39d6439aca862c928f5e355042e89aa", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218192, "uuid": "f068c229-93c9-48e8-8d9c-1caefcbbf8f6", "value": "978302ED3A16C666E2B1931DCD3D88C533A29EB8A00EF0526C4F7F7A7D2156F9411534", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218192, "uuid": "531abe73-fe7f-4538-9dac-2134fb3d127f", "value": "1536:PRn2h1Uf0IbwZQ72ZTYzqcIcUjoB8+wXdpUna5ahL2dmTLUVVv0:PR2hsbG6IcuXinakEmEVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218192, "uuid": "f91542cc-cd3c-4877-b66c-4474dde54afa", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218192, "uuid": "b00d3d6f-6025-480c-9458-b164fa00c8c3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218192, "uuid": "25453fca-00db-47b1-afc9-aef4f96de973", "value": "catalog-1390547070.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d74932b-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217692, "uuid": "c9afb9d4-9e11-4b0c-9e03-d6c30ca782ee", "comment": "Malware payload", "value": "7d4f2dee2205b4d2cb55d69c3966ac4f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217692, "uuid": "5817f270-dd9c-45d7-a878-11a31e361cdc", "comment": "Malware payload", "value": "3f99c3a734d89e05c6684f656dbeb4eaaa7aeafb77dcbe167af7f904628497e8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217692, "uuid": "9002243a-6307-40c0-bedf-c8c749124dc9", "comment": "Malware payload", "value": "ae8f3b89fb17ce41cd46a3b8b37332f43eceeb6a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217692, "uuid": "d20dbc70-d2f7-4a58-ab7e-ef17c9967722", "comment": "Malware payload", "value": "82dbe84a15c563475332244051a52dd84b39a48b923d521e5ae111a3df86a4d5186f4bb5943d95da91e484313e69e180", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217692, "uuid": "5f818d08-cd4d-431b-88e8-37f9b28834b5", "value": "468312EBCFEA499842027F0673069CBBB45428096118BAAA7EDD11506F524A0F4B7DED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217692, "uuid": "a8e8678b-6b77-49d2-bb52-507d0835abd3", "value": "1536:Y1KLWkP7EBmnbRARpNdZ2rQD2FPdo1f+5ff9fuQjMCYNst+IHClPLqkwD0DCuADh:kKLWSFbkpwQKW25NfuQjMCYNBwltD0DS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217692, "uuid": "b9c2a37a-2e43-455d-8590-53f6ab242123", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217692, "uuid": "258ac298-dee0-4670-8bd1-2d0f98465b94", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217692, "uuid": "9ae6fa42-1280-4fbf-a4e3-2c879885c568", "value": "catalog-1105940166.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d636c8da-a423-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619175938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619175938, "uuid": "b89d4f81-ba33-4d4e-80ff-e727f2688fe2", "comment": "Malware payload (AgentTesla)", "value": "8f78ada09b50ccbf1cfe6ee2300e4506", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619175938, "uuid": "032f0be4-91d8-46eb-bc78-12f673f53f85", "comment": "Malware payload (AgentTesla)", "value": "3fc7c77f77d451e79f13d209a4b9e825c0d26ea410dc58aedfc5179b687b273f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619175938, "uuid": "73827977-8dcd-47fd-b89d-0229d5046e63", "comment": "Malware payload (AgentTesla)", "value": "207c3fab096b0512801c00827aa9e9dc4952cc96", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619175938, "uuid": "7560fb17-9cba-4f01-b5b8-2186f07a1172", "comment": "Malware payload (AgentTesla)", "value": "b295b9bbdfef23bb5532fc8371d3ac2c146d3e36e52de6151519210db1678ed7982f97c6f64337701c8724911f405b8c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619175938, "uuid": "df1583fe-a64c-4075-b8fe-d3d1fb0bf71c", "value": "6605337A88211FDB25EBA89CC16CB75780671F0110C95572FE43A972AF1122BFCEF985", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619175938, "uuid": "1b7a6bdd-fff1-4dd8-a9cc-84652fa61459", "value": "24576:7dKDJAiZYUSHBpzsXqWcFFHmMz5yi4ZDOvjDJzZ:wFAiZB6nwuLHttyPBO7DJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619175938, "uuid": "d35e3c68-c20e-47e6-a7ae-5704262d1bca", "value": 856353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619175938, "uuid": "f8b5fc87-7153-4a5d-afb4-c4374138254f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619175938, "uuid": "9adb445c-9dba-4c9f-8d47-66a07f928cbc", "value": "_New PO.xls.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "831ea347-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220467, "uuid": "9bb07e98-a5e2-4553-88c8-294bf85a5309", "comment": "Malware payload", "value": "5c63022a2dabcae824c487f45a7f565b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220467, "uuid": "a30872be-4ac2-49d1-9c5b-a660e0492ee1", "comment": "Malware payload", "value": "3fe3a32ac7670430a05b978993795d3089a33c5dee7ccaab2ce897366a94bbfc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220467, "uuid": "52cd90fb-4108-45a0-a33a-a17d27997fa5", "comment": "Malware payload", "value": "17b2559e2bd0a2fffad2f73d5322d6e079d0be23", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220467, "uuid": "7ec1040f-ca64-4b00-bb1b-8204ed7d4394", "comment": "Malware payload", "value": "5056558e2027a6887679f60a6f931dd980c414d0d00875459af7bdecc551c2fb2ba039704e42eedb3b61593df92fbd56", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220467, "uuid": "52e1df41-3faa-4abb-8d6b-a0afdd453221", "value": "0983029C30FF0144967A68B8613FE80750FCAFDB2D37B75947308574AA114DAB6239AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220467, "uuid": "eff74d5e-87a7-469a-af52-c485c95a40f7", "value": "1536:Jr7l+KI0ejUgUlrZKFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbXYZTa4hpn:p7l+NUhlrZ6O6xoKDShicdBMM1/XPQTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220467, "uuid": "033dfac3-07f7-4e6c-a753-63f9a06f2c26", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220467, "uuid": "b32e1592-c77e-4528-8cd4-2e668e4ada59", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220467, "uuid": "ffec9ad2-4f58-4a1b-8205-04e5ae8c432a", "value": "info-1181190812.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d8dbef-a3f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619157169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157169, "uuid": "4d35539e-67d6-4213-bff9-36f9ba1099e2", "comment": "Malware payload (AgentTesla)", "value": "81ed6839e74cd80ee145a52ddc216a99", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157169, "uuid": "a912ef9b-c99e-47a7-8cc5-ff0bf29123cc", "comment": "Malware payload (AgentTesla)", "value": "3fe945c3ce7f06530c3eac6f88fec404a7757969fbf2163361e27a0db8bd2926", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157169, "uuid": "cb83fc6b-45cc-48ce-8300-6dd5efcfded1", "comment": "Malware payload (AgentTesla)", "value": "21650a9d6a82b7dc1af9bace9dca1ebe0376c1a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157169, "uuid": "ba7411ee-3a50-473c-8e61-f964288440e7", "comment": "Malware payload (AgentTesla)", "value": "6e81ce9b6b637482f9836fa6ceb92aa1e59678c98331f1bda25be7a3d0a7c1c8f342801c39ad38a95611ffa93da40b43", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157169, "uuid": "e72acebe-8d8e-448d-a13a-0c416c234227", "value": "6305F1A1315EA30ED96D56B829B127F153766D07BB46EEAC3EE8350E9B77C020700B35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157169, "uuid": "7d535ee1-a3ac-419e-80b1-0ffb6b59aa1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157169, "uuid": "b9081a51-1b84-40c3-9016-e9b05ca8bf7d", "value": "24576:u6s+zu602cWZ6G1HKeCpvJgXrZqlFuOm:bA46GwJdObZku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619157169, "uuid": "fb24cec9-570b-466f-a327-492d7d499368", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619157169, "uuid": "ac763966-e1f2-4708-9d01-f8e6c276adcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157169, "uuid": "ad91ba5a-963e-44da-96ee-d4e3d2294391", "value": "invoice 56788950954.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d5d8cf-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218731, "uuid": "42c44f48-a5c2-49ee-a479-dbb4a28f75c1", "comment": "Malware payload", "value": "be3d71edd3149dad4eb6af65073556ee", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218731, "uuid": "1cade45e-f58b-4430-af0a-fdeb6e5a182d", "comment": "Malware payload", "value": "3ff1a558d90d90dc66ab701e00b0f1bbfdda804c3ae5bb4fde95267515513efe", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218731, "uuid": "0a23b469-95b8-489e-844f-b9cfc5b2e301", "comment": "Malware payload", "value": "83eb9965e1754030e92d8231b9a90a2425572b7c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218731, "uuid": "c846f28d-aef6-40a8-814d-88efcdfe395b", "comment": "Malware payload", "value": "a2b40f7ef42cfd1513c34d5f48d2d1fc12ff754630f6309fe6f65ebcb356bb0bd87bb2ed3efedd5abe42e5d73251b23a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218731, "uuid": "04d2b50c-bf08-4ce2-8b13-5b796548b7eb", "value": "6A8302176BCB71328046E7B14B353A09A653BEEE540C6056DBEF4778FB3201568AC1D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218731, "uuid": "f960371a-a6d9-4869-8e6d-b0311fd39b83", "value": "1536:gRn2hxVTZQ72ZTYzqcIxxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZiZtF:gR2hxVB6IzJ9a03fjwe1moYpoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218731, "uuid": "b2bc0b8d-6f3b-43df-8fb5-f69f0e3e8917", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218731, "uuid": "af001641-6e7d-4dc2-bbc0-c8860c92cd55", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218731, "uuid": "c56eb792-72f4-4d24-9bff-5ea046fb43bb", "value": "catalog-1684924634.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8788dbb4-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218327, "uuid": "c16d3cfb-52f3-4878-9214-8ca3e1493021", "comment": "Malware payload", "value": "3b3994e9ee3f2001bcbeb5134ec523d1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218327, "uuid": "2f391acc-ac5e-4fb2-bd55-84eb0dc2c47e", "comment": "Malware payload", "value": "3ff69b2a37d6802dd7abe417a604d649f65e6a9c6ede1d99e34206731eee0dd3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218327, "uuid": "275a92ef-483d-45c0-8a03-5181bc8dacb6", "comment": "Malware payload", "value": "0594e0560c24928ed37a1584ca8ad35c0e103f1b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218327, "uuid": "5d4ab961-3e0c-4bed-9a46-df953ec19b09", "comment": "Malware payload", "value": "cd457097f5724915bebcaaa9da7bbb576ddacdd0787f9ee06e273d837fd2debf63e111aa6102b174b4cc503f4a4e40af", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218327, "uuid": "07a9b415-1f72-4fa5-8e02-4aefa2296e8a", "value": "9183028BB4D8433ACB3523F658AE5E4426B1A47F040CCBDC75D73A786B53672A572388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218327, "uuid": "d2f0ea15-6837-4f31-8fa8-fa24cb692af6", "value": "1536:xEwAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJve:xHijtuPmU9j7+XFWtYe14hbOjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218327, "uuid": "e1e5696a-fef9-45de-8cc8-0fb89609edbb", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218327, "uuid": "21e8282f-6e11-48e3-8ec7-46ff82ce62ee", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218327, "uuid": "28deea03-700c-468a-aaeb-964318b04680", "value": "catalog-1444654774.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7df974a-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217951, "uuid": "b61ac777-79f3-4d50-bf30-a910217fa723", "comment": "Malware payload", "value": "3e0ed02cc7febb6e8d1b7a4752ff0d5e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217951, "uuid": "686c15e6-2c9c-403c-b924-79a600cedb68", "comment": "Malware payload", "value": "40343224079f26aaa33595f26487b21929a9c378fe838565954c9db9c14a56d6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217951, "uuid": "2dad05af-3c16-4cca-8afb-a7c0421d397d", "comment": "Malware payload", "value": "8d1458959d69036fc5e6964cb23d5c9fc88e6a92", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217951, "uuid": "e4cfe068-8d6d-4684-9214-e987197da827", "comment": "Malware payload", "value": "7f3c41af9e28140b29e98d9354b58b6e41edd7a0c447d3d924c928c35585b43602afd05edcad6c30e57ce4387ed54ab3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217951, "uuid": "dd6ce0c7-ce9b-4aff-8146-c0b09e8730f4", "value": "95830268CB9F8D849005ED0ABB12F8ED7550524C716973ABAFAD1124FF478D5A2338F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217951, "uuid": "3cc29a59-9e34-4473-bd77-544481852632", "value": "1536:+A6P7EGmwH1zVQLQDYflSJXvoDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnu:+AY31zVQnIJXaM25NfuQjMCYNBwltD0V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217951, "uuid": "17f624f4-2b53-4490-86d3-0e6610a652d3", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217951, "uuid": "48d247e5-5b8f-491b-8400-aa87f6a163c7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217951, "uuid": "e0f327d4-99ea-481a-9490-2f256a50d4d7", "value": "catalog-1252723368.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fede2520-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221104, "uuid": "e50bada7-f209-43d1-931e-d88a978afe69", "comment": "Malware payload", "value": "cc03439595a9af3591481b1e7c10edd5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221104, "uuid": "67f25457-5c0c-48c2-975a-0506d4c4e49f", "comment": "Malware payload", "value": "40be742654bb8ca3a993c1ffaca814d4410c36ce8661b3a8610a0b81cb51941f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221104, "uuid": "a6951ea3-2abc-424c-9a49-fb0c5f2c7540", "comment": "Malware payload", "value": "f19df2b55da2f3fab4f9c291ca8efb7793b0b173", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221104, "uuid": "80df299f-04a8-494b-91fb-64e9af8421cf", "comment": "Malware payload", "value": "5787a7e3fec85b44f2f726d88a0c8e015d2744ab1d19093639ecd5e5fe1bb0530dad2b960961f315543f4b26c1f60806", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221104, "uuid": "2fc8eea4-8bb4-4622-a0f6-566162d2d20b", "value": "D283121A99BD1CD9C0BB13F00D73094D4860EF7D411C8449F11AAA8F78AEE85DEB7AE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221104, "uuid": "e781b138-139d-4427-8936-12774a87a80c", "value": "1536:lt1QVGeGAg5dwSp6yMvBjqqxPGLuhCWdHsh1oSFWsfEFhHqLWB:VAG7A8l3MvBjqq5OsZdHAO5hKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221104, "uuid": "e0cf2952-4bbb-4085-91a9-c16e37592e72", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221104, "uuid": "ae2fe5f8-2fe4-4962-8530-72052521e78c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221104, "uuid": "72ae40d1-d401-47ec-866d-92f36048effc", "value": "info-1493499482.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19226e20-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221148, "uuid": "f647e53b-96fe-46b6-8714-ceb99a9b8355", "comment": "Malware payload", "value": "2d736c4aa12875769f76908042735af1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221148, "uuid": "82c0297e-466c-4247-89e8-6ed074aaa435", "comment": "Malware payload", "value": "40d0cb8cbe03ef01e32d1cdc177ea7472f29e1b05093c46dede12f3466593984", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221148, "uuid": "60b334c9-ff52-4a4d-8284-d9f21f3d6e68", "comment": "Malware payload", "value": "4e2f0217b110ac9378d0c5d064b45220a45d357e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221148, "uuid": "a8e97ad8-a2d7-4b55-ad3f-06b2dae66503", "comment": "Malware payload", "value": "3dab75cc571085c04ec22ba5b211d5961c1ad607e69c8d1df2f6fdeecfd89a5dc01d5af5871bbe99392cdbb5fc0023db", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221148, "uuid": "b1993a52-b587-465b-ac77-7e7407766b2b", "value": "128302B7322D0BEF904AB89B509FF5F9B156693E5C2EE510B3642D20357143AA411EAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221148, "uuid": "6adf3ff4-3dbe-4553-94f0-0750bfea740a", "value": "1536:5HQBAV8QI/AATZvjL3+xnxv5ZUS0hhcBrasoi8vQMwdjVH6CTh:518QI4AZP3+9xv/UpDmrajvI76CTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221148, "uuid": "241db6a3-66bb-4248-8a9c-b9530737ba58", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221148, "uuid": "0f26a14f-deed-43d2-81dd-c15cc12d8444", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221148, "uuid": "e886c124-a0a2-482b-85e5-174335d3aaf9", "value": "info-1509999166.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e8a17db-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221237, "uuid": "55b826b3-4f71-42db-9228-3e2a1bac585c", "comment": "Malware payload", "value": "419354a27d231182c861141bf56c7863", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221237, "uuid": "1903a0ee-443c-4919-be85-d04a9a33f278", "comment": "Malware payload", "value": "40db5fadf4888d0c932634e9e5ef90441632847f1f23568f796b993e43431f64", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221237, "uuid": "8c1189a3-262d-415e-8f03-6ab7caf505de", "comment": "Malware payload", "value": "1e9f41eadaba37b5edbfcc3d615186bd1ec6be9a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221237, "uuid": "947cd640-741f-4160-9de8-82d913065dda", "comment": "Malware payload", "value": "7fbcfac3c1b54e35e24e14d86775d42cc59d77065b19ea360740d0a4e5ecc7796de5cb9e05a8320c2ae867687deedb38", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221237, "uuid": "436e770b-704d-4372-b6d3-8cd259f4c12a", "value": "B783124D35EDC040E17F7D60636AAD5901F8AF4BEFFF9164CA6961329801863EA0368E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221237, "uuid": "76f2cdb1-ab84-4595-9ebf-67869e9168fa", "value": "1536:UwJNfD6jITxi7UnLkb/Yw3LCq1GeOuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbz:UwzOEliUne/L3LCq4kO6xoKDShicdBMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221237, "uuid": "f9eb0157-507c-4fe4-a8b8-9d09eef67d06", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221237, "uuid": "055da914-b0d0-47ba-b354-ad811f46dc15", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221237, "uuid": "32bcbf16-6bb0-42d9-bb82-eb95533d6aa5", "value": "info-1568498491.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5197fe44-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217807, "uuid": "fd9dcaea-6597-4c83-92e9-0c10cec27f2c", "comment": "Malware payload", "value": "232c938d6e44d1a0a465b713ab186d94", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217807, "uuid": "a65a8eeb-855d-4dbc-a1db-f90b14b74a82", "comment": "Malware payload", "value": "40ddc64ca436ecfb6957aa2a2021f8ff3db59c8732786bf57114975725c5e00a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217807, "uuid": "7877b0c9-e38f-4593-8fd5-888def93bc77", "comment": "Malware payload", "value": "c6a5acc74090b07c986cc9633e447dd365f94d82", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217807, "uuid": "d484883e-ed4b-41d9-8367-81e4eae5a04f", "comment": "Malware payload", "value": "ce5a9b2c5ed884cb7b4e1cdb8e6612eda00f127c9a82fa00534f90a607c36bba40102e6c7dfee3a3bb6ff0563c44def9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217807, "uuid": "6a28dd5f-2a89-431f-be78-2d7da3ff0502", "value": "0983121F7B8B7932C057A3718F352A0DA293F9ED240D6159EF9F47A4FB2600A58681D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217807, "uuid": "ee5b80a2-d126-484f-8fcd-36f7776262e0", "value": "1536:fRn2h1Uf0IzwZQ72ZTYzqcIxxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZiZtQ:fR2hszG6IzJ9a03fjwe1moYpo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217807, "uuid": "34727ae8-d99e-4385-8622-ff3422feafd5", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217807, "uuid": "f7ed20d3-4046-4b5c-beed-568f93383d3e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217807, "uuid": "3c1dc31a-e1a8-4a57-a257-cdb0ade3b3f7", "value": "catalog-1177894141.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec7593ca-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221502, "uuid": "6e8ea81f-388b-487e-89d5-d903f0f454f8", "comment": "Malware payload", "value": "f7759562d5f4eda621843e50cb139d07", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221502, "uuid": "75cabb5d-0780-46ed-8fb6-0e4c5c96bdf4", "comment": "Malware payload", "value": "40f7d86c61b83d4f48d447d9bb341130e626a48da2b97534d9d149a3827a47da", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221502, "uuid": "c9b1eef5-b846-4aa9-9eae-33af16f36c7f", "comment": "Malware payload", "value": "205a6788fed7c4ef91256dcf74d358b462f89e89", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221502, "uuid": "3bf5297b-f449-4918-89a3-d7059f81cdd7", "comment": "Malware payload", "value": "3e9e8614652f0fa4e7cc643bcb9ab77c53763494ec8463bf5ef270b908afc1df270136f386b162a3d8f66ada6dca8f13", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221502, "uuid": "3f0892a5-82ae-47ad-8af5-310455872e9a", "value": "D283124D35EDC041E27F7D60536AAD5901B86F4BEFFF9164CB6961329801863FA0368E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221502, "uuid": "3a213888-827f-48bb-8ae1-8e2cf4fb2422", "value": "1536:ZwJNfD6jITxi7UnLkb/Yw3LCq1GeOuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzb9:ZwzOEliUne/L3LCq4kO6xoKDShicdBMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221502, "uuid": "9b36d7e5-f5fa-432b-ba92-7dd5136bab16", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221502, "uuid": "a05bbce3-1cba-4683-8f1a-4a66f2e58ba9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221502, "uuid": "c4133039-e91a-4a07-b36a-f43919ba3eb5", "value": "info-1722333555.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2abc739-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219365, "uuid": "cd698e30-46f5-4d1b-b0d6-3ab343ebe4e5", "comment": "Malware payload", "value": "0ee9461daf5c38df21062d78642227b2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219365, "uuid": "3e759d49-69f3-4ad3-b0d3-28eaf4ba7122", "comment": "Malware payload", "value": "4132be7aee84bf60dcd1e4cac94399f1883af97684ea48b3cf27bf65f4031306", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219365, "uuid": "199cf8c8-bec3-49dc-872d-9f9795878047", "comment": "Malware payload", "value": "fe0f9463af751de32472a717ca2ff092b4d73462", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219365, "uuid": "61edc014-dd9b-428e-8494-b0deae51a294", "comment": "Malware payload", "value": "8df9bcf6d52483b46c9c10f24b388b587b83ed001016ab793bb1c696057a641bd754e11ee93b0dc5d6c53451e49c0826", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219365, "uuid": "981dc1bb-bff4-411c-aaf4-05de9ecb7c5e", "value": "4E831232D6CB48D9E404E1501595BFA67F6A9763647A0107B878F87F3A6B4BC0C11BD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219365, "uuid": "063fe97b-8523-436c-9b3a-0e18e08ee3f4", "value": "1536:IEV2KMwcPGjVWvqBuKXxH23yWxaqQ6Rxt5AB/adPwL3VbCbp:IC2MEGBWvaXxHpm/Qwt+aZaxCbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219365, "uuid": "e8ca70e5-dbfe-44d8-82cf-c6174a1c60dc", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219365, "uuid": "077a0f03-7af4-484d-be3c-1e1e024a5b1d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219365, "uuid": "350119ac-bccb-4a50-bc2b-936330741f96", "value": "catalog-2040241957.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb58f4b-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218602, "uuid": "b6d4902d-afd0-4922-8ed5-f7091f9b73dc", "comment": "Malware payload", "value": "825dcef6e475e77e3535f7ac2c161e25", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218602, "uuid": "97730877-709e-472d-bbc4-461a8610b312", "comment": "Malware payload", "value": "416d3aa3af0c83a09f8d7b6720dede277f41ee0a9d6663cd29a482b55dd80689", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218602, "uuid": "41e3b497-1071-468d-9db8-09fc99cec0fc", "comment": "Malware payload", "value": "5b9f94c375757263a5bada83b3e6de844dc44970", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218602, "uuid": "e335ac1f-0765-4387-904a-7d687ce7bcfc", "comment": "Malware payload", "value": "f5962fdd55da842f55dc7ca02981a334a35e7d98df4fd036e4b76871993d07ea63128697d3024055ef29308476ae17bb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218602, "uuid": "20f925fd-b2eb-462c-9418-714fa321c237", "value": "5D8302C5FE771FED9C988D358066ACA41E17CB85D11B2268B02C39F3261DBBD67018E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218602, "uuid": "762d11b6-a022-4ee5-ab8d-8bf80341416c", "value": "1536:iE+3fNtg2tq2vxQqAvqBuKXxLXUAAWBHTe87VqINbtezgVRxr9AiUbQTKXs8FI+E:ilPjtk2vxQFvaXxLXne8JqmdIbLjFRbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218602, "uuid": "58ef1520-f3f8-489c-b655-6ef296bb150c", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218602, "uuid": "658c3631-6501-4632-b028-8347d100d15a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218602, "uuid": "7908bbbf-e08a-4d4d-9311-116f9029856d", "value": "catalog-1625228613.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b84d7d-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218166, "uuid": "55df1081-7374-4cc1-902b-e04dedb7dfb9", "comment": "Malware payload", "value": "9e003a375e12fcaf05aed16e4308035c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218166, "uuid": "ceb71143-35a2-40b3-8f35-1fceb5fb872d", "comment": "Malware payload", "value": "418c4f595c1d02e86fdce6145563ce2cd713e8f8841c6a1e22a8a59822add418", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218166, "uuid": "b522ab68-fb0f-4411-bae8-c5259c2a04f3", "comment": "Malware payload", "value": "c0848769522536edc78c8b97fc1cef1ee799c50a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218166, "uuid": "3ca9525b-0031-4870-8dc0-c3b9b126827a", "comment": "Malware payload", "value": "7790a39b8d7d06e1760f802d7c643a13f417b77565de83f819e65cbd7f242ba2d4864a301abf80b335823e52a9505e6f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218166, "uuid": "32d4265f-3ab5-46a9-84f0-3743b5bc1406", "value": "838302EC7A1BC68AE371835EDA3EA8C133475DA9C00DE062780F7F6B64216FF9525160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218166, "uuid": "5b16447d-14e2-4e1d-9dcc-2db561af2d37", "value": "1536:pf1lwsMJDrdAZQ72ZTYzqcIkUjoB8+wXdpUna5ahL2dmTLUVVva:xcbt26IkuXinakEmEV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218166, "uuid": "b3d40db5-c242-42fe-a52a-be6def77b169", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218166, "uuid": "9a22903c-1c43-4d70-93a0-082ad06d2c1b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218166, "uuid": "4c22eac5-0363-49ff-bcf4-275ab8cfe994", "value": "catalog-1369035567.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "434a6e7a-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219930, "uuid": "584091d2-edfc-4b8b-8418-6daf97f0ee8c", "comment": "Malware payload", "value": "ae6713efe931e34deda9bd7d45c68777", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219930, "uuid": "1ddbda80-029a-4ff3-a733-69c65e59ee68", "comment": "Malware payload", "value": "419943b71c6cf06e12f604114b21603a2397ef31b4907aae6a68af193abc0fe7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219930, "uuid": "bbd0238c-3f54-4d05-be5b-9a463cc9d1cf", "comment": "Malware payload", "value": "d4f17fb15fcad16d94904e2d0d53bd2296d8d9d5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219930, "uuid": "be28e7d7-4315-4cbc-b94b-20cb4c4f74df", "comment": "Malware payload", "value": "b5fee8457e3d5ec15bbea72ce1526f113957c904dee9d931cfd77d4d38c65851205b0669d69f0198d822c6a62b773a54", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219930, "uuid": "da67d813-635d-4684-bba4-637e5c830dce", "value": "2B83028BB4E8433ACB3523F658AE5E4426B1A47F040CC7DC75D73A786B53672A572388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219930, "uuid": "539bbf08-ddac-4e91-9d25-1fa83b93b1a3", "value": "1536:fEwAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvQ:fHijtuPmU9j7+XFWtYe14hbOjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219930, "uuid": "7b75e745-a961-465f-8e3c-e410d8df609a", "value": 86930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219930, "uuid": "037f18af-7153-4fa2-aee4-c68d37d7ffd7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219930, "uuid": "def89e67-4868-4d99-a8f6-debf9fa6c030", "value": "catalog-421172794.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c81ab09c-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218005, "uuid": "cc3dcfc5-8a37-4a72-bb62-87508eebf61f", "comment": "Malware payload", "value": "2468b3fc4ac15fe8abf87526613b8b45", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218005, "uuid": "65868668-b21d-4229-b2d2-18551aba0a51", "comment": "Malware payload", "value": "41a8dd3ebd3ccecc42c0b58c90b477d2da4d29ec7f743f447953b6ef3772780b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218005, "uuid": "7d8256bd-cede-48d2-befa-49989a81fb69", "comment": "Malware payload", "value": "7f3238cbaf191bc65921e55e6063989aad2352ab", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218005, "uuid": "3c955b25-60c3-4c88-92a7-28aa8a42ad43", "comment": "Malware payload", "value": "b1452cf487a6d23add1c04683d36763ae46075a43813bf65ecb3e21d45c1cb6565213d5be84b9df987ee4e92ccc0a74e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218005, "uuid": "da863539-6a38-4178-9802-c134f8369adf", "value": "898302176BCB71328046EBB14B353B09A653BEEE540C6056DBEE4778FB3205568AC1D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218005, "uuid": "1f78cce9-33c8-455c-9f3d-02839ef7eaf3", "value": "1536:sRn2hxVTZQ72ZTYzqcIxxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZiZtl:sR2hxVB6IzJ9a03fjwe1moYpoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218005, "uuid": "d54ca8de-3cce-408a-8a3d-697aea59c375", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218005, "uuid": "dab4d91c-f690-4648-aafc-7d13626a027b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218005, "uuid": "cc0f8b52-3679-4e79-b233-89dd8cccf42e", "value": "catalog-1280855611.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911d1a65-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217913, "uuid": "2dc24c7a-291e-4a6f-a8f4-9d8cabdfb046", "comment": "Malware payload", "value": "7c3eeef37f102c388ce16aa39996f4a2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217913, "uuid": "3599265e-8e52-4f26-977f-4801627330a4", "comment": "Malware payload", "value": "41d3c8ed2f035c21dbea8073fd93640a28a88d3529f2678914772aaf4ca7367c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217913, "uuid": "ab15a487-2fb7-457a-820b-c98a06b95949", "comment": "Malware payload", "value": "c580db6b5feac536853472c2a24da54f9b4ada9e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217913, "uuid": "5dc042a7-a1de-4374-9bf6-f2b91fe61a4b", "comment": "Malware payload", "value": "d8d8ad935f08286912a7bdc77b2dc39d34138f539d6073404c0e42524a170c60c6b0581942385c0266de78b6d239a884", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217913, "uuid": "5aa36c12-ca8d-4c6e-8fb5-c0499071bff6", "value": "D08312A306CD684D711BF828C1647F8F99ED8F57AF040A0FCBBD462B11969BD3990289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217913, "uuid": "8895d735-63af-4841-9984-c76f51052136", "value": "1536:X2fnBKjQUgFsqi+nTnfZA6l3SNZzTJAsB0Ic6DMADMt5zC/IDIz10l:CJiifrCNBJAIlcAGIz1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217913, "uuid": "fe5f9508-c8c1-4f9d-a2bb-80b5f4172429", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217913, "uuid": "9d342ed7-bbbd-441f-9174-0819ae0345a2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217913, "uuid": "fda2ede3-7f10-4a14-8ff9-6f35609c3f97", "value": "catalog-1235241441.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c2110b-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220099, "uuid": "415c4917-f425-4dfc-be0a-30862b7deaca", "comment": "Malware payload", "value": "3df9ae7b87cefaa43de4bf3238f4f418", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220099, "uuid": "edff47d7-288f-4b87-b7d4-55972af5d0a3", "comment": "Malware payload", "value": "4201c260ff31035e539c6195e0ddb424d2ec957fe7b0e4da158cc8224fb39f5b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220099, "uuid": "4fb50cd8-d178-49f3-8d9e-9a7fc91055e4", "comment": "Malware payload", "value": "0481e71c7e0450338aba87dcda14d25d01538b66", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220099, "uuid": "169223c2-16d7-48c2-bd37-f4f01abe4ff7", "comment": "Malware payload", "value": "9d9678b8883bbfbe9bdbec9617658904745b2f6d513a2eb1238b9f7f93399279afcfe5752a8f94658bd4a37aaa76d0b5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220099, "uuid": "71b3939a-c356-4b4a-9a70-4d141f89ad6c", "value": "7283021F7B8B79328057E7718F351A0DB293FAED240D7159EE9F47A4FB2600A58681C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220099, "uuid": "4b47c1c4-bdf3-41b7-a955-3927340356e3", "value": "1536:oRn2h1Uf0IzwZQ72ZTYzqcIxxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZiZtt:oR2hszG6IzJ9a03fjwe1moYpox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220099, "uuid": "1d1f2540-59da-4085-b71e-9aa56e1411d2", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220099, "uuid": "2a7c66ee-cb82-4510-a8bb-b3bc1a2371b4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220099, "uuid": "dbe35192-5a0b-4488-bd77-c6da1af252ff", "value": "catalog-520829006.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7c7af80-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221521, "uuid": "d3f0bf52-724a-4e75-8f34-98755091533c", "comment": "Malware payload", "value": "b8d24ceb70542a726c9d9809022f0f2a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221521, "uuid": "7870f00b-91da-4389-aabc-cde4061c6339", "comment": "Malware payload", "value": "420d677ac4fb235d94858d78a2901c982adab6c29c1f4783565b68fce2b1ae43", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221521, "uuid": "56447c66-88b8-450b-8f18-7a9b315139fe", "comment": "Malware payload", "value": "998bed0d618f6c0ac95b283dfcedc4184984df6b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221521, "uuid": "78284fe6-83b6-4848-b473-e30f42c7cc00", "comment": "Malware payload", "value": "d6489cd507e070eb5ffd8764c4bba4348ca3362c89975a32349cc10d125cd826b23eb13e4b83623a651b9ae2c566082e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221521, "uuid": "26b3aec9-3d4c-436f-9e0b-d134caaf026d", "value": "C8831209A0BD4FE890D21D813D347ACBCAE4EBD22985D443F1349B6781B2F364179E2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221521, "uuid": "7b3c1341-940f-496b-b467-b44c16ba4719", "value": "1536:dqHyJmpq7rWVy+qBDkq7M5Y2VXw1QFsrGq9ZMlmZQTQd4:IQmceVy+qBDkqUXw6Af5d4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221521, "uuid": "c40b16d9-990b-4620-b737-a9b988c293a5", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221521, "uuid": "21886411-5009-4236-8bf7-27d7dbc97c4d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221521, "uuid": "c9b5ec8a-a2cf-462b-9ded-6ad48f0fa71f", "value": "info-1726601851.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "493a68e6-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222088, "uuid": "6d9f5263-b6ad-45b9-a50e-96f85601d15b", "comment": "Malware payload", "value": "537b2d5606960a59fea9f07dd4cedb4b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222088, "uuid": "7998bdb4-1869-4620-bcc5-9b450ade84a5", "comment": "Malware payload", "value": "421798d7a2e15095025412b47c1709936212a583227e7000623e98e428956601", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222088, "uuid": "0650f7a4-3dfe-4e13-acf0-9d28b0b82116", "comment": "Malware payload", "value": "b86e2c4430acb966b9be9f77800ef360dedf0cc2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222088, "uuid": "da32a2c6-1b37-4293-afb6-f55d2b009bae", "comment": "Malware payload", "value": "70b43227102f87d9ce690f9c1fa8ba77609a516402ca2dc4d98501d1e3266a5b265a85c2b303a161bb4b3f27f63c59b6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222088, "uuid": "e6ddbd1d-89a8-4d0b-8e9c-1224a14621a6", "value": "D4830215A1FC87A780E305A229307AC68AC0EB97585DC043F1349A27A4F6B79857BF5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222088, "uuid": "749de550-8f19-49f1-a141-f5ca63bd3de1", "value": "1536:wt1QVGeGug5dwSp6yMvBjqqxM5Y2VXw1QFsrGq9ZMlmZQTQdy:oAG7u8l3MvBjqqqXw6Af5dy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222088, "uuid": "134e4d11-3010-4379-b544-6e6730da0367", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222088, "uuid": "e1eeae0a-e8ac-4793-a464-253c40ac161e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222088, "uuid": "860eb748-6acf-4ac7-8d10-4448fd659f80", "value": "info-2112315774.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da67ddca-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218036, "uuid": "bfc54011-abc1-46d7-aed8-772bb162943b", "comment": "Malware payload", "value": "9c77b82419f9e301bab8293b283bb376", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218036, "uuid": "61531d25-4305-4fad-bbc1-62a6a9e8c3b2", "comment": "Malware payload", "value": "4225c18e382866f3c803cb41fefaef7638cb1e4c7aa25d04dff253e77a84eda8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218036, "uuid": "101b35f0-680e-4e26-b2d3-a4c5b12c7405", "comment": "Malware payload", "value": "c62b4ea8783264c80bad3168257614d358cf29b1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218036, "uuid": "93693428-976c-4426-918c-f558eb5ed76e", "comment": "Malware payload", "value": "22b92c89139dbcda114b166eaf8f995407eefebb69ae46526493962a982f72536f6a9b713c1c0bbe585e866a3e7c249d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218036, "uuid": "33de922c-42f6-4338-858f-8367641e0ec6", "value": "51830217FBC626618056E9F25B3A3B2E6A8379DD795471A64FBC03C0F53614E2CE81C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218036, "uuid": "a7911b3d-caaa-48ba-ac96-3082eb0e2484", "value": "1536:mAqmy0pi0wcMlbCUN4gCQZiwotTCWxxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXY:Ty0pgGUNEvtTCWzJ9a03fjwe1moYpop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218036, "uuid": "eac1b6fb-39c5-4b12-9ab7-d71ef3d4906c", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218036, "uuid": "ce8a274a-13b9-413e-be56-f4414e6f8714", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218036, "uuid": "1735f955-7779-42d8-ab9f-c532597ba4e4", "value": "catalog-1304751015.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f949f446-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221094, "uuid": "a9f3d9bc-3e90-4578-b2ca-0442d78ae9f3", "comment": "Malware payload", "value": "c7f892198543ce3995c2824cad9502d9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221094, "uuid": "7fd0b21f-b2eb-4ba9-878f-f86a91b09d10", "comment": "Malware payload", "value": "425d8d68e360dc37d61a2eb14374006408adb26ed33a4f7a68c41292d02ef8f4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221094, "uuid": "4832d34f-7f7b-4e2e-8f46-cbf012bde40f", "comment": "Malware payload", "value": "e145a42d08eea6efc76ce5b550a8014c7c88b7fe", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221094, "uuid": "4c5d3a2c-e76a-4e75-ac4a-3b979ca5097f", "comment": "Malware payload", "value": "ead3a853b9c75940c00c7f21df8966f21b744161ecd99f027525b8767d00a7c0a60d5846ab9503699e037618889bec0a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221094, "uuid": "fc882eb2-f574-4815-8f4b-d032968615c7", "value": "03831277F076E96E829CD0B1941E3A2839F875C3A435878EFD1D3A17C426DCDA91182E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221094, "uuid": "7bfec665-b405-4e65-8628-ea9f696f3f30", "value": "1536:8Js4DkjRjDC+ramyNIPjLxx7mgV3e27JWgtrQZcUT7oqlaHvvbFq9GHocnoe1Rql:GLoNfPrG+vxxSCxIGUT7o/v096oiBkwO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221094, "uuid": "81cccc54-8539-4da6-a06c-305d400c6966", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221094, "uuid": "9c0254fc-1413-466b-8ca2-279be9831448", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221094, "uuid": "1351306a-0002-40a4-b5a6-7fec25b46ff1", "value": "info-1486418699.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "303a9f1d-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220757, "uuid": "ff9bd304-a1b2-4360-a287-668abb8c7b62", "comment": "Malware payload", "value": "a6f1bbe56206a12d560898bdfaca10e0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220757, "uuid": "5cafd57a-e3d2-460f-99e7-556555a5772c", "comment": "Malware payload", "value": "426ff23b6ed77c48385ed24c3c7f422faaa0cf46eb92b7fade739dcfe163935c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220757, "uuid": "d6ba5517-8b03-4873-ac6f-9d3d6cbd724f", "comment": "Malware payload", "value": "b02c5fa69828d802357ce43c5273b58e5a07579f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220757, "uuid": "a5c2b12d-e6e9-461d-82d8-2791a3b23910", "comment": "Malware payload", "value": "459f11a5583f09ea8999896d76afa32bacc8fb835a363982244891ca25ec6f5e7b52ef789ea00b038db9f86dbfce07f3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220757, "uuid": "d0623e9d-2fd5-4309-87bb-7b772ff08ac9", "value": "C283029C30FF0144967A68B8613FE80750FCAFDB2D37B75947308574AA114DAB6239AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220757, "uuid": "fdbabcf1-7660-4d5e-806b-96d98dde9416", "value": "1536:nr7l+KI0ejUgUlrZKFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbXYZTa4hpA:r7l+NUhlrZ6O6xoKDShicdBMM1/XPQTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220757, "uuid": "db2f01f1-9d2c-49ee-869f-b5e21cb0e278", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220757, "uuid": "6ea7638a-0df5-4030-b917-67af8ebefafd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220757, "uuid": "c2a6bf7c-99e2-4cf1-9f9a-320ce32002bf", "value": "info-1356379737.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501a01fd-a3fd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1619159393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619159393, "uuid": "62a1ac21-94fe-46e3-bcf3-04c180d4cfa1", "comment": "Malware payload (Loki)", "value": "02d8473d9d4a70d90191ebb4536908a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619159393, "uuid": "edaad5bd-aa14-43bb-bc28-b2593e3bbbd5", "comment": "Malware payload (Loki)", "value": "42b20811887a759b2fd60fa55875ead553aade70d55a1b6b94e7fc916c67e00f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619159393, "uuid": "8229a241-1ed5-4e8c-a10c-c9fd091a1d2e", "comment": "Malware payload (Loki)", "value": "07487ff8d99fd414fad56bafb0f097ecc6c38f2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619159393, "uuid": "0063a76e-ed02-451b-95b1-21f0161c8173", "comment": "Malware payload (Loki)", "value": "71978451df91e6623ec22a35ebfb59fb432b7dc9c87279844cc237e9bc7dec77593fa111bce6eecfc8648425cf331756", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619159393, "uuid": "1c412c52-ad03-4ad3-8226-63344227c88f", "value": "4D058CAC7650B69FC457CD728AA42C60EB60B46A470BD303B0A716ADD94E69FCF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619159393, "uuid": "a8acad65-5c5f-46e0-9932-f593cc16cb5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619159393, "uuid": "0aaf6c0f-2fcc-4b5e-b085-b4923cbe722e", "value": "12288:r9Ie11hZXS9+Ozo6u8brGFoH5vnDYZSVGjvDBMwAoKSusxlq4k2T2piuuPVFpdpF:FXSBuWH5vbGRnANgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619159393, "uuid": "08d29538-df61-4a26-8c30-484f17a34905", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619159393, "uuid": "9d89c599-d25d-44b1-929d-524edb74ee02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619159393, "uuid": "6ad61562-e899-42d8-89db-79f76ecfc7f2", "value": "02d8473d9d4a70d90191ebb4536908a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2aca31-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221559, "uuid": "1e06b410-af08-42ba-bd03-ad84a34fa04b", "comment": "Malware payload", "value": "acb9e967c767dec7ea89c926a775089d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221559, "uuid": "01cba9c4-a919-4cb1-a8b9-9a20fd6e8069", "comment": "Malware payload", "value": "42c9df0bbb5329f8d3b0a6623f49882a1d2b1f910bcfca25df91c0044d11b243", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221559, "uuid": "d6c20850-3cd9-4eae-a110-2b8172e57030", "comment": "Malware payload", "value": "3036b943d99928939a3cb5c86a6bb2db4fe0a0a9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221559, "uuid": "0b390a8a-7253-4bb1-9b36-4366d91c4d6c", "comment": "Malware payload", "value": "ed18aa851da95a44fcc91ac2587789a6811d45cfb2de7378096713de7e35aa01e295d8da4c16b8ac1c6ec0792db11f52", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221559, "uuid": "50393e91-c7c3-480b-abcc-05f395b4a241", "value": "87830277F076E95E829CD0B1A01E3A1839F875C3E435978EED1D3A17C426DCDA91182E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221559, "uuid": "2d9061ab-0d31-4337-ab20-28bf0e7bd2be", "value": "1536:/Js4DkjRjDC+ramyNIPjLxx7mgV3e27JWgtrQZcUT7oqlaHvvbFq9GHocnoe1Rqz:hLoNfPrG+vxxSCxIGUT7o/v096oiBkwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221559, "uuid": "362d68d1-56d7-42ad-9f5b-c4aea077b940", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221559, "uuid": "3739c57e-4b55-4f81-b79f-a2f965b02511", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221559, "uuid": "a8f060ef-0262-405a-9704-e9e715f10ad7", "value": "info-1752122151.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6257e4-a3f2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1619154744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619154744, "uuid": "0e271f45-e992-4c08-a76c-1a058993a555", "comment": "Malware payload (Formbook)", "value": "34370c8109b09c8f05efceb76d45971a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619154744, "uuid": "efb9a679-e9bc-4280-a170-ef1571e7df32", "comment": "Malware payload (Formbook)", "value": "42ce1809fb153f17182c47892df0b4d64567fb9a23610c982712b1c024637057", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619154744, "uuid": "ba981402-ee82-47c9-8fe4-274a9e97753a", "comment": "Malware payload (Formbook)", "value": "1922f54933bcdbba5695b13d41931479474e1086", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619154744, "uuid": "8f95542b-5e4c-4a72-b38e-1577b9a19859", "comment": "Malware payload (Formbook)", "value": "c0a16feef62da091ee415f35f22e9fc53846094127d9cd7fcc58e4bd8e7c9a3ac9e5a70bef3f3227cd383f79c5f3eea1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619154744, "uuid": "3bb9db93-c27f-4290-8b90-82d5c9f90d39", "value": "44C5336EFDC9C715DCAA59FCCD2F942D10F98D024A268C167A3931F5A237430B39876A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619154744, "uuid": "189953ef-d109-45c3-b48d-24a79d4386dc", "value": "49152:04mWtE7Ue2rgoPewrX0KaUH3OAxyNIIlaWTL/6eAr3jAKVT:0mtM1+ewrXESeF0WHgzAKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619154744, "uuid": "9c13efd3-7a6b-42a7-b4c6-4ccda8eea4e3", "value": 2670592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619154744, "uuid": "c6a21c22-ddcf-4542-86ab-07124619f794", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619154744, "uuid": "d66268c0-cb2a-4007-9f40-df1ef52a664d", "value": "FORM C.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b27d24ee-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220976, "uuid": "53dcaabd-e41d-45cb-84e5-37964e060950", "comment": "Malware payload", "value": "cdf7e1c15721c9ca4acc906bee9baf08", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220976, "uuid": "ebe48962-8a59-4fc6-97ed-1d5e7de55d34", "comment": "Malware payload", "value": "436d5665dc7a9489573c473bac76c50a7fe3ce702d2aff0bdd0558379ee650a6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220976, "uuid": "021e5c28-2471-4392-939a-6dfa08a97c4e", "comment": "Malware payload", "value": "2d20b69a158986997b03eaf444f92784176b9d48", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220976, "uuid": "79c2d4c3-ad66-4381-bd9f-74928c382a79", "comment": "Malware payload", "value": "fb7c3e6f547802b35ba9be05e3d2deb7ca073992324f76b7e8692cc19b26fafe3a3e55034f806119175e26bb9e397342", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220976, "uuid": "6c091504-09b9-4576-b844-014f0588a622", "value": "EB830215A4FC86A780F3159229307BC78AC0EB9B984DC043F1349E27A4E6B76857BF5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220976, "uuid": "6c0333d9-b20d-4b07-9826-d2c71e6dff64", "value": "1536:9t1QVGeGug5dwSp6yMvBjqqxM5Y2VXw1QFsrGq9ZMlmZQTQds:9AG7u8l3MvBjqqqXw6Af5ds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220976, "uuid": "30fe1214-34d1-4f41-bc20-8f10ad047a01", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220976, "uuid": "a84da363-bb00-4149-93c9-5b21c17c16f8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220976, "uuid": "45172805-543d-4a0b-ba24-28930cb1035b", "value": "info-1410882697.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f394ed61-a45a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1619199610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619199610, "uuid": "731292e4-19e4-489b-bc0e-4107a6ed6bd8", "comment": "Malware payload (Gozi)", "value": "a1acba462ec14ddccbc4fa7aedcc8f3f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619199610, "uuid": "45c689af-8209-4731-aee9-02770b58ff6e", "comment": "Malware payload (Gozi)", "value": "43b3014c1627c40c31c724e1a7b1dee4ef51428e2f68adad93c0df95f454275d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619199610, "uuid": "999e3ad0-4c54-4c22-b70d-4e3e9068756b", "comment": "Malware payload (Gozi)", "value": "c9e781b8635ed954176f10ed32b22e3832f5d408", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619199610, "uuid": "eef55479-c4da-4fbe-bc2a-4abc0292aad3", "comment": "Malware payload (Gozi)", "value": "521a8c3edf3da286f8358c76f7dbf67b00300aba0cd5c85b7783dc2c9eb3c07d06a982f0ca3166e8b0ebd929561a7653", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Shathak", "colour": "#440EAD", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619199610, "uuid": "4b047639-e93f-460e-8496-03f3171de781", "value": "F715CF2238C1C232D9636438097AD1A08BBCB4241D2697BF73DC7B7E1F7659252359EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619199610, "uuid": "3ad7ca76-7e5d-40b9-9cca-659ebc9cfa14", "value": "144296335e11e836679bbc0168a3f68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619199610, "uuid": "b3bf8c7a-2983-4b1c-b928-9d33fe5403aa", "value": "12288:PvidtsMhSvt4ZWeWQFlBegSwCHO+ExeaIsrscw05c7BBC8emGjRPmW/7/zVjbZw2:PvidKMhy7erlBegS7esa5cDKjeA42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619199610, "uuid": "53df124a-0703-4b88-a3d5-631c5c995d6d", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619199610, "uuid": "d1d3adb7-3d4a-4b54-800c-496af27fc210", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619199610, "uuid": "f2b23174-0885-48fd-b944-1090ff0111a2", "value": "a1acba462ec14ddccbc4fa7aedcc8f3f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c318b3c-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222012, "uuid": "5abe48c7-e027-4e34-9e99-cc32e58fd303", "comment": "Malware payload", "value": "d62800699fbccc8096f5e944986c1af8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222012, "uuid": "96b62437-7241-4772-9cd5-150cbd79dd11", "comment": "Malware payload", "value": "43c56df653175a1fc875127990965c56b93d778954145535a916960c0d8513de", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222012, "uuid": "a2fc41e6-4cd3-4edf-a362-3df35d51c730", "comment": "Malware payload", "value": "40fc421a81bf7d3e7c797e2357b375ac147766f3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222012, "uuid": "fe14b02b-af0e-4506-a6fb-66eb2b0dfac7", "comment": "Malware payload", "value": "d9d44f760c291bbd6f9cb2dd916920676d77167f6b26d4d490a9614e200ab582fed7e47fbbd7783b7091d1e08ee8baef", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222012, "uuid": "a58c9599-899d-4bbe-8130-5761151993d2", "value": "1783029C30FF0144957A68B8613FE80750FCAFDB2D37B75947308574AA114EAB6239AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222012, "uuid": "722b5bca-632b-40bb-9626-52235cb0f5fc", "value": "1536:Mr7l+KI0ejUgUlrZKFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbXYZTa4hph:27l+NUhlrZ6O6xoKDShicdBMM1/XPQTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222012, "uuid": "20982749-6d2c-45b7-98e1-6e0436bd19bd", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222012, "uuid": "3b5be5eb-cbb4-4e30-843c-e74a61502338", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222012, "uuid": "dabdf7f1-8f4c-46a7-926b-6746e8c038d1", "value": "info-2059739747.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc9102b-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218334, "uuid": "32ec400d-67d7-41b3-8a33-d1d1ed042f0c", "comment": "Malware payload", "value": "5d2367f179026647802fc0e7ef975876", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218334, "uuid": "2b2620cb-a6bd-4560-96f1-62b0b466de3f", "comment": "Malware payload", "value": "43c7d9d80f1c498696042c5eec79a9fd7f13c1bbe94193bbe0b6d841708a08c4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218334, "uuid": "369f4954-c148-4ced-8b9f-b3adae3a92d0", "comment": "Malware payload", "value": "afbb89d4447cef57db5a9eb5caff578fe4e7a59f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218334, "uuid": "f5a7983b-a5d1-4686-8b85-2c296fbb4314", "comment": "Malware payload", "value": "3711c4d1322581fb760d0e8a5c877c9525bdba054e60e8cd7588c4c0e15b9434604255a7ef9417aa028266064c84d155", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218334, "uuid": "d0372576-6be6-4f48-bc10-8a8b18646591", "value": "A28312979F9A3B9D2458AC39C57B9CD10905CE37C157301D22283AF6282BEBF9B054DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218334, "uuid": "0e13ff74-c2c7-4db9-855d-f2e93412e34a", "value": "1536:YMaAK6VMtJDrlSnna6UAAWBHTe87VqINbtezgVRxr9AiUbQTKXs8FI+bq:YzAPq1Sa6ne8JqmdIbLjFRbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218334, "uuid": "f8697db5-5b52-4c5d-a607-cd611589647a", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218334, "uuid": "d63e2852-e209-47e5-bb15-dc2eb7becce4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218334, "uuid": "50a59de0-b8ce-4a48-aa1c-7124e9ee78fb", "value": "catalog-1448606839.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ddc645d-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220512, "uuid": "2dd065f9-4f00-4b7c-833f-d97fe40100b3", "comment": "Malware payload", "value": "18c272e11a8b892b9f93bd850cca5a73", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220512, "uuid": "ff7f79bf-9723-443e-ba14-b7ff33a75cdf", "comment": "Malware payload", "value": "43e10bf5b01b1b25fa8b6ea6dda4072603ab24af987962579cd3ab378e1adbd5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220512, "uuid": "65201964-62bc-46cc-98ec-b0297ed33ed4", "comment": "Malware payload", "value": "157d4148184e3ac97966d4c9ec91c7598a9df81e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220512, "uuid": "ad119688-a170-43bc-b439-2b05e22ff017", "comment": "Malware payload", "value": "a899c9150a2f55c663c91630ec4651c23d31ad7ad15b427958ff637c1856f28fe8afea8c9cc40b561c699efcc2d74949", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220512, "uuid": "c669a1fc-9cde-451e-81d5-f1bf40b7f2d8", "value": "88831277F076E96E829CD0B1A01E3A1839F871C3A435978EFD1E3A17C426DCDA91181E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220512, "uuid": "8ce3bb4e-bc74-4396-a723-5e6af8b26439", "value": "1536:3Js4DkjRjDC+ramyNIPjLxx7mgV3e27JWgtrQZcUT7oqlaHvvbFq9GHocnoe1Rqt:5LoNfPrG+vxxSCxIGUT7o/v096oiBkwS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220512, "uuid": "d480dbb8-0d9f-4cd8-8e61-573b2f5ed0fb", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220512, "uuid": "97450295-863a-4881-8314-7a5565a538ae", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220512, "uuid": "e17fcf00-b68b-4498-a916-ca2b6f53898f", "value": "info-1216036855.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae798213-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218821, "uuid": "9137b844-4091-4147-8fa5-07aaa08f0e53", "comment": "Malware payload", "value": "b98d4108e719220f24606bb344713fd1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218821, "uuid": "e05cff6b-290b-49d4-b8c1-4ab268bd718e", "comment": "Malware payload", "value": "43e3f02e1ea7213dc4a1d461a720b16194d77dddb4caacfeb115942219010fa1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218821, "uuid": "5f25371b-eaf1-4934-bb80-dd1e82e884bf", "comment": "Malware payload", "value": "528e33f3b04fb2b5264c4c7434e572afee77e73b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218821, "uuid": "c3e9d8f7-47e9-4c7d-bf5b-afd8c12b1133", "comment": "Malware payload", "value": "c968aa1ec5b0bbb676a169c4674bd3df67c4f1310c4bae953f8b9202123409290c252bc3e8d37e3b0e28f8b8db63b239", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218821, "uuid": "f67ca8a6-f0bf-428b-80b2-3ee8ff57d0e6", "value": "B9830268CB9F8D948005ED0ABB12F8ED75506248706973ABAFAD1124FF478D5B2738F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218821, "uuid": "51789a5f-6f00-4eee-a3eb-0be2c6b69892", "value": "1536:QA6P7EGmwH1zVQLQDYflSJXvoDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrn49:QAY31zVQnIJXaM25NfuQjMCYNBwltD03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218821, "uuid": "5b7eaa2e-8700-4a0f-ae26-50ca687832b0", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218821, "uuid": "fdf464ab-8d6a-4ce3-9d89-626e4de11398", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218821, "uuid": "558f7158-d9f4-46b6-841a-ba4fbc5ea423", "value": "catalog-1727722210.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8149a91-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218918, "uuid": "1c387245-fbe2-4e00-83fa-a8d4e36ad616", "comment": "Malware payload", "value": "e7163734326f25aaef8badf31f78572f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218918, "uuid": "bed731fe-8d3b-45a7-a063-3e1f6d910055", "comment": "Malware payload", "value": "4426f677c2cc4ab68290c76b75f060f705a1347a07b47ecfd5de31351128a5fb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218918, "uuid": "f083e232-63bf-4200-8722-2cdfef139a9e", "comment": "Malware payload", "value": "a319e9dbd695bc2506af6e7c2ecb0aece6e62904", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218918, "uuid": "4fe5cd24-8dc7-4f0f-a490-bacdff0634b7", "comment": "Malware payload", "value": "9ea40776a959f866884a825b225a773fca611d98dfe325b341e8502c39a1bdfb9dd6e7998e0d705380ec460d235c37d2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218918, "uuid": "acc547d0-f254-469d-a1ef-b267cc77bd1a", "value": "738302467EF90F9C2C19EC2085174CB50E77CF6EC1872229F268247668486BE7E075EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218918, "uuid": "c383f5aa-2af5-4a52-b8e8-9a21957a5fe8", "value": "1536:yL2dSRV1UgF68rh4Khs/9qDUAAWB9Te87VqINbtezgVRxr9AiUrQTKXs8FI+b7:yL20RNrhDagDpe8JqmdIrLjFRb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218918, "uuid": "463a86ce-c560-4408-b112-5d6c9ae4b5e6", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218918, "uuid": "8982e0bc-3f16-40c1-b1a9-d653538109bf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218918, "uuid": "1745881c-3d31-4dae-8f43-630ce1c347f1", "value": "catalog-1781466728.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ee595d-a484-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217606, "uuid": "6173a265-d08d-47d5-b090-9b126e39e5b3", "comment": "Malware payload", "value": "ecdf78be049d03738f07d0efa2dba3bd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217606, "uuid": "a872e419-86f0-4b29-8948-060617e57211", "comment": "Malware payload", "value": "447b7c7070ebad148b1ac8b3813114a1931500c8004ab8b16b4a5c9a31c660c5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217606, "uuid": "4982e4c7-1236-4639-8ce4-0ca83ae63087", "comment": "Malware payload", "value": "72df13b774f2e63ba653bc3974f941d2f46141d4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217606, "uuid": "3189f3aa-1a79-404e-8fad-8fdd8be9d929", "comment": "Malware payload", "value": "b0c92511a8c5c95d1fa0d0e620d0f89c4696441445f4b5996462dab6e26d1a94cf421c092bed31129980f0be9e63385c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217606, "uuid": "c93d7e78-f9ec-4416-afd1-4f6c46bf3976", "value": "F08312E4C78E0CD5C1558E0D3B22F868B901711C3118B5E7FAAD58B96B538D8A2B3DF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217606, "uuid": "b74d19f1-c76d-4db0-a44d-67b09c4647f9", "value": "1536:wE2f1lwz7up/vqBuKXxP8JXvKDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnE:wpcvuBvaXxP8JXoM25NfuQjMCYNBwltA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217606, "uuid": "034b2f55-b2af-41e2-9d0e-9013657b242c", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217606, "uuid": "472e584f-9700-4f9f-86ab-e741a07bc5e1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217606, "uuid": "8364ada7-3ae8-4baf-83ff-161a2e358952", "value": "catalog-1062008404.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de7fa101-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221050, "uuid": "c823b774-e930-46b1-9413-dd0c897f7cb2", "comment": "Malware payload", "value": "2d9343d0bea8a3d4f7f8a7be184831d4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221050, "uuid": "bda76950-6b29-428d-b62c-8f243244dc15", "comment": "Malware payload", "value": "44878a867d4443ae5523942236aba8ea4fe9f7c553b9248fbeeae3de7cf4aeb1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221050, "uuid": "9b67875a-e745-4295-82bd-613f1377b8f7", "comment": "Malware payload", "value": "69034aca4ca6eeccc8714e45d57d0b6743090142", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221050, "uuid": "e1676693-d107-4772-a6d3-cf6eeb419c4b", "comment": "Malware payload", "value": "db2533827cb665224e5537f5c1c15ea95f269a7af2d3e17d692e4c63ca5f0263394351230ef59d7de397bfe31b7ed967", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221050, "uuid": "673ce001-0942-4a0e-93ad-5530ff1eecff", "value": "EF83120798BF24ECD07A6BE01C73584D58B0EF68801C8588B25A769F72D89E64BDBDC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221050, "uuid": "4cd4429c-e175-4070-b0f4-9d7bebb3aabc", "value": "1536:l75HZbN5m6RtwWdwSp6yMvBjqq1PGLuhCWdHsh1oSFWsfEFhHqLWq:l7RBm6XwWl3MvBjqqdOsZdHAO5hK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221050, "uuid": "6c31a49b-9345-4e27-a887-2278520881f8", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221050, "uuid": "183b82d6-dd18-4e11-9d7b-6bdfc21c0cfa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221050, "uuid": "76e5966c-82df-411b-af3d-6f1d096c58ff", "value": "info-145470901.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd441ae-a484-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217643, "uuid": "07999ff1-e576-46e1-b2c6-6f2b8e4ca7b4", "comment": "Malware payload", "value": "6be5943a7d37f8b12177d60e776af346", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217643, "uuid": "532b783a-f1b9-46de-ac25-9ab0850aa822", "comment": "Malware payload", "value": "44946418be2c46770d0465294b0e9bf8e3f55187ace787baa72378fefee32a99", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217643, "uuid": "a1eeb3ab-e884-4a84-9ad9-634b0c598529", "comment": "Malware payload", "value": "d96925cad9a97ce4e24332bbf6462e94fecdb6a3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217643, "uuid": "9bf52500-290e-4ad2-9f76-032bc9617a35", "comment": "Malware payload", "value": "ea8dd170dbc0773c4e2ca48664e23ca306308b9cefad06fa640557ac59edadf3492f55d52c63d2db444b0daf4011a6c7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217643, "uuid": "1c56ed8f-00c5-4ac2-b8b5-e779e971c321", "value": "DA8302E9654236BFC8FD951D206F3D442EACB2E56E3202E7D207D93770F5A9894D0718", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217643, "uuid": "e32c6bf5-d7ba-4a92-863b-f1376fca4192", "value": "1536:UF5u1k94TfvqBuKXxLG1ZQUcDwiFALqCJI3+xOtGkwdO2eDiFXm:UF5fsvaXxLG1ZQUcD1FALAOxeh4ONq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217643, "uuid": "bfdef5d8-f2d7-48d4-a0b5-380ce5188cd8", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217643, "uuid": "2be797c9-ed5b-4330-b5c3-54a16bcbc90e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217643, "uuid": "b8591397-aad4-4131-bce2-af420f5696e7", "value": "catalog-1083491444.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd8af86-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220676, "uuid": "313ab422-cc57-4f85-b7f3-ef5472ea15a4", "comment": "Malware payload", "value": "9d8361dc3b46c9bf6b3a13a3873ae24e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220676, "uuid": "e523441b-d64e-4d2a-95f3-668648e684e5", "comment": "Malware payload", "value": "44aafe9069d993c671d033be9d6883ebf50cb8a2ecb21908fca4c3f558a7463b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220676, "uuid": "fd2df1c0-5f99-452e-b06c-17b51316e90c", "comment": "Malware payload", "value": "d65084a0ff5d9d8a1dc1779a6c1aaeb240681fe3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220676, "uuid": "8521325b-bd80-40b0-a85d-5fb283ba3625", "comment": "Malware payload", "value": "b4698cced35dea307aa09c12ce9500a609f24f9967938166efa217bcbbb99c87209411e73ea4542723b58fa214fdb5c8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220676, "uuid": "2816e0c5-e2d4-47dc-8325-176b9aafd47c", "value": "7B830277E076A96E829CD0B1A41E3A1839F871C3E435978EFD1D3A17C426DCDA91182E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220676, "uuid": "7c6e24a8-e2df-458c-b55a-cae21523603c", "value": "1536:CJs4DkjRjDC+ramyNIPjLxx7mgV3e27JWgtrQZcUT7oqlaHvvbFq9GHocnoe1RqD:sLoNfPrG+vxxSCxIGUT7o/v096oiBkwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220676, "uuid": "09428402-53b9-40ed-a953-1b18f6b497ea", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220676, "uuid": "eb5bcdcb-c110-42ec-9cc6-2c2de82822cb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220676, "uuid": "c1f90caf-ab0f-4635-b61a-f711a709425c", "value": "info-1307374380.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56f1ed0c-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218245, "uuid": "1ef02048-e6d5-4e8e-9768-eedca345e819", "comment": "Malware payload", "value": "b2a64870a2fb5987241dac2bb082fe0d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218245, "uuid": "d37511b0-48e9-4b28-ad46-35d187380f0d", "comment": "Malware payload", "value": "44b67ff54cac160e05c75d78695fa9529f5112354ce2aa7408f364a012da2a9f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218245, "uuid": "0893b1ec-913c-482d-ac24-355a6bb9e90a", "comment": "Malware payload", "value": "6012e2c566926d85477a0595ab6896eee4101d49", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218245, "uuid": "91d15610-6ecb-4b4d-89d5-fabdd1a5e591", "comment": "Malware payload", "value": "380e31c5135d5959e6fb9deadb5144c6837417ef2740163f0e36bbbce6554c6cb80c3c991b2701b3a9606da85f441013", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218245, "uuid": "00ca780d-f3a4-4d8c-a614-7efa53e69d9b", "value": "268312EBCFEA49984202BF0673065DBBB45428086118BA7A7EDD11506F524A0F4B7DED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218245, "uuid": "6226da41-a604-4cb0-a4b6-debdc457f2e0", "value": "1536:TsKLWkP7EBmnbRARpNdZ2rQD2FPdo1f+5ff9fuQjMCYNst+IHClPLqkwD0DCuAD0:IKLWSFbkpwQKW25NfuQjMCYNBwltD0DX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218245, "uuid": "34e18804-ed25-4ba2-9a50-16bd2b663258", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218245, "uuid": "5a6c1864-24c4-457f-a2aa-b9f8d6dbad86", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218245, "uuid": "fc2e1be4-8cfc-4e8a-a0fa-deb119eadb92", "value": "catalog-1409656882.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2239153-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221458, "uuid": "33f26a0a-a532-4527-b193-69a84e56e4af", "comment": "Malware payload", "value": "a072ae84c6e3572118aa3aa184b4ffc6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221458, "uuid": "7993e98e-3efd-4965-bff7-b52cb215d333", "comment": "Malware payload", "value": "44b81cc93dd8b0d73457cc522dad2061b54a4fdf94646640801d0c5263794faf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221458, "uuid": "bf23e121-e3c7-44c6-9c09-6942390e5aa3", "comment": "Malware payload", "value": "1c073094e4e0a819448dba35f4643e7870b31ad5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221458, "uuid": "9013bf39-c70b-4145-9ea1-f6ee3b0670c2", "comment": "Malware payload", "value": "650c12b6b109d9321ba7d2bee9385110c0a3e6b6e466cb1f3d4caf511da7188bc08a443468f5dbef9de6085c9d3c3304", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221458, "uuid": "8e189649-1268-476b-9248-61cff7fd1673", "value": "B88302B7E9376DF6C15CE1E7A63E122824EC85C07435968BFA0A5E06C95AEDD9204C0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221458, "uuid": "02f2b1bc-2c6f-4031-944f-5bd512e0805d", "value": "1536:kr7l+KI0FlLHfAkZ8kISNq7xWgwMQZcUT7oqlaHvvbFq9GHocnoe1RqfwSOJrpM/:+7l+6FHfA210waUT7o/v096oiBkwPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221458, "uuid": "7024feed-9dea-4f3b-a98c-e05920ed4d96", "value": 86799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221458, "uuid": "5d5a6fa7-5e64-4d44-871f-ed91760b7f3b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221458, "uuid": "103d9a29-49fa-4bba-8456-42db4b04ce12", "value": "info-1693622126.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4f80e8-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218600, "uuid": "9e563b97-d322-459d-b22b-5f95eb7efcca", "comment": "Malware payload", "value": "86e02f34eb39700cad1cbb77463cff79", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218600, "uuid": "37758fe2-3f97-4d60-a49d-1df1ed740bb6", "comment": "Malware payload", "value": "44d3c7a75fd0eb620781a22bde64b6f7175bb4e112042c9b9c457e93c0a409f4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218600, "uuid": "735ae0b0-d8ed-412e-8f22-a33e8f514827", "comment": "Malware payload", "value": "702a94467253c8b2447d32333a750a3498fc440c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218600, "uuid": "601ffe6f-ce13-4cd9-82a9-ebb724ed7650", "comment": "Malware payload", "value": "0f6686473cac26c216e10b61ddd843b05c36dc70de5e5e61a29af949e697a0f6cf895ec2450469235458e0d6be54b343", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218600, "uuid": "815dde47-e687-42fd-b10a-f2f96883a34f", "value": "A383028BB4D8433ACB3523F658AE5E4426B1A47F040CCBDC75D73A786B53672A572388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218600, "uuid": "99b56288-a9b7-49ae-b356-45929badd831", "value": "1536:+EwAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvi:+HijtuPmU9j7+XFWtYe14hbOja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218600, "uuid": "56d63d5e-1462-462b-a44b-050ebf12851d", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218600, "uuid": "97ee3536-3600-4b3d-a075-c3065d520c1d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218600, "uuid": "af51696c-be48-499a-9d78-4761d5356ecd", "value": "catalog-1624643931.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af4c954-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219165, "uuid": "2706c38a-eb56-4516-8aa8-582b2b9f4f91", "comment": "Malware payload", "value": "540431379b5e24636cc38cee8abd460c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219165, "uuid": "40a46c05-0b85-4999-b2c2-6082604f7166", "comment": "Malware payload", "value": "45086648a8646ef8a92f46af62622270cd14712864d1db87a4879e506e1fba48", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219165, "uuid": "ed9f8810-e560-4faa-87df-ec4793d0d01a", "comment": "Malware payload", "value": "a2e2eeff1982792e6afdac5367c4a3164efb704f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219165, "uuid": "c660bdf4-6b8f-4fdd-891e-c548e232ba4e", "comment": "Malware payload", "value": "464eb8ef58c6dee2b751e5d7da3db15fd236134ed1d4a631ce91c73bb0f08ec52a0c894468d15dea053974ab280446e2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219165, "uuid": "34bf9519-9e6e-463a-9bcd-52bc282ff69c", "value": "1783121BFB8626618056E9F25B3A3B1E6A8379DD795471A64FBC03C0F53614E2CE81C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219165, "uuid": "70c8e681-26ec-4090-998a-408fcf242175", "value": "1536:lqmy0pi0wcMlbCUN4gCQZiwotTCWxxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZy:py0pgGUNEvtTCWzJ9a03fjwe1moYpo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219165, "uuid": "d5c74c15-2141-42f4-a6f4-cbe65e7ca218", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219165, "uuid": "9f935db1-de82-4f59-bb2e-30025d45e460", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219165, "uuid": "d954dbb9-63f7-40e3-bafb-e8a5dc9f6be2", "value": "catalog-1921809873.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474c60a1-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221225, "uuid": "e5b85be5-0cdf-4fff-8815-6312745656cb", "comment": "Malware payload", "value": "28960a4237f9ad06bf54ddf516d36f33", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221225, "uuid": "de956169-d0ea-49a7-a873-d96717080864", "comment": "Malware payload", "value": "4532ca53fc05e1989b2935133142b389abb87a8fd02fa6b7048066dcd865f649", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221225, "uuid": "37bb418d-0549-4784-a43a-904ef7dce194", "comment": "Malware payload", "value": "f005ca0b51a65cd028808002fcafbd9ac7a7b076", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221225, "uuid": "30fea3d7-29fc-4f05-bb4f-7b63aebd7d8c", "comment": "Malware payload", "value": "6cea958ffd14d93d9c7d26085baf6fd48d5b8bb3d65a5ee017457203e2529be3147ca0e2d7b0011bafc19fbd13b9bac4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221225, "uuid": "945dac9f-0fbd-42b9-a8ad-ff84b92ff473", "value": "63830277F076A96E829CD0F1A41E3A1839F871C3A435978EFD1E3A17C426DCDA91181E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221225, "uuid": "c5f4931d-bfc7-4295-a317-05eafb705c2b", "value": "1536:zJs4DkjRjDC+ramyNIPjLxx7mgV3e27JWgtrQZcUT7oqlaHvvbFq9GHocnoe1Rq4:NLoNfPrG+vxxSCxIGUT7o/v096oiBkw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221225, "uuid": "8fa6474f-9e59-4d5a-8705-d7a5795c75b8", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221225, "uuid": "45bee77c-2ee8-4ab4-a61b-1b17cda59517", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221225, "uuid": "d78e8b30-31e1-4498-936d-0118b57a1dfa", "value": "info-1565074597.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08851274-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221979, "uuid": "50344bb6-7136-4e40-81bc-3ab1ccca031f", "comment": "Malware payload", "value": "ca75eb2b8461e46ea2bf5a68be91cf34", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221979, "uuid": "6b0a8966-4b3e-47d1-99d7-784124514ae2", "comment": "Malware payload", "value": "4573e443dad09b48191a5d182ce75c8a71bfdc5121e514341f88e8db7f09af40", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221979, "uuid": "43e445ee-2437-492d-887a-bf90922d53a0", "comment": "Malware payload", "value": "3611abe6d01291f1431056bb111d9570b40fe42a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221979, "uuid": "f35ed427-5681-4608-9daa-ee91c104c2a5", "comment": "Malware payload", "value": "613e3fc9477adef67653f2e87287757f1aef1a46b345ac368a0d89637f6afd1d0f7bdf42e05b9b220829e03e4884e7af", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221979, "uuid": "0498a1e8-906c-4987-a8e5-325dd38cab0c", "value": "EC8302CE31EE01486ABB386430B7F54B50FC5F5B3D73B7288231A570AA114B57A126AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221979, "uuid": "6a365648-62e3-4f38-8f4b-51bbbca415c7", "value": "1536:6wJNfDtI/W4UgUlrZKFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbXYZTa4hp5:6wzpIpUhlrZ6O6xoKDShicdBMM1/XPQz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221979, "uuid": "ac5786f6-a94d-4138-8214-4ee44b7c9461", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221979, "uuid": "a8602663-949a-46f1-801d-342677556181", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221979, "uuid": "14a6bca5-7379-4530-91a7-0b5b480d1728", "value": "info-2034567899.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c84a663-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218577, "uuid": "6cdaace3-d580-45d2-93f4-5a29a6113955", "comment": "Malware payload", "value": "d6e5d61870b61cea3875a0a5c0287af8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218577, "uuid": "6f55842c-cd01-40a0-87a3-7bc5eaa48126", "comment": "Malware payload", "value": "45c7279b6cecb185cb2b721ac3d7c034c3bcb50960dd62cb2b8b630348f37277", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218577, "uuid": "87f4ecbb-a736-4d64-8255-576f092c5a4c", "comment": "Malware payload", "value": "c635e441e14121ebc0b996627f6ead8c65a3b28f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218577, "uuid": "f5a54bca-df0e-4b06-a1e3-386c77ea4ed4", "comment": "Malware payload", "value": "679d62277fa4ddf6211daf89bb8d59a90fc6042d250fbc32776f17f687a3d3b8dc870a91009ce3b11ba08f67bac20333", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218577, "uuid": "2c5f2b0d-a720-4629-9ecf-5d4f1be58bb7", "value": "22831220CB87DD9CD418E4001968FF980F2AE7666156455BFDB49CBB366E82C04C2EF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218577, "uuid": "20043a3a-cf6c-404b-bf29-cf04425b2d78", "value": "1536:466WB7yMfHNwvqBuKXxP8JXvKD2yWxaqQ6Rxt5AB/aqPwL3VbCb8:EMlwvaXxP8JXofm/Qwt+awaxCb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218577, "uuid": "0f91736c-2b8c-4b32-bf72-4c9adedb466f", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218577, "uuid": "b6e0e6c9-f1c6-4397-be79-192642a9c3ca", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218577, "uuid": "1be4cb2e-5002-4eb2-b3ae-02429e574fb4", "value": "catalog-160825279.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0acfe67-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220516, "uuid": "40eda1ad-932b-490d-af1a-0b0e80e3694f", "comment": "Malware payload", "value": "b5cae26554ab472b3d8badda7cea5c6f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220516, "uuid": "0e53baa5-ec42-43b7-ac14-0eb722903e1d", "comment": "Malware payload", "value": "45c7a4448f83d797d05c5edd7522bde4e03e919761e2dcb341c602d88e0154cf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220516, "uuid": "4c0a8f60-97c8-43ad-8aa1-795acac05dad", "comment": "Malware payload", "value": "7e887b0e9e8835e7830589afe1da0518d8568d05", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220516, "uuid": "fb75e87e-b936-4300-902b-fa7fe1e22ae1", "comment": "Malware payload", "value": "31925ddc28b2519651f704c76e75914904c59904c25c7511b2dd8ae176b9dcc3bd3ee0806a52144d4fc547da4fda548f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220516, "uuid": "c55ca9de-6a2e-4f5c-98d2-a6a1083f5314", "value": "088312F02CAE15BA439D6677A07D2543CC9C1FE026586F9B531117282EB1CDF843B675", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220516, "uuid": "6ac11700-b2f2-48d0-8a45-b33e3792a3ed", "value": "1536:LqVr7l+KIUejUgUlrZ8CWb/bLCDxxp/ERd9QnGlRTH7qrelcF:Lq97l+tUhlrZ8nfLMZERQnGnTHMeu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220516, "uuid": "efb8c648-0b49-4062-86df-d482459aba98", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220516, "uuid": "9327435b-a571-4c82-b067-fff7e0413fba", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220516, "uuid": "46fd8116-1a29-42aa-910a-34006977bb83", "value": "info-1219381692.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a60f44c-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218546, "uuid": "7df0285f-6ef9-451c-b370-d8df76fa00c0", "comment": "Malware payload", "value": "9297442cd811315eb68b9107a7e4e1a9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218546, "uuid": "151144bf-42a3-49fb-b58d-667a2e0a0276", "comment": "Malware payload", "value": "45cab09c62dfb4c1aa6d2ddb400c1dbb3e783e8aaf940aeab360741b08053337", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218546, "uuid": "776a7f9f-e88b-4472-97df-2a623a309dc8", "comment": "Malware payload", "value": "a67ac6c73663856a1e23c1b242cc08ffe33aaff2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218546, "uuid": "f56fad46-4096-41e3-807e-73900dee1f36", "comment": "Malware payload", "value": "ea1923a28faf8a21234ef53505177782e2b96b67bddd2dad6a7baaed6130c5b7f006ae851bd1d49d5e9ce41e8711710a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218546, "uuid": "104b6f40-7522-4cb8-85b0-9c2c9eeaad90", "value": "B28312E347D9289D7167BC2881647F8F58E95B23AF040C4F8EFE0B6B11974AD3690350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218546, "uuid": "3bf2f980-6e9f-4b9d-a201-65a1cb71f3be", "value": "1536:WA2fnBKj0MlbCIZi+nTnfZA6l3SNZzTJAsB0Ic6DMADMt5zC/IDIz10V:QBIZiifrCNBJAIlcAGIz10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218546, "uuid": "600ee1e8-c6a1-47fe-b2b8-653922856141", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218546, "uuid": "e8469f4d-7200-4d63-b0c7-d255439c85c1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218546, "uuid": "923cd681-1220-421f-a185-5198aeacd4ce", "value": "catalog-158542775.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4883afea-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218221, "uuid": "0c9f4ab7-7685-4c44-a24a-d933b111f7bb", "comment": "Malware payload", "value": "b18cee88272b6976da26678360f6481c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218221, "uuid": "356d2a90-89c0-4d37-9c7a-c895bc611c2b", "comment": "Malware payload", "value": "45ffc76ef7a76eaa163680a5841219a89794ce9fff08ed41c0c0032cc40cb9b5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218221, "uuid": "e7eacda4-00bd-4903-abb8-e1ef9de8132b", "comment": "Malware payload", "value": "0f795ee28e0ae4ff26f7dcd063716a30f0788552", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218221, "uuid": "b0bc6da3-0b83-4f59-8f02-6b67dd99e446", "comment": "Malware payload", "value": "d6bdfcd8a3cacbb89c58e2c240e8e61e65f2f70f32d0574de36d1116d1115327f4836c6964db9d05f75cc94ddd98130b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218221, "uuid": "5f3aa3dc-42c5-46c8-b490-fceb2ae9b060", "value": "02830258CB9F8D848011ED0ABB22F8ED75106248716973ABAFAD1124FF478D5B6338F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218221, "uuid": "870b5381-bf76-4902-974b-1e396d019bb1", "value": "1536:gA6P7EGmwH1zVQLQDYflSJXvoDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrns:gAY31zVQnIJXaM25NfuQjMCYNBwltD0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218221, "uuid": "37a0a9cf-6ec1-4d8b-8de0-95e75d8e969e", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218221, "uuid": "b8e8955a-d84c-42e9-9ec9-186878c8c750", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218221, "uuid": "f56f9597-9dd0-416c-9d02-0ec3b4083c1e", "value": "catalog-1402583600.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733ff25c-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221299, "uuid": "39bd1b5e-cc80-42a7-bbc9-ceed8614b047", "comment": "Malware payload", "value": "96f1a2cfe1246857914a062149667864", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221299, "uuid": "15c9b14f-353f-4c06-a662-c13a1627202e", "comment": "Malware payload", "value": "460ed93b844892edf5cff30f5dfb5833e6d12c75d3f533b7827013a5a59ab2d0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221299, "uuid": "03d2b195-13e7-45dc-99c8-f819cdfadb22", "comment": "Malware payload", "value": "453e3b7bdf422ada7636a40b05c03f5a91ab7ea1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221299, "uuid": "54492a7c-17a9-46d8-88bf-491527aa39cb", "comment": "Malware payload", "value": "ed09814a6127d3a0a1c4e81d95976a2da0e7dc1d740c872795ea8ab629904fef8d97330babda3c61cc6fb0a040de338e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221299, "uuid": "b978cecd-05f3-4b83-adce-d454ec52bc87", "value": "058312A7F537ACF9C1ADF2D7A22F625C36EC85C0B0358286F61E3E16C599AED550480C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221299, "uuid": "60369ff3-cd77-498b-bf95-a55b97a5c074", "value": "1536:KHZbN5m6RtUlLHfAkZ8kISNq7xWgwMQZcUT7oqlaHvvbFq9GHocnoe1RqfwSOJre:OBm6XUFHfA210waUT7o/v096oiBkwPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221299, "uuid": "a22b3574-f687-4a30-970f-fb3ea8b513fb", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221299, "uuid": "1d11b58c-e29a-4e13-a54a-0e61094b6041", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221299, "uuid": "883afdbf-ccac-40c8-868a-cabc95e1a12d", "value": "info-1604406145.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d5d3a9-a419-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619171527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619171527, "uuid": "a9fcf5fe-0881-4a7d-ac11-93c5be0bd34d", "comment": "Malware payload (AgentTesla)", "value": "51cc9ef1470b1a132b0c8555bb204291", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619171527, "uuid": "5fc3ecd9-7e7a-4b97-afbf-53c5cf56aa85", "comment": "Malware payload (AgentTesla)", "value": "4618f55b6482e1d13e798ed1045deb42ab9efb04c1e16a2313d62f1ec6d9ef43", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619171527, "uuid": "91969c1a-dece-4220-b8e7-9d3f6bc4bc36", "comment": "Malware payload (AgentTesla)", "value": "d54e8fb1eef02ec6c1c4d246c912ebfd82bb0e67", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619171527, "uuid": "d7b1116d-b8b3-4a93-beed-9a30cabc3ae8", "comment": "Malware payload (AgentTesla)", "value": "a2e77e1e72f45d4211a815c87fd385c5c4ed878a01488ce27eb2163255aae826fa925b636da9e25f6faa350f2b85d74e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619171527, "uuid": "a641d036-da36-41c8-8280-26d1ac30eabc", "value": "91050122F790A698D02D4A7A4502D34157F3FF265B26D94A3CD4728F52323A2D6B1FCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619171527, "uuid": "b8f93c49-16d7-460d-afb0-f9943e58bbdd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619171527, "uuid": "d9c9c474-2739-4681-88ed-6cc79ce8035d", "value": "24576:JBruSHRRRRR6yh9V1DX5Rd07EXQmawEtIh:jruSHRRRRR6MhDXDXMwE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619171527, "uuid": "c9c810fb-b1b8-47e3-a7fe-2a576d040110", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619171527, "uuid": "3db75ad4-b1cd-4e1d-bef9-d9ad6fd88f82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619171527, "uuid": "6838b372-019e-4359-a5c7-eb854af01ddf", "value": "1221000880.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ccd32cc-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221745, "uuid": "2511ae0f-91a5-4a89-a1ab-702ec0fa80ee", "comment": "Malware payload", "value": "6bf4ae4c7bb5b0ad650bfe56e01dccde", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221745, "uuid": "fd4c9569-958e-4b8d-9898-c2c88a1ab586", "comment": "Malware payload", "value": "46359f4a0ec425b03495877849aeb44b69f4f516e59a9cd08e04fd23df11db11", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221745, "uuid": "3a3496a7-5344-49d8-abc3-9d974efdb064", "comment": "Malware payload", "value": "ea606b4bdc698913c0821c2adf67caf04f49b9ba", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221745, "uuid": "9f14bd66-834d-44db-b314-2131331ef886", "comment": "Malware payload", "value": "80e87c4a3cd458827508bfe7ab6142077cf42344808c33269452a676c3637ae66a60089b7022afdc17504a32ee55335a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221745, "uuid": "8d83b9a5-1205-4da3-8c1f-85cb8b1d8698", "value": "E583029C30FF0144957A68B8613FE80750FCAFDB2D37B74947308574AA214DAB6279AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221745, "uuid": "9c9f0a52-0ff3-4865-94b9-252eb2a77774", "value": "1536:mr7l+KI0ejUgUlrZKFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbXYZTa4hpV:s7l+NUhlrZ6O6xoKDShicdBMM1/XPQTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221745, "uuid": "39e0713a-7bb8-470b-9ea6-73862314ef80", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221745, "uuid": "f7fc020f-ba62-4afe-9e4e-d836981f2ffc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221745, "uuid": "9256829e-ad26-49e8-b4ff-32f18a82a3dc", "value": "info-1854610489.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8291dbda-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221754, "uuid": "36a2222d-8215-4dec-9f55-3f14df00ee9a", "comment": "Malware payload", "value": "d51ccde23ac925d05994b2df09570420", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221754, "uuid": "3888754e-0049-4c70-96ee-10fd4abb2b53", "comment": "Malware payload", "value": "466ae0d5d4cbba22c71e299b8016ebcb07f4a381b1478bba9bef912e670b30d4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221754, "uuid": "51aca779-8442-476d-be6b-9cfdb2bc8c1b", "comment": "Malware payload", "value": "2aa1c125e10e378765624f435e3bc09d3caa8c0a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221754, "uuid": "74a43129-0810-44f7-a5ab-96db2fbfce52", "comment": "Malware payload", "value": "84472d185056f25621c5c96dd4d85a6839cf533b2668a5408c2f426e758911a2f269f1eddc1cfcf5ea3ccac94bfe348e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221754, "uuid": "2cfd6666-7c29-4cd9-a51d-ec56c11a3a03", "value": "EF8302CE31ED01486A7B786470B7F54B50FC5F5B3D73B6288230A570EA118B57A126AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221754, "uuid": "ad4b73a8-d621-4da8-bd58-4dafcc198e38", "value": "1536:4wJNfDtI/W4UgUlrZKFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbXYZTa4hpp:4wzpIpUhlrZ6O6xoKDShicdBMM1/XPQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221754, "uuid": "d38316df-5339-4529-a3a3-b833bad0db3e", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221754, "uuid": "9591a975-65cf-46db-b47a-164bab62a8ea", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221754, "uuid": "4ba0311e-a462-49ba-8105-e2eb2d02aecc", "value": "info-1859422502.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa467d94-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220667, "uuid": "f01d2b20-019b-4424-b81d-e97d9af52295", "comment": "Malware payload", "value": "7e3ea89c9562b50c6b01ec0b815b342d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220667, "uuid": "59a67489-f8f0-4ff7-b2bc-09a4b25c7a11", "comment": "Malware payload", "value": "4690fb3273d6169adab35bc71f6f321d227aba2e6e14a582d729f2c98384c3a8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220667, "uuid": "6d8d71f7-3be0-4405-bd3d-5f78163d9be0", "comment": "Malware payload", "value": "2d7202c2a0a5272d3235b84288f0fa30b7dbd2ea", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220667, "uuid": "fd89ee50-e292-43cb-9e7a-cd130b8f0bf5", "comment": "Malware payload", "value": "59af983e8c234da54565cdbc554823d7081b538102e71d9649cc4f688a08b5aab021a81732e1e4c09d2a3bb5737b6883", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220667, "uuid": "46b5c372-74b8-4576-a834-bd3491d1666a", "value": "6E83121A99BD1CD9C0BB13F00D73094D4860EF6D411C8449F14AA68F78AEE85DEF7AE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220667, "uuid": "fe7ca8d5-b10d-46bd-86d4-d060f281f7dd", "value": "1536:Yt1QVGeGAg5dwSp6yMvBjqqxPGLuhCWdHsh1oSFWsfEFhHqLWs:gAG7A8l3MvBjqq5OsZdHAO5hKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220667, "uuid": "33636df5-19d2-480e-a143-b7657ba9ed7d", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220667, "uuid": "7b3e3bbf-a933-4fac-9b9f-4a44db637f16", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220667, "uuid": "f31699a7-a6b5-4377-89b9-efff02eac463", "value": "info-1298973202.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1dadd0-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221099, "uuid": "345df4d3-c920-4b53-93c5-6c0d66397cd0", "comment": "Malware payload", "value": "ee606825557ab78b0875fdfa2f6b10a4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221099, "uuid": "1f384ec3-211a-4224-b9b5-e93dc35c8b73", "comment": "Malware payload", "value": "46a00961620bd529818ea148dbb52730354c16aa98577fcce7337a56f4f2ae89", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221099, "uuid": "bd82200f-eeee-4610-b386-71a8ff96ae21", "comment": "Malware payload", "value": "8b470cece9de899b7b2e4c6e9d873befc0e2d4d5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221099, "uuid": "b40e79e4-0fdd-4f39-8087-c521854a128b", "comment": "Malware payload", "value": "c8ed8588c0af34e96a20e68772e7f3695ca145a75bca9f7eaeef7ea4e083104d312a6e3538a4048d6a1b50452bbd80a4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221099, "uuid": "1fb17838-6474-43e4-85a1-cc5d4757b8cb", "value": "8583029C30FF0144967A68B8613FE80750FCAFDB2D37B74947308574AA114DAB6279AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221099, "uuid": "65f40c67-0993-4972-acf9-adaab2ef551c", "value": "1536:Xr7l+KI0ejUgUlrZKFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbXYZTa4hpa/:77l+NUhlrZ6O6xoKDShicdBMM1/XPQTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221099, "uuid": "f8e5f160-117c-4a7c-a566-55081007677b", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221099, "uuid": "961fc8d9-a97a-4d57-9c2b-07171cc40812", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221099, "uuid": "66f76333-5521-4355-a7b4-07e26cab645a", "value": "info-1492093250.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef05607-a46f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1619208407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619208407, "uuid": "3b4aca8c-04d5-47f6-95ea-20bbf29fd838", "comment": "Malware payload (Gozi)", "value": "649b08006aa0d3404581dd983e120082", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619208407, "uuid": "1c7236b3-fa54-48ca-9f15-2080da2d1cb6", "comment": "Malware payload (Gozi)", "value": "46b5308d058e2dcd8e0868345d77a81abea0db8e0aa32a6b55e264fe18b7f577", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619208407, "uuid": "63e36ca2-1f6b-471c-8309-2cf53de5be4e", "comment": "Malware payload (Gozi)", "value": "4fd106efc91a69c0f841112690b0703f06ba07aa", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619208407, "uuid": "36c5f9cf-2758-49af-be1c-df34260a19c3", "comment": "Malware payload (Gozi)", "value": "dcc5e93fda8353c3625eae3fa98ab29df441e3a323d152b3e795f8d1a766f4519a6ff6ff2b299c0848669f0247f41fdd", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619208407, "uuid": "7cc823eb-7837-40cf-bc5f-041fbcd08c5d", "value": "FC15AE127682C472D1721A308D79D6F509AEBD254F3089DFB3D82B3F6B765C24A31B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619208407, "uuid": "6b32b7d1-00fa-4c06-84af-14af212bc591", "value": "44651f329c07f336663299858381870f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619208407, "uuid": "3ae94f2e-014c-42b1-a611-2989a44e3f2d", "value": "24576:Dx3XEeW0BLDnAyQ8jbVINuAzNm4etJkeyeYV:Dq4pcAVINusNm4+kefYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619208407, "uuid": "70c2c3de-0daa-4aa1-8ecb-fe7d320509c1", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619208407, "uuid": "4d36b4e2-320e-482a-9954-aa925cb2751e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619208407, "uuid": "ce7e9fe1-b111-43a2-85fd-f957f71fed2a", "value": "boxi12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064de925-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221116, "uuid": "9bdb31be-c3c7-4bbe-b753-d780c206cd23", "comment": "Malware payload", "value": "e3afe3b966a0600aad61efa70a4e0c11", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221116, "uuid": "7e08773a-a813-4d23-8c73-2f190fbec2ac", "comment": "Malware payload", "value": "46dd4ddc430772b9983c283f40dfb49d7fb038282e55051853615915736ebcef", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221116, "uuid": "8e56ed0f-a55c-4830-8dc8-46b20f52950c", "comment": "Malware payload", "value": "a863bca497f565ac408b2e49f8f0c5a0731c0008", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221116, "uuid": "a7d890ae-c234-499c-9227-91db88072010", "comment": "Malware payload", "value": "ac59adc18e0475095f2d3817ec4e47767bd9c15e665e98cdb05e5d96bf4047e4a8403c50a8412dbd766dfdb67224a05c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221116, "uuid": "d67f535b-df91-4c3e-afbd-76083103232f", "value": "8983121B667E3D98C219A5F45EB31F6D2D600CA9815C80AD514B64FE22BCDE24E638E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221116, "uuid": "9c185b9a-f878-4aec-a3b9-61478b6a311b", "value": "1536:8taLgbCL+q1zmW7WPGLuhCWdHsh1oSFWsfEFhHqLWj:8ZG+xW7qOsZdHAO5hKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221116, "uuid": "a50be17a-cf1a-494b-96d1-c4dc80543330", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221116, "uuid": "649edb28-111f-40ab-bb27-57171d9b0b94", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221116, "uuid": "8d72f78b-8d42-4e64-b6b1-1fca4d4a7086", "value": "info-1499188218.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3b732c7-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219260, "uuid": "fde7bd2c-c201-4f81-be23-6828f8b61090", "comment": "Malware payload", "value": "53732a6659d26cd40dbd6ca499488afb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219260, "uuid": "1caa69a8-fa60-4a10-9d01-19510085e36d", "comment": "Malware payload", "value": "46f4a16213e43a14187efd5eafdf789c44732216020dcc4cb272cb0526e9c921", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219260, "uuid": "709482f4-a560-4895-9a06-59e5914fccb4", "comment": "Malware payload", "value": "64d2f188b942b825536964d0beade682e5044f42", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219260, "uuid": "c9ba9d76-4f89-458e-a318-b0f4df2701d8", "comment": "Malware payload", "value": "268335da7a4df3922a9d0b377d97dd45070547246550522caa54af14e651886a1ef066a9585cab5d46479d597dfc7580", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219260, "uuid": "e95075d2-bfa0-4243-86fb-481d2dfda7ef", "value": "F28302D58BDE8814C5019D0C7E39BCA57560692CB00EF2E6BECF0B50BB5349AD1F2AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219260, "uuid": "b4dbfac9-8a87-4b47-bc06-113c0cc4200e", "value": "1536:lLYnBKjsMlbCIv4DhQ72ZTaNqhJXvoDLf+5ff9fuQjMCYNst+IHCkPLqkwD0DCuq:lLYZIvU7JXaL25NfuQjMCYNBw0tD0DC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219260, "uuid": "eacca416-c046-494d-ae15-f7ffe050ff69", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219260, "uuid": "355b1294-8977-4386-bded-4baee78718de", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219260, "uuid": "f1724c9c-b345-48fa-b884-ff7ff59afc37", "value": "catalog-1965829772.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb4f6f48-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218843, "uuid": "9e0e9bc5-6998-4493-b348-4ae303e27e58", "comment": "Malware payload", "value": "f10941be7f70a5462d49cb9836861316", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218843, "uuid": "caa52590-fa5e-43b3-b608-b75f8eed5902", "comment": "Malware payload", "value": "46fadc1784d1991c3921c83a0f66524bf220d00ea721691d205517bd73f1d064", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218843, "uuid": "4a51d4d8-1311-40d9-813a-3180acf63c51", "comment": "Malware payload", "value": "a4404b2a85b5a513c619346a7ea032c2f685540b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218843, "uuid": "51dbe37b-564c-4620-9475-ccadbe9515d0", "comment": "Malware payload", "value": "01417e987834539a6503ca9b33644b71136f93b0e5a1021421be41fcfb30f197dbcc76dd17320962869f2d0a3b592bb0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218843, "uuid": "ffc33877-1124-4c5c-be66-636cd1726f30", "value": "758302D79DCB12A87029ACB9C4772C840A19CDB7D246222A265636771856F7FB7008FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218843, "uuid": "3054321c-267b-47f8-8417-4438d3151224", "value": "1536:CAS5f5E/5fEnaj1ZQUcDpTe87VqINbtezgVRxr9AiUrQTKXs8FI+bK:CASvE/Ztj1ZQUcDJe8JqmdIrLjFRbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218843, "uuid": "44dbcff6-1930-4530-ad61-bb2db623f099", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218843, "uuid": "0924cee6-7523-4533-807f-3860f0bfa5f0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218843, "uuid": "a7b92bf8-f0a1-4e34-b96b-5510e31ecee5", "value": "catalog-1740286288.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49de7d2-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219744, "uuid": "f703d262-92a9-4c9d-87ee-41525f8f5772", "comment": "Malware payload", "value": "3c77962f2d9fe63073789034c7f17067", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219744, "uuid": "92120bc4-f265-4e32-9c76-27457e0b5a4c", "comment": "Malware payload", "value": "46fc0cf19d2015f8bbaa55e971544a8851a11c5b78e348118ddfa666c7d7adf9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219744, "uuid": "cd5d86ef-b772-4f8a-8aee-f44c25f26d90", "comment": "Malware payload", "value": "b160a3c41a560870673298dbc8c612c4ffbf8200", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219744, "uuid": "15a8235c-eebf-428c-877b-7734c5a8017b", "comment": "Malware payload", "value": "e5a33d400192782b763e553435a2623486bc538233d456b69a25c113f47bcc3c5fee468a7bb63b63449e333bd5c2793a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219744, "uuid": "4340cc6f-a15a-4627-a2ca-c50504385384", "value": "E8831227FAC721A28006EAF29B323B1D6A4279D9745435A68FBC03C0F63615F1DAC1C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219744, "uuid": "bda56919-0ea2-4207-abad-29928c7edb9c", "value": "1536:mE9my0pi0wOQMF4gCQZiwotTCWBxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZiZQ:mFy0pgOQMFEvtTCWjJ9a03fjwe1moYpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219744, "uuid": "67142d3f-5923-4176-a52d-021f765a7161", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219744, "uuid": "3a5588ab-ebe7-4064-a3e1-835b3c7b002b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219744, "uuid": "6503aa00-829f-41ba-9508-56a3fd15a745", "value": "catalog-320853113.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd28f26-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219065, "uuid": "f9d2993c-495b-4716-bbee-87f061f03b22", "comment": "Malware payload", "value": "f079796205b016bb7fa0d86544a99155", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219065, "uuid": "0b27ddf8-362d-45c5-a5ad-b7cf89f0637f", "comment": "Malware payload", "value": "47098a11d0adb3fbb40398c91392848778f03a54adee49f6b1799b35484e479f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219065, "uuid": "61c6509d-f2ef-4cca-83e5-5d9d153fafcf", "comment": "Malware payload", "value": "026889929e0632fcd272860f0622a49642c2444b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219065, "uuid": "f95ac8f8-8ce9-4701-b086-da606090d7fe", "comment": "Malware payload", "value": "f32276f7498e3e16248bff34086508774a1d0311d5d16d3950a66b879973c6e216f6c8639e2672b611a24ed983581321", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219065, "uuid": "3030bdf8-4497-4e76-9e3d-3fdd0ad9c7fa", "value": "5383028BB4D8433ACB3523F658AE5E4426B1A47F040CC6DC65973A786B53672A572388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219065, "uuid": "aec4d39a-07b3-41a6-8edb-472b65c73ab3", "value": "1536:5EwAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvY:5HijtuPmU9j7+XFWtYe14hbOjA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219065, "uuid": "88176116-54ab-43fd-8312-22d693ef9e40", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219065, "uuid": "e58b7fba-b5b0-4e2b-b069-3edbc838cbe7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219065, "uuid": "3ed32fcc-59b9-4a22-962d-6ce6674cfe86", "value": "catalog-1867807294.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62382b6b-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217835, "uuid": "4eac58f2-61ea-4419-ac55-80aa22c454a7", "comment": "Malware payload", "value": "bcd88249363442da47f75151a1f399e4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217835, "uuid": "4b9fec48-b31f-4af2-90af-d87b4ee630d4", "comment": "Malware payload", "value": "471ea37a57c0f7df4bf59bc5608388d140be1690082632fca4b57dca470e7fd5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217835, "uuid": "b541e73c-88dc-4c5c-8964-8e592360b25c", "comment": "Malware payload", "value": "cdf94f747b9d762d49d709a92062d004afb6b2b6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217835, "uuid": "42000fac-65e9-42ca-8f2f-032cbe3964b8", "comment": "Malware payload", "value": "ce1c555c2e468df648489ce186c4ce19527eb64e3f774b6c42a5ab6f0dbc0d1e06b130c5337af9c60d4555e58e034b7b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217835, "uuid": "6f98b85e-1f1d-4075-a339-03997a94ba71", "value": "36830276DE8F8289C016B23003787FA61F286B7146A1141E5AB0747B2F5B9BD4C85FD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217835, "uuid": "b7a8e4a0-1395-4077-b83b-a67c38a42489", "value": "1536:XEyHCzlWAXdZ2rQD2aCvdyWxaqQ6Rxt5AB/aqPwL3VbCbm:XHCzh2QKmm/Qwt+awaxCbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217835, "uuid": "3830aa16-ed6a-4cb4-80e7-ca2e66a3fe36", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217835, "uuid": "07b3967c-ffdd-41eb-9c09-67ff7ba10d90", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217835, "uuid": "cb7e256e-7969-40de-8586-05e2c3dcf149", "value": "catalog-1188865292.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d234a110-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218452, "uuid": "76546d08-61b7-44d7-a08c-97d993655d39", "comment": "Malware payload", "value": "4bd855878173a5e9705db05d215a2a09", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218452, "uuid": "8c741f9f-ffd2-4191-8f35-1c496e7d84ac", "comment": "Malware payload", "value": "4721d8b00e97730d3f36d75c1cb1d7a0d40f651a99b433d79cfc89bada8cd2fe", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218452, "uuid": "592014ac-2a4e-4eb9-b4c7-2af6f102164b", "comment": "Malware payload", "value": "a26e609175e32f111789412ffdfbcc073b29ae13", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218452, "uuid": "ca46451c-c1ac-4c21-832e-0c86bf05d025", "comment": "Malware payload", "value": "e0c7c72adfd702c09b81274f5e36e848fc31060b38a94b60b46928bb2fe358cb727cc866f3fd41b1ffa2c041a4bcafd8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218452, "uuid": "d80e0013-b438-418d-a8ab-882be11d89fe", "value": "5B831277BA612DEC2812F612A165AFAD25FF1D8776540C6DCA7D142340862EE3ED02E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218452, "uuid": "28feeaaf-492d-4442-b42d-cabe09769c7d", "value": "1536:ZxAS5f/KHErqQaiwotTqFUAAWBO3SNZzTJAsB0Ic6DMADMt5zC/IDIz10g:bASlmEXvtTqFKCNBJAIlcAGIz1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218452, "uuid": "77c2cf60-042b-4fa3-95be-af11dfc694c4", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218452, "uuid": "41f7d373-b3e2-4830-8c29-478ce873f1f2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218452, "uuid": "6ed3086c-15f1-4678-96b7-9006b5e9947c", "value": "catalog-1512101794.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d1f0a6-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221808, "uuid": "7f6dec64-0650-4666-89a5-c255b7ca91cf", "comment": "Malware payload", "value": "8ea606e811e81e5297403756b842b586", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221808, "uuid": "0b4ddb0b-a72f-4c7d-a597-b57011f98e5b", "comment": "Malware payload", "value": "472b6d5076a59554196c60a15d41d49e4418b23fb72b357d8ff02e5a7041aa0e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221808, "uuid": "4e8b5aa8-f654-4732-b380-41efa558e967", "comment": "Malware payload", "value": "7cb87a6c5cd5744b0f033b0e714a232608d9cd5d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221808, "uuid": "9aaa3714-6493-4fc4-a7b8-60e8fc20d4cc", "comment": "Malware payload", "value": "9c51b3f5a7e3c972e2cb0f6a697ac591f6595f24d2bc925ce38ad642cd21cee3e7c45939f36d1ef97ac92ee2350d635c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221808, "uuid": "ba698da2-ebea-4ba3-b4ce-12d28729c700", "value": "738312B7F9776DB6C15CE1E7A63F122824EC91C07435968BFA0A5E06C91AFDD9204C0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221808, "uuid": "7f0c410b-4d17-4ab7-9674-8d4a401a1a83", "value": "1536:ir7l+KI0FlLHfAkZ8kISNq7xWgwMQZcUT7oqlaHvvbFq9GHocnoe1RqfwSOJrpM3:w7l+6FHfA210waUT7o/v096oiBkwPQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221808, "uuid": "4a2c001c-72e0-48b8-b594-41c58ecf165e", "value": 86799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221808, "uuid": "e77bb864-53ab-4651-a07c-896cbc51e918", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221808, "uuid": "0faf98a0-9e19-4b15-b225-449ed8f5e25b", "value": "info-1895443171.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b348b1-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218438, "uuid": "2ab1db45-01d8-4a76-9735-e488b3bacdbc", "comment": "Malware payload", "value": "f91ca3b9630cc1dc11a9633cc91e0cc6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218438, "uuid": "40f7f197-e69e-41a7-a9f9-4a6130684341", "comment": "Malware payload", "value": "472fc0726c5c02c9b37bd7e33c590fd06573ca43031c397b911c09d2a0aa3f83", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218438, "uuid": "4cb1d5d3-da24-409e-b814-1b893c8499b4", "comment": "Malware payload", "value": "e43fbf23c7102c490fb719f53984bcc7ff4127c4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218438, "uuid": "5d8c4f51-cb43-4be8-8ce3-dfb64e1f0fc1", "comment": "Malware payload", "value": "dab7631272c37ad0026428a4aa1fc0e31e964d0412870e22eab3a85578aec5c3ece64a2c776a32fa7216b71dc3752b6c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218438, "uuid": "671a11b7-5a8f-42e8-ac45-bab64b0ae2a7", "value": "94831276DE87A28EC402713013782FE74B2C6B719A61151A2670747B2B2FA794CC7AD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218438, "uuid": "10ecd10d-3419-4977-8859-b52ff971511d", "value": "1536:YuRWAXdZ2rQD2aCv0yWxaqQ6Rxt5AB/aqPwL3VbCbs:Yg2QKDm/Qwt+awaxCbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218438, "uuid": "2409d490-3c9e-4fda-8739-6ee7efe002bd", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218438, "uuid": "ceb06c85-4dcf-4a5d-bb09-6275c3e3d8fa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218438, "uuid": "daa338eb-ba1e-4da0-9997-c02fa314c69e", "value": "catalog-1500667122.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd39056b-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221477, "uuid": "75d0bfe8-00c1-4d0b-b2c3-01f85fd8e37d", "comment": "Malware payload", "value": "1bb01e8bcd77c4bef95491f15249bdc9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221477, "uuid": "a8c01b18-1e89-45a1-a399-935cd86bc5a6", "comment": "Malware payload", "value": "474958496321e78031c87c0f78066605b2f9c45ef363543d71be25ba5d3c2c19", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221477, "uuid": "2c5a2b92-0092-4408-bac3-2c7943076e3b", "comment": "Malware payload", "value": "9ac482e8f39da0168b07be2bc2065542102eeed9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221477, "uuid": "a0a54415-672f-4335-92d3-513aa3ed8dbd", "comment": "Malware payload", "value": "bcef7e2b702ad1afea0cb141987a9789e34815d55cfee992ae3425825e72e0fb49f3df33c5d92dbb503dd61191aef9a3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221477, "uuid": "b4d12600-1a43-438a-ae66-55638198e3a0", "value": "10830215A4BC86A780F3159229307BC78AC0EB9B5849C043F1349E27E4E6BA6857BF5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221477, "uuid": "bb3e8f7c-02c0-429d-8ed3-03bb87c01f4d", "value": "1536:tt1QVGeGug5dwSp6yMvBjqqxM5Y2VXw1QFsrGq9ZMlmZQTQd1:tAG7u8l3MvBjqqqXw6Af5d1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221477, "uuid": "1ccb1cf9-34da-4ea9-b45a-c1c5dcfa8ffd", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221477, "uuid": "3647d356-8e05-478c-8b63-77c7ae4d9616", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221477, "uuid": "7d9c1bd7-6ae2-451a-b2b6-799301f6fc29", "value": "info-1704247175.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c183bd-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218461, "uuid": "f0960c6b-e9ea-46b8-a3d9-e4fc188ec354", "comment": "Malware payload", "value": "5a78de14c671cde64f926f4b9c21cd9c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218461, "uuid": "2a69ae99-89d9-4561-a414-9e62fe34207d", "comment": "Malware payload", "value": "477a48ebf72f5009b2e2aa30d5c2377171a09362cb4c8bf651ffb03184a23577", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218461, "uuid": "4cc011e3-c48f-44b9-a018-81e6836a75fb", "comment": "Malware payload", "value": "e6d4c1b53af862c81738e78c52249dc454950433", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218461, "uuid": "a5b12c03-6177-4aba-8bde-a22db8090c09", "comment": "Malware payload", "value": "cd5391f36355c2605b34b15239edc0c2ede519240e4b5b7d6f748bf2a4e5d40a74344544eadead57db744970ada5725f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218461, "uuid": "dce17468-9742-4eda-9456-2a35bca73756", "value": "E5830258CB9F8D948005ED0ABB12F8ED75506248706973BBAFAE1124FF478D5A2738F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218461, "uuid": "c096958c-f4d7-431f-a3ef-93d1acd435a4", "value": "1536:sA6P7EGmwH1zVQLQDYflSJXvoDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnD:sAY31zVQnIJXaM25NfuQjMCYNBwltD0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218461, "uuid": "b7572f34-c9e5-42de-b09c-f6a0f6a97f6c", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218461, "uuid": "9082f354-83ad-4e26-a834-44f5517bf33b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218461, "uuid": "e6f12da7-759a-47ce-9b34-8a241b64635f", "value": "catalog-1514232970.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e51f04c-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218204, "uuid": "d74b5c0f-5daf-4d28-8ee0-3e6ef1380603", "comment": "Malware payload", "value": "2542de43063647ae7979ffaa1e0323e6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218204, "uuid": "b67a2bb5-d7ff-489b-b16c-d29cbb11afcd", "comment": "Malware payload", "value": "47a46d1233eec49c4197c723e7758e31f53c422e5e4c3c03624d7cadb11d8f13", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218204, "uuid": "aa22b0ee-7f34-4cd5-b027-53d17a4f32de", "comment": "Malware payload", "value": "0e1aa91b434dee8e2c12c5f16682a2b76c5cfe5b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218204, "uuid": "0ca0006c-6cc3-41a5-810c-939a5c1ae595", "comment": "Malware payload", "value": "04287a38a64b320edfde2c1bd81f8d6964edc803c3d59fb4e7e80b889401186f3c71f1a0ebdfcf93fb82eb74b38dbcd9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218204, "uuid": "5c16131c-acea-4917-bda0-014c840ec92d", "value": "7D8302CB74E9433E8F3527F748AE1A046271A43F44088ADC35D73BB86B566B265723C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218204, "uuid": "427e5f42-f9db-466a-8964-d3d0292e2af1", "value": "1536:uAfNtg2tf2vCapQ72ZTaNqeo6Vadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvy:uijtt2v7aU9j7+XFWtYe14hbOj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218204, "uuid": "f96d704c-a055-4623-bc12-1e5d8521fd58", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218204, "uuid": "003772f0-ca25-42f5-aea9-5e6a21307ab7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218204, "uuid": "492e4b12-3f6f-47e4-aa80-ac8cb0ca89dc", "value": "catalog-1391845053.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4379351-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221811, "uuid": "3257992b-1529-4651-aafc-a803a4bcc33f", "comment": "Malware payload", "value": "4d0095184a12f4842389ccb5dcfae944", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221811, "uuid": "8a09ab75-06db-4a78-9639-b4419faab63f", "comment": "Malware payload", "value": "47b894431a9d56af4ab24d9273f736ea8a6b1dae878d12f4044d60574b1816b7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221811, "uuid": "33854ccb-e035-402e-b5b5-fa16f5a6df84", "comment": "Malware payload", "value": "070d7c8e5c200649898ba6de599faef2b0495c2a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221811, "uuid": "08c82f26-b24b-4a40-ad10-69592653dcc9", "comment": "Malware payload", "value": "a72666a49e14c76debd62d2ba6c121d399b3559aca318ddc074e344d1dc0997d86c69019dab93ef8b8ab1ca23df1e9a4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221811, "uuid": "5273900d-a2b7-4746-b815-990fe3853315", "value": "2383121068BDC35950E31A9024707E578FD0F793988CD043F2A4AB77A5E0BA5467EEAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221811, "uuid": "85253924-9885-44d0-a8e4-6634d3499bad", "value": "1536:cxKzHWdwSp6yMvBjqq7M5Y2VXw1QFsrGq9ZMlmZQTQdx:cxKzHWl3MvBjqqUXw6Af5dx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221811, "uuid": "0a8aa2e9-4c66-4660-b6b1-8275f8f030e2", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221811, "uuid": "ac9f4fab-04c5-4db3-b0d3-8caaf9e2f8ae", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221811, "uuid": "56a5f461-6bfb-4033-b9f5-6d6e367e0515", "value": "info-1895635456.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "524b8f23-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219096, "uuid": "45c852eb-cc67-4f08-bb58-d08b64797f32", "comment": "Malware payload", "value": "a0996c10909acb9baa0d3383f5c3b4da", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219096, "uuid": "1ee6f9b8-a94a-4b39-9402-b1a038b4e80c", "comment": "Malware payload", "value": "47b8f38df53760fd4f711e6ba8b1ed723197e74d7518c74bdf5ad96746b77a0c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219096, "uuid": "418190fe-0a0d-43de-b834-9996693501f5", "comment": "Malware payload", "value": "47ac6b2c3878fc4fc77f62e5d267b5b6a4ade6c5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219096, "uuid": "9d65ceec-858d-4160-acaa-a148a8b599bc", "comment": "Malware payload", "value": "f992ec49d599d858a3ff88489be7c5c5b4af01f0cc93ff07284bf7c24f92bfc4412bca48d44594bf2a67462fbe01b79d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219096, "uuid": "254b503e-b835-40d9-90ad-f1d79724605c", "value": "2A8312EBCFEA4D984202BF0673065CBBB464280C6118BA7A7EDD11502F524A0F4B7DED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219096, "uuid": "3b4abd9b-8547-4586-a7e6-65e4712614ad", "value": "1536:b4KLWkP7EBmnbRARpNdZ2rQD2FPdo1f+5ff9fuQjMCYNst+IHClPLqkwD0DCuADR:kKLWSFbkpwQKW25NfuQjMCYNBwltD0DC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219096, "uuid": "f5e5be73-90a5-4c53-9555-b6264d2aca8e", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219096, "uuid": "79b2aefe-9d84-4055-8e0c-ec1177b9644e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219096, "uuid": "54fece5a-4124-4115-8af7-ba451eb53357", "value": "catalog-1887825838.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770a1549-a409-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1619164612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619164612, "uuid": "2c2e9e19-153f-452f-a87c-ecfb8bebfce3", "comment": "Malware payload (Gozi)", "value": "eed96d06c6abb27f5706cdaf74b23466", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619164612, "uuid": "1800782f-6505-476b-8211-55db383a5ac3", "comment": "Malware payload (Gozi)", "value": "47c0bff79348c16f8a28f868213f56333fffec7117a8333c88172885aa67e7c8", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619164612, "uuid": "925f50dd-a1f9-4af9-991a-4f4e14697d8d", "comment": "Malware payload (Gozi)", "value": "3f02cead6bfef1921e544e658f38151d4d8308fe", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619164612, "uuid": "c1d35759-7bc2-4a46-a53e-323597398b45", "comment": "Malware payload (Gozi)", "value": "2e09d90b014bd35992ad976b978cd7eef504a35523a60e66c4b140f7b843d1014b683c8c6ead1e41b3603ae90dc6d831", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619164612, "uuid": "df587614-6c16-4367-8139-0e776fa805f5", "value": "B5D18D7FDF509D66D7B18ABD263C1A078068409B4158AB1EC3E01F8BB370CC59D86F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619164612, "uuid": "a9b1e8e3-0f9d-47bc-901e-a22337e801e6", "value": "192:C9/04RwqDoXT7QgWBhS8oKvkz+/wGZ0afaeC:Cp04R5EXTUggktKMz+LLy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619164612, "uuid": "e8dd8b86-2989-46e9-aa4b-74aa101348c2", "value": 6647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619164612, "uuid": "6f784750-af5f-4533-9396-90104b4c923a", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619164612, "uuid": "eeb99d1c-2e9b-487d-a75c-1465c682746b", "value": "presentation.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1da4895-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219659, "uuid": "ebb6f5e3-ff39-45a8-bcd3-63454ac07671", "comment": "Malware payload", "value": "004435bbb8384dd51b6d18fdd883c101", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219659, "uuid": "bd649a63-5f63-47de-95bc-fe005d82149a", "comment": "Malware payload", "value": "47eab3c8f2aae7d002abc1ab92c2773ac0932c0350e512cfd037752b45e48f01", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219659, "uuid": "10291951-e900-4392-a50e-45fed3f38c55", "comment": "Malware payload", "value": "2def852206868958c0ebc74a281ac3b6db19ec50", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219659, "uuid": "701b4810-b380-47e8-8c30-0310b5719d59", "comment": "Malware payload", "value": "c38fed03b46856a708e68177b323a868299424f776f8b9189bc2add968adc2a6eb6622c297b8e149dc8f755bfb805942", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219659, "uuid": "a823f22c-8f0a-4260-b2df-b94e501c8106", "value": "BE8312D79D8B12A8702DECB9C4772C940A19CDB3D246222A265636771446F7FA700CFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219659, "uuid": "5f38ed9e-9ae2-4360-87d3-74ebef6e2698", "value": "1536:fAS5f5E/5fEnaj1ZQUcDpTe87VqINbtezgVRxr9AiUrQTKXs8FI+bw:fASvE/Ztj1ZQUcDJe8JqmdIrLjFRbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219659, "uuid": "27cad39f-3095-4bee-bd37-5e7779741ea2", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219659, "uuid": "029f9cd4-47b4-485e-91a9-dfec9425720c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219659, "uuid": "f1d0c653-f591-4b6d-a69c-0b8823984106", "value": "catalog-265639781.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e178b70d-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218048, "uuid": "36995eab-1239-44be-8fbc-d0698e77fac2", "comment": "Malware payload", "value": "7e9d413cd9e8795fbab2a1f9df8cf746", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218048, "uuid": "b44eb9ee-9a27-4806-9ce7-e0f4314d2ade", "comment": "Malware payload", "value": "47fa5f9ca155346b755e5d94266fe0a37627cada73924c6bf254f04570dabf79", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218048, "uuid": "9353b674-2e1e-4545-8654-c2bd8695158a", "comment": "Malware payload", "value": "0f8017b5c36b158726d64ab54b0c307b8b02ee32", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218048, "uuid": "ddf1568c-aedb-4c0c-a245-75bbc796c578", "comment": "Malware payload", "value": "8cb46988bdead73df9ec7c0d2b7b9045f0abc944125010fdf94c1925703deb2132932b12db69538d12d07f5a4d6e83ee", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218048, "uuid": "8a4468b5-54ac-4db0-8d08-078403e5f974", "value": "B2830227FB8735A68046EAF29B333B196A4239D9745435A68FBC0380F63614F1DAC1D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218048, "uuid": "54ba9ec5-f52b-4cba-a724-15c1258f3fe5", "value": "1536:hHmy0pi0wOQMF4gCQZiwotTCWBxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZiZtT:Iy0pgOQMFEvtTCWjJ9a03fjwe1moYpoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218048, "uuid": "42122f54-a38d-42ca-add6-3f3edbf395cf", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218048, "uuid": "5dd3cf41-cd23-470b-a32b-e90735a81152", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218048, "uuid": "85a320ec-268a-4088-8e79-69285b8a3ea8", "value": "catalog-1315954027.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbae33f0-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222333, "uuid": "83275316-e9b7-482e-b0ee-7fc3687d9a71", "comment": "Malware payload", "value": "50d8ac4a8b3b541a190531cac9ae936d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222333, "uuid": "dea0be3d-8e49-4e3d-8f14-8bb7e050e8f4", "comment": "Malware payload", "value": "480a9010e61a5d0da89799bf145b8600935e6c4ab069875d848ac8880a87e13b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222333, "uuid": "ad6edba6-de81-46a1-ac0b-f52d5e98d9cb", "comment": "Malware payload", "value": "8f3f651605a9a774c1c3718b97efbbcc05663aab", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222333, "uuid": "0f1b8380-182a-41af-bc7e-b531584cd6b7", "comment": "Malware payload", "value": "e64879aeb314e93e8306d711119e3f1c2e2a1ed6ce90eb0a83744ed905cc825fe87b66c753da1bf941eb722f0e4290d4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222333, "uuid": "0e5a83fc-ea69-4959-8898-4d67540fe11e", "value": "0A83124D2C55E29EDB5879A217EC31A86F942333B7F502EACC5E72227513E36F1041A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222333, "uuid": "a2404f5c-6a53-436a-bb33-7d7468d771ba", "value": "1536:JwJNfD6jITxi78nLkb/Yw3LCq1GeOalTJkv9c/EWd8E//nfYRq1o+VCQHeWnsUWf:JwzOEli8ne/L3LCq40VJklMdT//gRL+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222333, "uuid": "0b2741c4-54fc-4aa1-879e-2e4d38e3e37c", "value": 86790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222333, "uuid": "edc6edd8-3a90-4d69-bcea-613fe82b9249", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222333, "uuid": "396d4b54-ef0f-434e-b607-e0ea4beb0e90", "value": "info-3271675.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eff8d90-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219601, "uuid": "fa25f53c-abfe-40f9-aa30-2f427760e4af", "comment": "Malware payload", "value": "f8d26e7d3926e9a445dddbd7871144c5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219601, "uuid": "d564b9a1-931c-436d-99de-fec635951314", "comment": "Malware payload", "value": "48423e087c969799fa5efa33719e756a192dc2e1ddbc6b1fc84ab49fd57e30de", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219601, "uuid": "95f6c0d8-b754-45bd-a767-838401b6c0a1", "comment": "Malware payload", "value": "46653817ceeb1f4ebc02402e953a2867c4dc68e1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219601, "uuid": "6800f847-2d99-46bf-82e6-2239975247b8", "comment": "Malware payload", "value": "81e53901d7bb8ceda5dd100e2db571705204708c505a16f528abeff204423b2dde2c8045b56bfa722af7c3007e81e156", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219601, "uuid": "0e6bce0c-cbd6-444c-91ee-0e4d0f98df1b", "value": "F1830127FAC725A28046E9F35B323B292A4379D9745435968FBC0380FA3615F2DAC1D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219601, "uuid": "2f13fed9-0ff2-4fee-869b-8ec6211ca01c", "value": "1536:Cqmy0pi0wOQMP4gCQZiwotTCWxxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZiZti:oy0pgOQMPEvtTCWzJ9a03fjwe1moYpoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219601, "uuid": "8ecfef92-c67e-4a77-b563-9567b09b36d2", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219601, "uuid": "f4e50fe3-4fc1-4b5e-a445-8ba149f28f93", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219601, "uuid": "99ad2cd3-06ea-4d6b-8275-12d66dc2e7fa", "value": "catalog-230872258.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44fa99f7-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220792, "uuid": "116d39c0-ed15-4473-9b3f-4895fd24e2e1", "comment": "Malware payload", "value": "a6428edd8079922e48681c81fda57c3f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220792, "uuid": "275aefc3-c200-4db6-87d8-b0f1cbb200b6", "comment": "Malware payload", "value": "484cf5ae46f7c8ee4f2bf65795e3fb39973856975d087811d256795fef0f97f6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220792, "uuid": "6666fcac-b0df-4c61-a4cc-b7b51685d7e8", "comment": "Malware payload", "value": "da39e3092db62227ebe71595f3756a88f0cb66c0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220792, "uuid": "320eb433-f9ba-4323-b4bf-09ad85182efd", "comment": "Malware payload", "value": "117b3f603dadfe193273e7e6d7b415a85f3d67bb572daf4043b8400ffc3dfba2ccbcb186fb1cdd9f00111da4c0d268f7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220792, "uuid": "fdb594ff-3ba3-44f1-9ef2-b9a87048d021", "value": "FA83124D35EDC040E17F7D6053AAAD5901F86F4BEFFF9164CA6961329901863FA0368E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220792, "uuid": "8fde0575-c941-4846-9157-5e5ed93d33f1", "value": "1536:wwJNfD6jITxi7UnLkb/Yw3LCq1GeOuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzb1:wwzOEliUne/L3LCq4kO6xoKDShicdBMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220792, "uuid": "55130a09-6a3d-4a9c-8204-86aa768cb231", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220792, "uuid": "605c52a8-0749-42a0-8afb-657f3caecacd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220792, "uuid": "9823bfc8-a9a0-4933-9cda-b0282684ac17", "value": "info-1379478665.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c90191-a434-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1619183004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619183004, "uuid": "e2e0dc4d-cd96-453f-8555-4bf1d1e5b93b", "comment": "Malware payload (SnakeKeylogger)", "value": "bff264dde5be95e457c699624f465503", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619183004, "uuid": "8c6606aa-2a61-4a8b-9144-32e0e2d6401d", "comment": "Malware payload (SnakeKeylogger)", "value": "48675602916308789190795356ca5247cfde0416f4805ed078db5bb431c1d30a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619183004, "uuid": "83ac048a-5607-4637-a2b8-a343363ab1f5", "comment": "Malware payload (SnakeKeylogger)", "value": "00b867658a271a22de74fa14398b537d21e4773a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619183004, "uuid": "23d7499b-2fdc-4fe9-9683-5a87aae22fc7", "comment": "Malware payload (SnakeKeylogger)", "value": "f43b99cabf9e1004eac62f3f10f207a0b039d978a9a54859f61cd91410bcf08b663335278596dbf085b487bfaadc62fb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619183004, "uuid": "b3163520-bf3e-4cef-957a-ff0f2b4c3a7f", "value": "5EE423805BFE4A2592E6B4500C952C9E1EFE0339354C7DCB28962CF26C5E37657B16E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619183004, "uuid": "4229e83a-66d6-4db3-a72b-da72460f2f1d", "value": "12288:s08i0yK99PLLMfcGNc5NSIGKuRSZAZ4B8/t9Ci9O0vrWn8n:su0yK9NLL+cwszuRcAGun9fvUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619183004, "uuid": "e0976662-7174-4c82-b471-cf24e1223449", "value": 659686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619183004, "uuid": "f7e3f370-eb23-4e75-98a3-473cc60d9ed0", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619183004, "uuid": "aa58d993-6027-4c7e-bb46-673ee48c3a45", "value": "_Bank Details.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc607883-a42b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619179358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619179358, "uuid": "6749f573-0946-4d86-83b5-35cabefb2fe7", "comment": "Malware payload", "value": "551fc4e6c0a593d0b04b055531d1fc4e", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619179358, "uuid": "d31f50cf-188b-4a81-bb20-730c3973d930", "comment": "Malware payload", "value": "487530baaf1fbdfbe1c80a8933b96b7ad6d435e2c9d3d640ecce2993edf2dc93", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619179358, "uuid": "f501b264-b27a-4496-a977-4e9c257df4ea", "comment": "Malware payload", "value": "552b313e11386a566a8ab84d5bbda683791be897", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619179358, "uuid": "20abc720-0b72-4a51-8ca5-2e0e1e62e8fe", "comment": "Malware payload", "value": "fc4e3620353121ebcf9c155599f8da9647854422a23742709a5c659a26b365c2c392f34ab95332cdbfd1deac595dce93", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619179358, "uuid": "cebecefd-cc8e-4d4c-96f1-df44b6fd5429", "value": "C9328DF4CC9671A3838EE4F4954E2A6598017CBD6BE78DF51CCDF6843B479928B428D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619179358, "uuid": "a1304edc-413e-4c25-9fed-83aaea6089d6", "value": "192:ZA7NPUtj4wXKOt1h7zqqZTLDt/UYjvE2odsrLu7a56oXTMWDJW54AWF1htMy+:ZMNwcwjdzqkTLRDA2xuQ6WDECrFbtMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619179358, "uuid": "8ef36d8f-22ab-423a-8a8c-15661493fc62", "value": 11356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619179358, "uuid": "643c01a4-6e96-4094-b00a-a5884df9182a", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619179358, "uuid": "c729da3e-047b-4011-bd68-3ce59d1beceb", "value": "551fc4e6c0a593d0b04b055531d1fc4e.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f850b3a7-a484-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217657, "uuid": "c8228068-87b7-455d-8aba-184f66cb3db3", "comment": "Malware payload", "value": "3aa777a29f8ba122a0048bc29bcf4593", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217657, "uuid": "0a23e4f2-e027-441c-b7ac-498bd3635676", "comment": "Malware payload", "value": "48db5a71ed1f91ece1824f816f106748184c03fa6e58806a0b60a6bc285bf39f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217657, "uuid": "e4006aed-151d-47b6-ae07-d42a2ba82402", "comment": "Malware payload", "value": "3c625d0e6eb2fdaf82efd00799ac2982179be79a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217657, "uuid": "cc087e24-2143-4451-bdd1-47e5630e8706", "comment": "Malware payload", "value": "ee49389379fe92a8f0cff093fa68a476c3f0b8956b8a7062302c01a50136faa86d207f7473fc175910dd538d88eadf8c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217657, "uuid": "a0e37af4-8d00-4754-95db-6a8c4acc0808", "value": "1C8302CFB8F5473E47322A77051D0E5A56E0352F05009B9D36EB35742B65A31E8AB38E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217657, "uuid": "1be4833b-8f01-44a2-a3d1-088ab9af445b", "value": "1536:AdKLWkP7EBmsbLlBRpNdZ2rQD2FPdoeVadrj7ZIXFWgKilkAq14HE6M5XL2l92Vr:UKLWSibL5pwQK3U9j7+XFWtYe14hbOjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217657, "uuid": "3fb16d04-bb43-4053-87f8-1d5b738294c7", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217657, "uuid": "2502a7c1-05ff-4531-8fe7-3f26182ea59e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217657, "uuid": "0ae720e1-4827-439e-a229-21d24fc8f7ab", "value": "catalog-1089064316.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7679c151-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218298, "uuid": "e1d17cbf-7f4c-4f9e-b77e-a5218226813a", "comment": "Malware payload", "value": "26a4f1d16a0d13cb8287d7a7ef5fb0a2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218298, "uuid": "72baa51b-5e8d-42a8-af7d-ece1665d6f28", "comment": "Malware payload", "value": "4907d9e439bfc84e71c31f14a4a30548af60af3cd1ec7407bbddc4d07a75c70e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218298, "uuid": "10582e28-7cdd-4565-9096-fd2c28624eb4", "comment": "Malware payload", "value": "9049b142ed934a99abc95564a38f0e2141d56cd7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218298, "uuid": "4901438a-8de1-494b-92ac-bdf53da9759f", "comment": "Malware payload", "value": "3035d471cd87e71c88fb01b50689ecb816bda8004c47e90c79bd1bfab631c269c34dad3c974e2770a71c17abfdde89b5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218298, "uuid": "964ca320-c573-468e-91bd-c3ad061d0f4c", "value": "87831277DE8BA14EC402723013782FE74B6C6B729961150A1770747B2B2F9794CC6AE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218298, "uuid": "720f246b-5956-4389-9745-727839924b43", "value": "1536:huRWAXdZ2rQD2aCv0yWxaqQ6Rxt5AB/aqPwL3VbCbM:hg2QKDm/Qwt+awaxCbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218298, "uuid": "bcdf3350-2d88-4438-8bed-835c0848901e", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218298, "uuid": "f9f8d975-7017-4464-aeb4-b56479bfa57c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218298, "uuid": "7373ba37-eddf-4c64-89c7-e43d66693b9c", "value": "catalog-1432448215.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50292809-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217804, "uuid": "44b9a214-d22f-4f2b-ae68-fe6a232228fd", "comment": "Malware payload", "value": "5312021d8fb9e0eafb883fcb9b3dfbb2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217804, "uuid": "94d1bc77-1c83-42a1-a174-a8d48ce70a14", "comment": "Malware payload", "value": "492c77999eceba5c8fb0d0e582cf18be1f79fd6c84f23cb3e44ba7fe6e48cf4f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217804, "uuid": "f970ed88-fd7b-44e3-a4f4-499739062951", "comment": "Malware payload", "value": "0afd3b5b8b178b4d2b962fd4a30e7c1e0fd3be6e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217804, "uuid": "1f24fc57-602c-446f-999c-cf3230fa8355", "comment": "Malware payload", "value": "604d5edca1d2ef5932067b16438bdf034ae5e6c89163b6ff3657758981846204129aabb5b47f91f312807e6cd70b7ae2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217804, "uuid": "b2da41ca-9ec9-4434-9d27-6517e0b37dc3", "value": "21831232EA9F1484D404E2625AF17BE51F34CBF28136410BAFB4B43EAD1B59F0488ED2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217804, "uuid": "2c757656-f615-451d-a43c-c2e8ac5690ac", "value": "1536:M2Lsy0pi0wOQYUtcDYflF4yWxaqQ6Rxt5AB/adPwL3VbCbL:Ay0pgOQYqtm/Qwt+aZaxCbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217804, "uuid": "8a3b3ea8-0416-49f1-8ae3-7076308646d5", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217804, "uuid": "6551392f-86f6-408c-a144-f70403c110ef", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217804, "uuid": "4c63a27b-3592-459c-bb5a-77b245e61dad", "value": "catalog-1177137293.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9df2ccfe-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220082, "uuid": "69553bae-611f-430b-a576-ca94ae822cb3", "comment": "Malware payload", "value": "b424bb226f5611dec8f2b0fc3a8b1189", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220082, "uuid": "bf0f7166-e35e-436f-a1ef-b2bc5632cd90", "comment": "Malware payload", "value": "493fef5749faa3b7b4f029f80077c5decc306ccaf13d08850a508ab139874a6a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220082, "uuid": "fb243bb0-e109-491d-b17c-58e6779c8d3e", "comment": "Malware payload", "value": "7040f27e4485e2b20e4dbc308636e5db601153dd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220082, "uuid": "f4bf679f-4a9a-4a0c-9ba3-b5f23c74e7e9", "comment": "Malware payload", "value": "325a3a7d9aea099a45d64dfa214fa383efcb00744b1468a15103cc162192daf938907143858e3dd5b1684e085adbb7dc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220082, "uuid": "deed3e3c-2e2d-45e3-810c-ed9e225c7a7e", "value": "C3830277DE87624EC102723013782FE64B2C6B725A61150A1770747F2B6B9698CC6FE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220082, "uuid": "7194c682-040e-4a9f-9c3f-ffe221957d91", "value": "1536:0uxWAXdZ2rQD2aCvdyWxaqQ6Rxt5AB/aqPwL3VbCbj:0A2QKmm/Qwt+awaxCbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220082, "uuid": "f5550c8b-40cf-463c-b01a-eb62e57fc6ae", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220082, "uuid": "c8be94e9-548b-4746-8d7e-7d63d7f427ee", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220082, "uuid": "cb6a5e0b-c062-4496-89b4-a6a5e096a17d", "value": "catalog-507458110.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf87245-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222228, "uuid": "ff046234-064a-4d80-9517-7d24e3e75364", "comment": "Malware payload", "value": "4072b15b89fc33271480d6e39932df61", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222228, "uuid": "04eb786c-c0fd-420a-9234-3ea11534efa1", "comment": "Malware payload", "value": "4940a118e191d350415887950d06bec4c7747accce6beb3a2c04ca701d5e1e38", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222228, "uuid": "50e19ad0-5d19-4274-96b7-a1b5537a9114", "comment": "Malware payload", "value": "5a286b5026976f6cda98edf94500eddf54ed1883", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222228, "uuid": "1b939298-25d1-46a9-a480-9d3047863295", "comment": "Malware payload", "value": "cdbc85c72cbca33279b9618bff23cc4eb15a77f03b44e81531515234a7f1d2191707ff74af8a347054afd83c36202ec7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222228, "uuid": "7e2aec43-8e52-4e22-ae1c-159c5030b254", "value": "66830277369DC6FED14EB05E605FF1BDF054A91E9E2EE624A7B428103837429A410A7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222228, "uuid": "f9f90680-0bbf-4e60-880a-72ca5d8b1a69", "value": "1536:OzwJNfD6jITxi7z9ZvjL3+xnxv5ZUSzhhcBrasoi8vQMwdjV46CTV:OzwzOEliRZP3+9xv/UGDmrajvIM6CTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222228, "uuid": "a64ccf9d-3c4e-4f77-a326-c7e21a8407e0", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222228, "uuid": "94590146-5d02-4a06-8552-dfc5280a9ed5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222228, "uuid": "6285c1e4-cab5-4bd1-b65e-dfcde9ac540f", "value": "info-270238287.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc01495-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221750, "uuid": "35110d81-b644-4298-b36c-292920225fa3", "comment": "Malware payload", "value": "35ac754ef0afdb8e636b3c7d36fd39a3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221750, "uuid": "6155375a-cebf-4603-9a08-3cf77ef806bf", "comment": "Malware payload", "value": "495afc0fe86a230443705e72641d71db03bf5d59f56600ead8c28ca869671cd3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221750, "uuid": "21b4f48f-5159-4fc9-a8d8-edc67190149f", "comment": "Malware payload", "value": "5271da11ce3f9adf9818542baaba433051cfe8b6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221750, "uuid": "361df95c-08f5-4db5-9f41-5677a96c9512", "comment": "Malware payload", "value": "001626c27e7dd30060bfb3387656e56269ac6a413182bbfe9f9f6591f63eadea8c71483e2adf55e16810fb3aa00d3a88", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221750, "uuid": "487aee75-e683-433c-9bea-9f4dd92ddc74", "value": "4783124D35EDC041E17F7D6053AAAD5901B86F4BEFFB9164CA6D61329801863EA0368F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221750, "uuid": "e41cf14b-f248-480b-89ab-b04bc63500b1", "value": "1536:5wJNfD6jITxi7UnLkb/Yw3LCq1GeOuFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzb1:5wzOEliUne/L3LCq4kO6xoKDShicdBMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221750, "uuid": "a09f51e0-0e60-45bc-ae03-45522fbce685", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221750, "uuid": "1ad59249-a7ec-43ee-a5eb-a813c0f98818", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221750, "uuid": "ecadf700-4461-40d6-9634-1a288b834598", "value": "info-1855421894.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a7a76d-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219505, "uuid": "c0d4fd6f-c434-4cda-8fb5-c45569fecc48", "comment": "Malware payload", "value": "66f58c881a59e578593d6d0dbcd71a0a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219505, "uuid": "b7792ce5-45e7-43e7-ac86-a6934330df93", "comment": "Malware payload", "value": "49a3d3899e0f2fe2ea6d90dd2ff3ba80715ebe1f930eaf3a27acb9e595defd71", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219505, "uuid": "7aaaa718-206d-48a4-9de8-542e4811826b", "comment": "Malware payload", "value": "a2cf2c2c603d6df9f30b5b2e3303314a3ae23373", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219505, "uuid": "201ac72a-546c-4b7a-a20e-2070183b6f64", "comment": "Malware payload", "value": "45efe1e632990dcf9a57e719337c08385d0591983fea1de5b4a4bc3f8b87427d69b2910f56e623385fc31e8df92b5ae8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219505, "uuid": "6adbde75-7a3d-4267-9005-f94922bc61bd", "value": "418312EBCFEA59984202BF0673069DBBB454280C6118BA7A7EDD11502F524E0F4B7DED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219505, "uuid": "5f56cb0a-d478-48cf-81d2-0ef4cc3a96f7", "value": "1536:P1KLWkP7EBmnbRARpNdZ2rQD2FPdo1f+5ff9fuQjMCYNst+IHClPLqkwD0DCuAD3:dKLWSFbkpwQKW25NfuQjMCYNBwltD0Ds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219505, "uuid": "eebf9750-bba2-4e87-abaa-38d5384b6b27", "value": 86936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219505, "uuid": "f229646a-4c98-4857-a8f0-6a8747edf3df", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219505, "uuid": "d2d4cb3f-045f-4c61-bc37-8aa41d81d22a", "value": "catalog-2122747732.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af2b259-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221768, "uuid": "723debf4-225a-4ec0-b0a6-818924553363", "comment": "Malware payload", "value": "a80ae00c556717abedc5cbe888233eac", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221768, "uuid": "f55b5748-7446-4c92-9684-279f253d994e", "comment": "Malware payload", "value": "49aa342c436e9a7b8c7f8cbb5727d2367e69f301c30b76c6ecf2469501ee6e47", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221768, "uuid": "8b04801f-3914-4faa-974f-c79a60ff79bb", "comment": "Malware payload", "value": "8a72d4b02786936e75a3af723983de13ce53ba76", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221768, "uuid": "900b0e46-e90d-4fbf-b1c8-5e55e04bc069", "comment": "Malware payload", "value": "64284a84b7b385f82f2694a56a488215bcdef96a36c7288b80d3509d9ce976f6e960383705fd28c803e621e212d0a93d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221768, "uuid": "f0224717-b68c-4cf9-863c-8f07484cd298", "value": "9E830277F0B6A96E829CD0B1A01E3A1839F875C3E435978EFD1D3A17C426DCDA91181E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221768, "uuid": "7539c418-c6ce-4572-945b-6c128d8d472a", "value": "1536:xJs4DkjRjDC+ramyNIPjLxx7mgV3e27JWgtrQZcUT7oqlaHvvbFq9GHocnoe1RqG:DLoNfPrG+vxxSCxIGUT7o/v096oiBkwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221768, "uuid": "2b39667c-2545-42cc-85f9-07ecc082e9bc", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221768, "uuid": "b3247de0-60de-4093-a74f-cbae317dad62", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221768, "uuid": "387f491c-b780-4eca-af69-be0eba41ec76", "value": "info-1869010837.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da23dfd0-a3f2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1619154900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619154900, "uuid": "21666571-cdb6-411c-8536-2139e8d17757", "comment": "Malware payload (Formbook)", "value": "9ed245f09ec458c56b6caffe499b15de", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619154900, "uuid": "b219cd66-a8df-4fe1-8790-1537f9bb1d7e", "comment": "Malware payload (Formbook)", "value": "49bff41afa4a8b3c72319b925e3a4d0bee986be36fc7c705ed76919ea6b459c1", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619154900, "uuid": "46572b9d-78f9-4dd6-a7a3-a5b46d48c538", "comment": "Malware payload (Formbook)", "value": "070f6020e4de4639c190944e6798a079731cd877", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619154900, "uuid": "b4111ffa-b1be-4ba2-9b93-4b64bb9afd8e", "comment": "Malware payload (Formbook)", "value": "53eca226fbe344ba3b2a7726ed4f811c96a46caac4178fa4d302ebe633763cfb669dcb2b8b87e2d8e6731b7111ae907e", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619154900, "uuid": "333e0bd2-bff2-4703-9a92-aa90e378cd01", "value": "030523F1B7D4BDB3274D08AA9473E5D40F92EE8E162CCFD4D21D9CC9C6A896626D1220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619154900, "uuid": "c9350fec-74ff-4323-8c2c-1436f0a290e7", "value": "12288:XPKBkokRc/S2zGYoye5uLl2nreF+LFcpDctxKbhUsVly69WEdEXmSgCU0jC9zY+Q:XC2okqZwk6eFQFcrZpz0mZhQmHuB7kU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619154900, "uuid": "a14f9a7f-3ee2-4e8a-9e8f-58d49870b51f", "value": 829091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619154900, "uuid": "d0b9ffdc-daa0-4d70-9464-919d4d16b600", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619154900, "uuid": "a0a2b67f-6f85-4204-aea8-67f7f9e5d909", "value": "Payment advice pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92dafea8-a456-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619197730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619197730, "uuid": "2812aa41-59a3-4ec1-9f63-7a359d9c970a", "comment": "Malware payload", "value": "effeb6845cee0ab05c452d39f9e5382d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619197730, "uuid": "91492db5-50fd-4f21-b193-9ef8d51245f4", "comment": "Malware payload", "value": "49d33c7ef12c00bf7fc4dbb31f719146884f1120433df4f4b3b7ff2009400cf0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619197730, "uuid": "bcd778d4-1c6f-4ae1-9f75-000c7fe3ff2b", "comment": "Malware payload", "value": "c1429226815b526f185388c49c7cbeb9e115d5e8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619197730, "uuid": "5b8d7b63-ec74-4560-9930-fba4f8ee2547", "comment": "Malware payload", "value": "e31249580d6693ba0b4c30eb8952407fd1c0afc563ab401bb3afa49e47e1c71fb52abcc9657f11f44068a85c0131df94", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619197730, "uuid": "8d09f796-b609-46bf-b2ac-c0dd243f2d10", "value": "99B39CCCCD53A4CAC224DF7D8916318144B4C47B322FF51A65DE822F8E12FA9594E7AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619197730, "uuid": "91cf7e34-1b6a-40ee-a45e-9aff61fb0bfd", "value": "3072:Kxol0GwXQQteyZJAW++4vIDJN6ySc7DVTl/R3:K+l0GCRgeUwCyV7DVTl53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619197730, "uuid": "5a0cbde4-ea26-401e-a489-cc85e42ea223", "value": 112134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619197730, "uuid": "4adde6eb-db4b-4dc3-875c-73d88fcb8e46", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619197730, "uuid": "ad48c6a9-7e43-42b1-ac95-926f3126830b", "value": "info-33549970.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbbedf63-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220186, "uuid": "47869182-6d0c-4571-b674-37eadca807a1", "comment": "Malware payload", "value": "e0184f2cd87b85fa37f0ee0231f54b37", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220186, "uuid": "f4b7dc75-94e4-4eb8-813b-2816840548b7", "comment": "Malware payload", "value": "49dd339c24e3a3973ec665d28e0bcb0f9890e402f02e3e2e71610a608c4112db", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220186, "uuid": "b642e852-4d26-445c-a431-368b616163ed", "comment": "Malware payload", "value": "3655c9ac88ff8c8c381df24c88efbe653bd86076", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220186, "uuid": "ebb1e3f4-d4fb-4aa3-bd02-f1df7fc05c49", "comment": "Malware payload", "value": "db7ddf608610ea032e93b5314bf17ca20e8c9a368869d00b7ff14af9dc7130264acb88eac1c61e4f16f8064711787dbd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220186, "uuid": "1c81c8f0-1069-4357-8163-a06cd24f1867", "value": "088302B7322D0BEF800AB49B80DFF5F9F156A93E5D1EE510B3642D60353153EA411AAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220186, "uuid": "b6732e37-4daf-4454-92e2-3a042cdf3a07", "value": "1536:DQBAV8QI/AATZvjL3+xnxv5ZUSzhhcBrasoi8vQMwdjV46CTz:Z8QI4AZP3+9xv/UGDmrajvIM6CTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220186, "uuid": "c47f16d8-d278-447f-a376-4e7c7f8f7ecf", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220186, "uuid": "9df957dc-140b-4e7f-a597-7ae732c2f56f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220186, "uuid": "d4f166bd-f962-4d41-aa00-4da954d0e897", "value": "info-1001161477.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d01a3dd-a3fd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619159307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619159307, "uuid": "151ff125-100c-4cdd-a108-d6aa9acba4c8", "comment": "Malware payload (AgentTesla)", "value": "1cfe9f26db38b2507e4c27cad400ad6c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619159307, "uuid": "d969479c-78fa-46d2-9751-49bd210b2518", "comment": "Malware payload (AgentTesla)", "value": "4a11d85dec6ca99730c67c909898c5a057921b3befb7edee95836bcf0c09dbe5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619159307, "uuid": "35c08b0a-eb2e-41ea-b033-14870381da50", "comment": "Malware payload (AgentTesla)", "value": "335ff79faba937e0500872930232bf853e0498ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619159307, "uuid": "8a2d8a76-6673-40a0-ac1a-e32f61f7a47e", "comment": "Malware payload (AgentTesla)", "value": "af250bd15a832d0d7b554bc10396f7e91ac112c9691f5b8971dff1ed234521a0c1b83e7d37ca8ecd29e9a1bc4589926d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619159307, "uuid": "b98a19ba-f513-419e-9c69-8d2480043e91", "value": "C7A23B21FB899957E029357311621E0813F7A4EE2B02E75BEFCCD6A318139DB5E68B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619159307, "uuid": "21de4f43-77ef-4941-9854-a5649a5c8652", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619159307, "uuid": "54300ee1-3db7-478b-a3a6-bfc87a23cf53", "value": "384:lxQ0GGBHLEywHxQ0NYlRxQuHxY21QLwfH1LABVj2Jlf+:rpQHWhXHxn1hf1L+ylW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619159307, "uuid": "fb6146a0-7a35-422a-bad1-ec183a0ddc64", "value": 21504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619159307, "uuid": "0aef8c06-5189-476f-9a39-42abce58b42b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619159307, "uuid": "5e6e3116-ca97-4b14-845c-a160466529c7", "value": "1cfe9f26db38b2507e4c27cad400ad6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57fdaa98-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219106, "uuid": "938ba358-570b-405e-9d69-2a4fdc094949", "comment": "Malware payload", "value": "6995316fa4fa6b119492ee182a25ade8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219106, "uuid": "8560ea90-f8eb-4cff-9453-d13ea5f7a08b", "comment": "Malware payload", "value": "4a1c2cb8316492127bdaddc224578d8eb23292f55ecd4d56c73c87946f0cb5c7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219106, "uuid": "b050f25d-f473-4b8b-b0fc-0266b6fd2a54", "comment": "Malware payload", "value": "6ad40de5b2e32b350cbf1d0df2248297fa36881a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219106, "uuid": "820a74fd-b9f5-4db9-b23b-3b075251e213", "comment": "Malware payload", "value": "8bfbd918fbd6f19236b17a8a00cefbf29cfdbb95eac0ee325bee833168e6554153d260613c68392d5df64c44460751c1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219106, "uuid": "93e6f3d8-16e4-4fc0-9f4e-be01235bfbe1", "value": "9283028BB4D84339CB3523F658AE5E4426B1A47F040CC7DC65D73B786B53672A472388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219106, "uuid": "254be3b6-df36-4607-9c7c-9874263119d5", "value": "1536:fEwAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvJ:fHijtuPmU9j7+XFWtYe14hbOjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219106, "uuid": "93a5661d-11d2-4439-a14c-d8c8c3fce558", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219106, "uuid": "507593a8-0ac1-4c94-b39a-1a53166089c8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219106, "uuid": "1beb5c78-6a2b-4d39-b212-674e21886039", "value": "catalog-1894517973.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a1828d7-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218680, "uuid": "b86cc043-b318-493c-9f83-fc91434b9c9d", "comment": "Malware payload", "value": "abfebc4a6947559b37dbb077767aba37", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218680, "uuid": "963d3af7-22d0-420d-acb0-109a5c5faef1", "comment": "Malware payload", "value": "4a2a613ec2bd2de7c8cce13e18cbb588877627a259e7f523cbe1a14821dc6f16", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218680, "uuid": "7a203af6-b114-408a-9c3e-e413a0c051f1", "comment": "Malware payload", "value": "4fbcaca39a0d43e9372884ae007247a6259de9e2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218680, "uuid": "c5e6c1d5-e958-4951-8da6-fed4456e74ab", "comment": "Malware payload", "value": "4967b8aeebb600d9786cb2628a8861f91266d8198f22e7e2b9ed9f5c76e4dfa459299de3ef389bf2b80f3ef13fae0eaa", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218680, "uuid": "626468fb-bcc3-4cbb-b1e5-e0ee18c2c69c", "value": "158302EC70238A76637345A6DD7E90C32B6B8BBC441DB056A82A79364A307FFE121535", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218680, "uuid": "a412aefd-b182-4bf7-879c-0677dc614c5c", "value": "1536:pzKTWDE4Qgl8LS4v50FC+p7UjoB8+wXdpUna5ahL2dmTLUVVvs:peKDPKLRvaFjp7uXinakEmEV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218680, "uuid": "11de40fb-18c8-4a90-982f-1b1228942b3e", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218680, "uuid": "308c30c4-4a18-445b-8f86-2b9eb021fcbd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218680, "uuid": "e9ccdd8d-e0b6-49b2-a74e-54c692194993", "value": "catalog-1665578616.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6131be73-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221269, "uuid": "9f5bad35-5175-4250-bdaf-20dc6840ac00", "comment": "Malware payload", "value": "427d3ada03f6bd6161bbb4b56f2a5b59", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221269, "uuid": "afee29b2-a88f-40bf-96d6-23af70c84032", "comment": "Malware payload", "value": "4a4256c2624386352b8a4fc11e50ee869827f426a5aebea3375e5b92e55622a4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221269, "uuid": "e99bf7ed-5fad-4659-80bc-2171659c1a12", "comment": "Malware payload", "value": "50c0457f03d41722fee8d658ee210aa42c7a2d8c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221269, "uuid": "3be09d2b-400b-449d-a249-40be6ecdbb55", "comment": "Malware payload", "value": "42890c0fdb4f68b099b5d379e1eb53d8cee368ee82092c3ac4facff929bda205801d36e4d048f1ef963b906854aa2bc4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221269, "uuid": "116a08f8-7cf7-458d-b7c3-8d3e184b809c", "value": "0683121AA9AD2CD9C06B13F00D7248494860EF6D411C8459F11AFA8F78AEE55CEB7EE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221269, "uuid": "7d639486-7d06-45b8-b4d7-1d3e2c5782a8", "value": "1536:b1QVGeGig5dwSp6yMvBjqq1PGLuhCWdHsh1oSFWsfEFhHqLWH:JAG7i8l3MvBjqqdOsZdHAO5hKM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221269, "uuid": "92a94245-6874-4aeb-8e4e-af4d4b6aff1e", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221269, "uuid": "3798bc1a-247b-48ab-9de5-2065cc5e9e2d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221269, "uuid": "b5f69382-ccad-4a8d-ad21-c55ea82b066d", "value": "info-1584549908.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7194821-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219292, "uuid": "1cc1c50c-a58d-4159-ba3e-82c5215b7bd8", "comment": "Malware payload", "value": "704e1cb3fa3aee6cf559aa60a19c29ab", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219292, "uuid": "10326c75-ee8c-4f6f-8741-5d34caeeca14", "comment": "Malware payload", "value": "4a461e4958b4709356abcde3ad282aefeb4fdeafadbb3c69c0304945895352dd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219292, "uuid": "7ce103d9-00b7-4cfb-b0a8-db0974e110f5", "comment": "Malware payload", "value": "5dae6f3929a4b9713a216925f806b356b9678060", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219292, "uuid": "b6052858-f9f0-4ae6-a72d-a981949bb14b", "comment": "Malware payload", "value": "135d7664a8db32b03912e24253ead43b9e832e6ed815b4407670a0e58271e460b29f61f7c5f52440e65c9658f620ee7f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219292, "uuid": "a7fa40e6-35d2-4092-968f-43daad7d2bad", "value": "09830232FCBA2BCC5C1DD820D0256DF4096FCDAA959333B859682D32208D67D6B419EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219292, "uuid": "455b3111-f034-4c02-8b77-d3f74d91069a", "value": "1536:Og2sNyMfHfrqQaiwotTqFUAAWB9Te87VqINbtezgVRxr9AiUrQTKXs8FI+bc:AM3XvtTqFpe8JqmdIrLjFRbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219292, "uuid": "f1594123-666a-44e9-ab7a-8eed9cb42bd3", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219292, "uuid": "71c723e1-01fc-4ca1-8a04-31bf9afbed12", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219292, "uuid": "3905d35a-d4bf-4e45-b1cf-189cd4120826", "value": "catalog-1989014156.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c42a8107-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221435, "uuid": "30762f19-9f48-4616-80aa-6490b405ab48", "comment": "Malware payload", "value": "e905d2e91da0de98d85200f231ece5b4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221435, "uuid": "3f48e0e1-5b9b-4a8b-994b-3ec01de5a921", "comment": "Malware payload", "value": "4a5131007a44a452cd81b5e4651a316b29d55c7672645c0f48ae54f097332bf5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221435, "uuid": "6cf00fc8-540d-4c5c-8b3c-c8120a6a9b01", "comment": "Malware payload", "value": "84b4d2dd99bb45dabe87cf06b11d19201dbab7c1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221435, "uuid": "cb9cbd91-7a94-4cb8-9f02-4e832fa76c73", "comment": "Malware payload", "value": "94650f6c2b7fdfa395fcde653c7bc567de8204ad5e6b4db7017a4a36d0f8f7bb6b916acdd866d7fea3368b1d16e2c668", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221435, "uuid": "0edac42f-63c3-44f5-8a7b-779a958449a6", "value": "18830215A1FC86A780E315A22A307AC68AC0E7975C5CC043F2349A27A4F6B79857BF5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221435, "uuid": "f086cbe6-26c9-44c3-a4be-a84e669826fd", "value": "1536:Jvt1QVGeGug5dwSp6yMvBjqqxM5Y2VXw1QFsrGq9ZMlmZQTQdEz:J7AG7u8l3MvBjqqqXw6Af5dEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221435, "uuid": "2554796d-7bcc-4007-9741-f6bb4fb4e85a", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221435, "uuid": "2b180853-9c48-4ce6-abeb-d24a3760244e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221435, "uuid": "851fd78a-0b24-43c1-b93d-206d6bef760c", "value": "info-1683967770.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf9e9b1e-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217991, "uuid": "81c1480f-def4-440a-8007-83e06a6358b6", "comment": "Malware payload", "value": "90e209a1bc4c0f713e7255dca8389b38", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217991, "uuid": "67d61bd2-0594-4b2d-b307-996bb811b737", "comment": "Malware payload", "value": "4a77bb16b99563a9115b157806a565428e13b69a43fee80f71b223a5aae4f927", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217991, "uuid": "dd5caf3a-3dab-43d6-a7ee-ec773cc42faf", "comment": "Malware payload", "value": "b68d4df78f467c2b179bc65eff1e25b660a61905", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217991, "uuid": "6e318c4e-ef2e-4159-9d70-5afc32d23666", "comment": "Malware payload", "value": "15b98256953f13a26e62f76b6fd039773d87b4362de8eb19b485c6c8642a077e2e1014fe8ff7caf973f560d55434c032", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217991, "uuid": "53ed0465-b35d-4a45-9af4-a6b74fdcab10", "value": "B1830258CB9F8D948005ED0ABB22F8ED75506248716973ABAFAD1124FF478D5B2328F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217991, "uuid": "d6980967-7cca-44e4-8b8f-40d326fd3258", "value": "1536:FA6P7EGmwH1zVQLQDYflSJXvoDMf+5ff9fuQjMCYNst+IHClPLqkwD0DCuADrnT:FAY31zVQnIJXaM25NfuQjMCYNBwltD0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217991, "uuid": "7668f4b0-39a7-4de4-8f4e-c51d124378f0", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217991, "uuid": "3762ad6b-3928-4e73-9de8-b636e2d986eb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217991, "uuid": "0d4671a8-553d-41a1-92e0-f65eff4b8118", "value": "catalog-127278833.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba13fd8a-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220559, "uuid": "1f9643bf-8da5-4ab4-903a-4632a89fc904", "comment": "Malware payload", "value": "7091b0c87210356eb90912c55fd50c4c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220559, "uuid": "fc461a93-7b54-4761-8db5-10df9702d5cf", "comment": "Malware payload", "value": "4a89e987e3d3e6df669ba3579390ee3bd9b06f2f95bf3fbf4230f541803be1c7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220559, "uuid": "eadd5188-89ba-4953-b2ac-7da7efc2e23c", "comment": "Malware payload", "value": "3476e9dad58f8379e9ded86ea9741c904f49c44c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220559, "uuid": "3d2baf56-5f4f-44e0-aa4c-4fdc9405f7af", "comment": "Malware payload", "value": "bc49e579c08c0c3383b7ef31223d2892a927458409b674c7b51588bcda3cde8ec36f5ee4dab3d31bf1208966df4e8a59", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220559, "uuid": "59071b3e-2b70-4679-bba5-7cb97624947e", "value": "338312A1A87CA15F638FDB77D0777747E88009E5512C1E9B534222393DB8DEF8827229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220559, "uuid": "42dd7c28-95be-4190-a7d5-ccbeb62811b3", "value": "1536:ftaLgbb9ZvjL3+xnxv5ZUS8CWb/bLCDxxp/ERd9QnGlRTH7qrelcK:fZ1ZP3+9xv/UHnfLMZERQnGnTHMeV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220559, "uuid": "3b18cf9d-cf0f-4c10-b2f7-daa830073575", "value": 86799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220559, "uuid": "85a46405-e82b-4358-a8b6-67dd3a3a52fe", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220559, "uuid": "f301c209-4beb-44bf-9c12-1411ad17e933", "value": "info-1242696221.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da29c900-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218895, "uuid": "6ccced99-8aa2-406c-a46a-908c034da0c9", "comment": "Malware payload", "value": "aac2dc44320e423e4c7ab7c91dcf276b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218895, "uuid": "50e3a17d-0192-4abb-9c98-f3bc6a2fd0ee", "comment": "Malware payload", "value": "4a9e745fb9d6a4f7fe18fd79d3b9ef7ba5b2ebdffdbf74de3ab5024cab1991ce", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218895, "uuid": "bc64f6cb-249e-4ef7-83b0-a59acb89b206", "comment": "Malware payload", "value": "4d11d8dfb8a794a14a8ad8934fc5530087106393", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218895, "uuid": "c85dade4-3a76-42eb-b7d3-2353488f804e", "comment": "Malware payload", "value": "e8f7eb9eb0894f9748f5d31bac3c7180afc4af4630445a75a40427e47f43819560a95678405b0cca9fb51754091da625", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218895, "uuid": "00a424d9-6f62-45f9-a5a9-32942403c115", "value": "168302176BCB71328046E7B14B353B09B653BEEE640C6056DBEE4778FB3205968AC1D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218895, "uuid": "8ffc0cea-19d3-470f-88e0-56fa5d9178d7", "value": "1536:oRn2hxVTZQ72ZTYzqcIxxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZiZtl:oR2hxVB6IzJ9a03fjwe1moYpop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218895, "uuid": "c33add4e-8a70-4c38-a184-7b6340e55f9c", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218895, "uuid": "c79cb426-ca0d-489f-9b0b-bcaf6782baff", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218895, "uuid": "6512c9d5-71fa-40c4-9dbe-0d4adb9e2e04", "value": "catalog-1771309639.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c0c2a8-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218725, "uuid": "dbe1dc45-5b21-4fe9-9287-867cefd0ca24", "comment": "Malware payload", "value": "0607cd668c65cb46fab91c787917277e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218725, "uuid": "41f6a3ed-ea91-4e68-a520-7db1c3834d49", "comment": "Malware payload", "value": "4ab4b0e6978e45f2aa78ddf38c0713e11de39f512b1dedb0943941aa16c73300", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218725, "uuid": "43a3fe15-1fe9-48b2-9330-876fd7b2671c", "comment": "Malware payload", "value": "e61657064c4df5323b687f8a41cd3989fa9a25ed", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218725, "uuid": "bc8be791-db6f-45bf-b2de-d1f18c5d0bc5", "comment": "Malware payload", "value": "d3f91e9c01fc43b9bf0b58109347dba1f54439ad571173f2cacc3db70dd084a1d52377ddc42fa3cc12958adf307137dd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218725, "uuid": "1a2436cc-583e-4cfe-b85e-579f6d05fd73", "value": "81830221DACA54EDD814E2200564BBA42F75A7A2913A4207D9F8F97F3F6B46C0845EE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218725, "uuid": "8af733e0-2566-4f41-a7c4-a789fc8559cd", "value": "1536:QERIn2hxBsvqBuKXxP2dyWxaqQ6Rxt5AB/aqPwL3VbCbR:QmI2hxBsvaXxPrm/Qwt+awaxCbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218725, "uuid": "baf182b7-5202-45da-9aae-7b79ebc7fe33", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218725, "uuid": "cf0f2b84-96e4-4b43-8778-03ffaf491c7c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218725, "uuid": "c36fc9ee-f173-407c-9470-2b0f8b19d6eb", "value": "catalog-1681956167.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4764a97-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218483, "uuid": "319eb223-ba56-460b-b04a-9f4ef49db16b", "comment": "Malware payload", "value": "99f889488288e537f5b6ccba3c07c369", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218483, "uuid": "6e01adf1-2637-4e1b-a6c0-e93431e51194", "comment": "Malware payload", "value": "4ad51459280b4b2ea8878a535d00022eef83f010176fb4b610146c449267675b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218483, "uuid": "145c49cd-01f0-412d-910f-9a46e1efdeb5", "comment": "Malware payload", "value": "de9dfd2dcf01378799b00f6d60a118f83c5f399f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218483, "uuid": "6b9917e0-2085-4b2a-8a19-a399a3fc59c1", "comment": "Malware payload", "value": "8da0e74ee2b27e96de4782913783f30433e73925decc26d0f19a7732f6eba680afb39db910616a0b1698db4db042bdfa", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218483, "uuid": "d6ef946b-4d9a-491c-8111-29cc6d148e4e", "value": "2F83028BB4D8433ACB3523F658AE5E4426B1A47F040CC6DC65D73B78AB53672A572388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218483, "uuid": "7762c335-1692-4225-a70e-3063f9c55deb", "value": "1536:VEwAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvg:VHijtuPmU9j7+XFWtYe14hbOjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218483, "uuid": "3299c1ba-d6fe-48ec-9755-aa37d13c4554", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218483, "uuid": "aa998235-851d-427b-b172-825e2cc83adb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218483, "uuid": "3b6d4980-f2c6-4d93-81b3-5fc71eb22cf9", "value": "catalog-1528893854.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f50f012f-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221087, "uuid": "b0e773f8-87b8-4e29-8f2d-4b1809e1233d", "comment": "Malware payload", "value": "eaa5c22d9cd7015fa6fef31a226a2d09", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221087, "uuid": "d9ce7cd0-bba1-45f8-a67b-8a3e910f895a", "comment": "Malware payload", "value": "4ad9014ef815098f619e27ac4b4880418917c9d49f91cba567d6972a4801fd47", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221087, "uuid": "e0956067-1254-4d0b-93f0-2e592f40c217", "comment": "Malware payload", "value": "82e5138978f2060061e9c69009c33e2bd2f06c87", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221087, "uuid": "59873676-33e0-47aa-99ba-8488b4306549", "comment": "Malware payload", "value": "253c889a4af554d4511385b71077f85ad0cf3e03295cec8e1ce1de334d48293affeaff742c454b79f6fac7b2762f7b2b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221087, "uuid": "2b913c74-18f4-4898-be92-96336e795583", "value": "5A83121A99BD1CD9C0AB12F00D73494D4860EF6D411C8449F10AAA8F789EE85DEB7AE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221087, "uuid": "af29e36d-8df7-4deb-95d7-51d3ef9cf09d", "value": "1536:dt1QVGeGAg5dwSp6yMvBjqqxPGLuhCWdHsh1oSFWsfEFhHqLWa:dAG7A8l3MvBjqq5OsZdHAO5hK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221087, "uuid": "66258699-0021-4edc-ace5-df6d546037d5", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221087, "uuid": "93efb3e3-2b0d-4e91-a348-db48944d7cdf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221087, "uuid": "b314f48b-9569-45c2-8413-5c0220e7552e", "value": "info-1482471036.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a8cbed3-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221714, "uuid": "1e4d1cc6-4534-4e0a-bcaf-e3526381f72f", "comment": "Malware payload", "value": "8c0e22be9af43c50c29be74f6e65e0e7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221714, "uuid": "112e62a1-b157-4595-9031-0611a3ef2887", "comment": "Malware payload", "value": "4b04248a93e487fef81581d7926291585406fcc8662ffdcbbb61ee3706220a16", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221714, "uuid": "857d6287-a643-481d-b257-152cac50f73f", "comment": "Malware payload", "value": "f6281dde624c32915df4730e0e9ae8798b25f0a9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221714, "uuid": "f958e90e-c886-4268-a459-fdf6e793e473", "comment": "Malware payload", "value": "1c06c1e3b07c0a4b430469507a1e8458e9458b1e85d97d9dd9975ec622e2a29103a4a0264861a712a8dba523b14742df", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221714, "uuid": "06f3eef7-519a-4b9a-8996-31f8641bdda7", "value": "51831209A0BD4FE880D21D813D347ACAC6E4EBD22986D443F1349B7795B1F360179E2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221714, "uuid": "1942bb05-eba9-42ca-818d-c9f755b333b2", "value": "1536:uqHyJmpq7rWVy+qBDkq7M5Y2VXw1QFsrGq9ZMlmZQTQdF:pQmceVy+qBDkqUXw6Af5dF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221714, "uuid": "3b91f944-8a2e-425b-a929-e57b6ad37a53", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221714, "uuid": "8ebaed91-d2fd-40fb-8895-48a9a9ec2c1b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221714, "uuid": "4106562b-70b3-4167-ab97-c86afd59d980", "value": "info-1836249486.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1116a4f-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218504, "uuid": "b034aed4-187f-433f-a169-d6e5ac2bd0ce", "comment": "Malware payload", "value": "72828436db212664e55dd9bd76d0273b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218504, "uuid": "283ac2e1-e579-4d73-8da0-f4b401c18fc8", "comment": "Malware payload", "value": "4b09f7e94a9e979a9d09bf4b9c81c21c03a480d9f81ab020c9ba6f94ccfb6af5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218504, "uuid": "9ef71294-9aa3-4bf4-b57f-a0b5d2599a47", "comment": "Malware payload", "value": "49d8e73b92640ecc856df100b51dadb948c16e0b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218504, "uuid": "a99d7ddd-e7bd-4d19-baba-f78a4fc050f0", "comment": "Malware payload", "value": "01b46fa642875365cf8d06676d4091ee6b1183b411c756ae739ffe47c82c02ba44de02b1d2e1333faf3154e594bbe0ff", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218504, "uuid": "ed196e7c-f653-4f04-a5c5-0d1a13d67e82", "value": "2483028BB4D8433ACB3523F658AE5E4426B1A47F040C86DC75A73A786B53672A572388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218504, "uuid": "f46cf7c5-42c2-444d-8255-e35bba814c44", "value": "1536:VEwAfNtg2P4QaGapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvU:VHijtuPmU9j7+XFWtYe14hbOjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218504, "uuid": "ed862d73-07be-4678-8a50-60cba7f1798f", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218504, "uuid": "3b32e7cb-4215-4add-885a-b655e79e487e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218504, "uuid": "b713e511-7cca-46fe-b952-562e05c8b51c", "value": "catalog-1548890947.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb708c12-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220561, "uuid": "77f5dad5-c73c-4091-ba6f-1552ca08e36a", "comment": "Malware payload", "value": "d73c9b6c7c356b3b278721405b750a16", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220561, "uuid": "9fd13ad3-1931-4da0-8adc-61c25764a406", "comment": "Malware payload", "value": "4b35564f21546d6927d0f286ad16e052334d555fbf367fb2c1058c600a52a7d7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220561, "uuid": "617da864-afec-4c18-bcfb-1f2cc9ae1266", "comment": "Malware payload", "value": "f60719c1cf1dfaf984411eb3b63fd8203d6d4220", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220561, "uuid": "0c48232c-fb6a-445d-958f-a50c808f913d", "comment": "Malware payload", "value": "0819af040526eb08b3605f4774bcf067af0ca0f2f0159bd0e211c28340951a4eea1591ad4aa50ddb0283430d7a49014c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220561, "uuid": "8865991a-443c-441c-9fd0-0b1796b929f2", "value": "0D83024B599828FFE295AF10232CD98AA90FCAF4D9705514F20BFB5DD0B7B29727041B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220561, "uuid": "96553709-05f1-48bc-861f-53d577c0307c", "value": "1536:rP6sEDF9MwsqZSCzfAkZ8kISNurvd197v7UZoctQ2kPo+4mpRlDi1nUSUqxuuLX:r65R6wsqZXzfA21s19T7YptKRNpoUSUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220561, "uuid": "88c0d685-421f-4e5c-ab9a-f49855350c18", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220561, "uuid": "5d2573b7-6b9d-46cc-a45f-3e2c2d42b2bb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220561, "uuid": "d821a758-ffc5-453f-be45-8caf1e4a3e31", "value": "info-1243391861.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee59ba0b-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219358, "uuid": "76b0ffef-b4a7-4d98-b3d9-49dd4a28d32a", "comment": "Malware payload", "value": "c5c3a1bd2a56fd2f6e6634a58da430cb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219358, "uuid": "78eae90d-3703-4858-8a1e-8250ed282ffc", "comment": "Malware payload", "value": "4b36ccacd86db4259be96e908ceca25dd1b7be810ebcd1072a25df2c95d5490c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219358, "uuid": "d4a47420-91f8-4ab1-8c85-48b30a6eeb9c", "comment": "Malware payload", "value": "f60f2ea3e99ea44ce718c98f4f109690d415a5c4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219358, "uuid": "0e2adc66-d9a4-4ef4-bf47-1830525420d6", "comment": "Malware payload", "value": "0a74fb773b5b2055e2bf2f087eda105b99f952acae8b06319692cad262a2ee0d7d36f7cde77ce8da6c63f7d4672c0c22", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219358, "uuid": "ba18a0ee-b5be-449d-aa5b-ff80d80d61d3", "value": "778312979F9A3B9D2458AC39C57B5CD10905CE37C157301D22283AF62C1BEBF9B054DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219358, "uuid": "ead0db7e-86c9-4ef6-834b-728e8db97548", "value": "1536:qvMaAK6VMtJDrlSnna6UAAWBHTe87VqINbtezgVRxr9AiUbQTKXs8FI+b8T:IzAPq1Sa6ne8JqmdIbLjFRbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219358, "uuid": "3a037e35-5049-4968-84c7-b55846119282", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219358, "uuid": "70253866-f0e7-4591-9d4f-0fd87c454096", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219358, "uuid": "0f64a5b3-0e30-4191-9ea5-d92241afe8be", "value": "catalog-2037410508.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a5ef9d3-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220747, "uuid": "100b7b92-a7a1-4c9d-9755-ed7ad077c4c5", "comment": "Malware payload", "value": "60f6a502f87547d3c4c35149ff357987", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220747, "uuid": "084d297f-2bf1-4494-9438-f842f53bb933", "comment": "Malware payload", "value": "4b4f644cf67c2c963fd8fe0b8163295aad9235d681b668aecd0b0ce1d5427f74", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220747, "uuid": "cc964842-764b-46d5-ae73-0392e43ac60c", "comment": "Malware payload", "value": "da1f4c4a73407ce0af06a23c217b9e9331949d93", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220747, "uuid": "55031603-75e6-4805-9c0d-b9f32870301e", "comment": "Malware payload", "value": "633ae47239a59c9f772ab6bf3da65239fa0a4eb614cb91a72e2a2236725d67af08036425a047b92264b6ec196994665c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220747, "uuid": "4bfbc0b5-7a8e-4546-94b6-fbfbe93e408b", "value": "0283121B567F3DD8C21DA5E45EB21F2D2D600CAD815C80AD514B64FE22BCDE28E638E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220747, "uuid": "b6df0691-0f18-4683-8758-b4680f37d161", "value": "1536:EtaLgbCL+q1zmW7WPGLuhCWdHsh1oSFWsfEFhHqLWM:EZG+xW7qOsZdHAO5hKH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220747, "uuid": "ba93aaaa-b595-41dd-ab07-bb3f5c1b1aeb", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220747, "uuid": "15e98438-b08a-4700-ac62-77df8e291a04", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220747, "uuid": "aba66723-d5ae-49ae-81d1-c5f224b537d2", "value": "info-1352093826.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237e386c-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217729, "uuid": "9d78a6da-3c88-4515-8083-8ddec2b0a851", "comment": "Malware payload", "value": "5b6f69fffcdd9f6b4b93518c74c8c7fd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217729, "uuid": "194a4185-6f36-43b0-a883-635738ed070e", "comment": "Malware payload", "value": "4ba01f82d5c3d6762e970cc47a42b7460b7267b2f5e612e9d8bde8ce48b7a778", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217729, "uuid": "f934cccc-b5da-4aaf-a7ce-6dd60d4d5fd5", "comment": "Malware payload", "value": "b73a5cf710f4d8b8728d485e9229d2f78d9c6085", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217729, "uuid": "a1e88cae-50c3-44c0-9f0f-d086246d7f9b", "comment": "Malware payload", "value": "4909b8688b0c2d2280655f286751be3cef6c547900186ad098d62c384dfa2fc43f09acf551800a8949798d58c8c5f1a6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217729, "uuid": "32b82805-6c55-42bc-bca8-23c1b0eff8cd", "value": "79830227FAC725A68046E9F35B323B192A427AD9745435978FBC03C0F63615F2DAC1D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217729, "uuid": "27ccf064-f971-4e4c-8ac3-df9dd7f0f62a", "value": "1536:mqmy0pi0wOQMP4gCQZiwotTCWxxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZiZtT:0y0pgOQMPEvtTCWzJ9a03fjwe1moYpoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217729, "uuid": "b96ded1d-453c-4c97-84a3-8115b3a58cff", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217729, "uuid": "564fc3cb-20c2-424a-883d-8139edfdec54", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217729, "uuid": "52ab0833-58a0-43d0-a623-4585e94aaf49", "value": "catalog-1127580069.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "349ac889-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221194, "uuid": "e26610f7-b2f0-4b3d-a9f3-cd26d6ec5c9a", "comment": "Malware payload", "value": "13036b51169222847968958ff3af663c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221194, "uuid": "43197782-42a1-4021-8f26-722280be1fd4", "comment": "Malware payload", "value": "4baa5ab6b2732a1062719883b43a49c8a750ffbd2f9f7e2d15f730e53c69b238", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221194, "uuid": "938e1fa5-9c96-4bc4-8fbd-d29eb2ca9b5b", "comment": "Malware payload", "value": "ea2543e27fe49b40910e470a41ad69b923305964", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221194, "uuid": "0f4e3598-3411-4a95-9b91-e5746ebbbdd9", "comment": "Malware payload", "value": "dd512e5c0da892e7f6fb6e7303007a8021aaa8fc9c50cc52847b1d5939d0da7492d4d5f1e5a6835e59e71bb9173826c1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221194, "uuid": "2fe1f88e-bff0-42b7-91ad-8d533e602ff3", "value": "948302F02CEE15B9838D6676A17D1A43CC9C1FE016686F8F631152282EB18DFC43B676", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221194, "uuid": "9df61beb-f64d-4d04-8424-1ad79549bf52", "value": "1536:Pr7l+KIkejUgUlrZcCWb/bLCDxxp/ERd9QnGlRTH7qrelcH:D7l+9UhlrZcnfLMZERQnGnTHMe0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221194, "uuid": "e41bb4d1-ed80-4821-af00-9b18bd16ef2c", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221194, "uuid": "8f215aa7-4517-4dbe-a86c-28a532843d2a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221194, "uuid": "516707cc-efb1-4b2f-b85f-bd4976d2fc86", "value": "info-1551617287.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a1f8564-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222223, "uuid": "d37c722e-c288-41ba-872b-7f7240492fc4", "comment": "Malware payload", "value": "d2bb703401c44c37345f6cd41f9e18e0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222223, "uuid": "44222d92-3a0e-4e72-a739-704ccae4db17", "comment": "Malware payload", "value": "4bcc04e870b4c2488d95c950226a2fdd16230d04cbbf8fd8d4eb9c1d841a1ccb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222223, "uuid": "6d77df76-e24f-4ec4-9937-e76dfa88093f", "comment": "Malware payload", "value": "6c993d994624c40b2edb4b0e8a0255560068a67e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222223, "uuid": "ce62653c-f616-476c-af56-5d767f87c19e", "comment": "Malware payload", "value": "5bc686c8fadd7b52d3e3350a69122b0e4b48262c668a0bb7114ffa2df69466caf9e5b12beb53eef0a57f647056122275", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222223, "uuid": "9d42a531-d82e-4846-9e9d-f800011e3653", "value": "D783029C30FF0144957A6CB8613FE80750FCAFDB2D37B75947208574AA114DAB6239AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222223, "uuid": "71c8e980-71fc-4019-b308-35377b245941", "value": "1536:oQr7l+KI0ejUgUlrZKFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbXYZTa4hpe:oC7l+NUhlrZ6O6xoKDShicdBMM1/XPQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222223, "uuid": "795dd039-18c9-495e-9716-fe3b23387a73", "value": 86795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222223, "uuid": "d8ba1bf6-56fb-48b6-8a93-39038cc5d963", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222223, "uuid": "91997986-165a-4beb-ace2-862138efb730", "value": "info-269919138.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "457d3ff4-a488-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219075, "uuid": "0288bc48-18bf-4f65-8a44-4501c2ed3e83", "comment": "Malware payload", "value": "d3a178a4673980d1f0e6603916c2bced", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219075, "uuid": "d216209d-6c45-4bf8-b90a-0a53492617e6", "comment": "Malware payload", "value": "4bfdca78f8755ac7c377f378a64f0ea01d33db76a335facd3291928d6f0e3033", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219075, "uuid": "ea090619-65ee-42ec-9a1c-9ecef4974d26", "comment": "Malware payload", "value": "9dacbdf1e1d93fe3ad967f1e6356963d33971f8b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219075, "uuid": "ea43a04f-bcaf-4709-88d4-dad9091fdfdd", "comment": "Malware payload", "value": "9997d57d90172c4edc0827c68a33da67264ae2dc4104cfb041f0c5832856341cdaa2022f9c8ca74a0e1a5b173a9b8b1d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219075, "uuid": "33f2e295-d03a-4a32-af7a-5c1cefd79a84", "value": "A0831230A19F8888F914F5A01F69BA971B6ED72342A508177734B47F1C931FE2C957A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219075, "uuid": "6e33038e-88ce-4d67-b8ae-e6fb5673f65f", "value": "1536:Kf1lwz7uJhVC4r94hhs/9AG0yWxaqQ6Rxt5AB/aqPwL3VbCb0:0cvunfEaK+m/Qwt+awaxCb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219075, "uuid": "fdaf7895-0e48-4c6b-9760-fd085b0e24cd", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219075, "uuid": "15b346b2-5e76-4261-b9e5-8a5ce6558708", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219075, "uuid": "dbd9db80-e4e3-4a2b-b84f-fe131d553c97", "value": "catalog-1877383076.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c01ebe-a487-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218637, "uuid": "b42c06e9-bdf2-4a78-9e6f-ece31d262c25", "comment": "Malware payload", "value": "b9146abf3183ae449df2cc5cd3a312ea", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218637, "uuid": "8a0b019c-4b05-46e8-9643-4020b975dfc3", "comment": "Malware payload", "value": "4c115544097209095dd3b0623fbf5a6ca991127dc131c67dfbebb1b3309d3ca1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218637, "uuid": "28ab728c-f6bb-490f-bfcd-21daf4851b15", "comment": "Malware payload", "value": "80e50efe9fc2c7db3945862e89f46c038f31435a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218637, "uuid": "e80ce49c-aadc-46e9-b450-a8fc955f11dc", "comment": "Malware payload", "value": "f868f0917baa33885aa99f6e3e6b1e7e9ca8400ab87408b6a872255006920f71dbd3c203dddd7bfa646f5623597ce2e7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218637, "uuid": "3fcbefcc-ff66-47ca-b2b8-c60413861196", "value": "3E8312D79ECB22A8702CEDB5C4772CD40A15CDB3D2462269265636B71845F7FB7008FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218637, "uuid": "d8ac44a6-be3a-4e5c-bb0e-c5af8c183779", "value": "1536:IqAS5f5EV5fEnaj1ZQUcDpTe87VqINbtezgVRxr9AiUrQTKXs8FI+b4:XASvEVZtj1ZQUcDJe8JqmdIrLjFRb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218637, "uuid": "a184f65c-7727-42d5-85c3-d54fabcb6b8f", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218637, "uuid": "ec33ae90-f599-4ead-bef7-9e3cc86ad42e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218637, "uuid": "d7d35673-b27f-4396-8288-d6ce22648a52", "value": "catalog-1652045069.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64236431-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220415, "uuid": "206a425c-680a-4e9d-8374-e3b2990c74a4", "comment": "Malware payload", "value": "471efcafe1178a2b1d267bb5763ee407", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220415, "uuid": "8419dbc6-9168-4181-977e-67221bc23a81", "comment": "Malware payload", "value": "4c6dbabf0a4c676cc2d051e39bc394e33b07135d5bb64b0b95f431cd615ce353", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220415, "uuid": "49606c06-6c4c-4d1d-944d-c2bbfc86175b", "comment": "Malware payload", "value": "c9ea0ca9384742086387bd0642389a907c55c773", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220415, "uuid": "946b484f-bd9d-45ac-893e-6149ebccab53", "comment": "Malware payload", "value": "b001f0fed30fe7cc04931a535842a4ce1ee2151f7f25b8f29e084ff2b2d23e8f3e4c0ab2b22c837123aaa9606fa4dbd4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220415, "uuid": "a150eb7e-f561-44c9-9fee-e83b62b23bc6", "value": "2C831209A0BD4FA890E21D413E347A8ACAF4EFD229859443F1745B7791B1F36417DE2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220415, "uuid": "fc87f727-f11a-4e98-8e3e-9d383a46f0fb", "value": "1536:TqHyJmpq7rWVy+qBDkq7M5Y2VXw1QFsrGq9ZMlmZQTQdx:uQmceVy+qBDkqUXw6Af5dx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220415, "uuid": "515bde9e-3a52-4a51-8a8c-673f2069fbb3", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220415, "uuid": "b341a9f6-3b83-48bc-92ee-a916f5f1deff", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220415, "uuid": "f8a51819-7e2d-4fdd-9ec5-0b8c27adfd51", "value": "info-1146024091.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c030754-a428-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619177935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619177935, "uuid": "6c3c64a4-52dc-49a4-92cd-3864fc583630", "comment": "Malware payload (AgentTesla)", "value": "29cd0ed00234609279ae20ab234e3a52", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619177935, "uuid": "982ca853-05ca-45f5-85c7-32303ba5d632", "comment": "Malware payload (AgentTesla)", "value": "4c89a49b4e2bdbf85ffcf0499219b54504ce7e27234869ebdbafff57401c6689", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619177935, "uuid": "f0020773-f558-4a69-9dea-721735c78b8c", "comment": "Malware payload (AgentTesla)", "value": "71e5830c7c45e18a84ef4748a128d8391ab3a9cf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619177935, "uuid": "627b7eb1-ec2e-4953-8e33-87eeccac5c7d", "comment": "Malware payload (AgentTesla)", "value": "1b4d58f386f6941b71a3414b2df4dd39fbb4bf4c045bbbd3a1dcadef8cdb21c68ce93fc1c17768f8dd191da778dd8f93", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619177935, "uuid": "14b98f10-bccf-442e-add9-358004a8eae8", "value": "91C4234F74877CDEEB61DFABF34B12E41196A1424B508A50C2CC94CD27BAEC7E942D92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619177935, "uuid": "7cf698d1-f780-427a-bb8b-d4587763fccb", "value": "12288:5bBaZx7RORccA8cE/eFXl06I1tyPk1sQU+5hCDZI7VqMUtGU:5bmx7cRBJ/8XWyPusQD5ht7IMpU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619177935, "uuid": "c16857ec-6320-4a2d-bab0-34f49c81887f", "value": 596096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619177935, "uuid": "d70e9cf8-98d5-4709-a3dc-57baf53548d3", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619177935, "uuid": "1443d8ea-4d6a-41dd-ac37-85c937a53dc1", "value": "_Shipping Docs 21000020.7Z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb047d82-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220587, "uuid": "77cbf078-8769-48fb-aa0c-5832664aad1f", "comment": "Malware payload", "value": "18261cdd6fb34f71e9e0fb0432823f5d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220587, "uuid": "fc3a55d3-49df-407a-9e1c-3d0f4985045e", "comment": "Malware payload", "value": "4c8d7e9033fefb8ae64cd37bf139e7d55782f02c8630ea4d97768bf80558f3f6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220587, "uuid": "e40386cf-d121-4ef4-b69d-623b4d8f25fd", "comment": "Malware payload", "value": "b4e0c07caba88c1c6011c0bd97de0983b6a4d0a3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220587, "uuid": "14aad501-a8b4-41d6-8d57-b7d6de3598cf", "comment": "Malware payload", "value": "6a10e6a3546600202abf4fb6481ce7e85e810e0c05e3159289208d8ba1f45974d14bb7ab9c5164ba67881b919777d188", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220587, "uuid": "f661ee86-5a58-4f9d-89fa-27ff6eafdcb9", "value": "ED8302A1A87CA15F638FDB73D0777757E88009E5512C1E9B534222393DB8DEF8827229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220587, "uuid": "958ec996-9574-4ccd-8ac5-0e74a2392547", "value": "1536:ItaLgbb9ZvjL3+xnxv5ZUS8CWb/bLCDxxp/ERd9QnGlRTH7qrelcn:IZ1ZP3+9xv/UHnfLMZERQnGnTHMeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220587, "uuid": "28b06903-1580-431f-9fd2-318800ef71d4", "value": 86799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220587, "uuid": "370d254f-018f-4e35-91f0-e9c65bd0df8f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220587, "uuid": "d1b3ce0d-08cd-4d00-a3d8-301ee8394b93", "value": "info-1261736186.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98408d80-a424-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619176264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619176264, "uuid": "1a25c220-df7f-4480-87f5-1517c595f22d", "comment": "Malware payload (AgentTesla)", "value": "6107606b81727839ddd19d920e2938f7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619176264, "uuid": "367df87c-32fe-4cf4-a667-67db52ed27b4", "comment": "Malware payload (AgentTesla)", "value": "4c9413507fb0bb724998ec8ddd0055608de2379e9387eb762b41669deb168215", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619176264, "uuid": "bc7f06db-359d-42d6-863e-6226bf3a136b", "comment": "Malware payload (AgentTesla)", "value": "ba237967a08c6be91b5ef979c54d7d439c2f8dd4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619176264, "uuid": "3afddf4d-5ece-4ed3-84b9-e87f7fc61248", "comment": "Malware payload (AgentTesla)", "value": "1dc8520741dc22174dbfc989c0ad9f5ff00702fbd65db33e8233c2ef561ef9cfd14dbccd9421fb0d2ae213b7a7e528d3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619176264, "uuid": "db141061-a3c9-4ec3-a44e-cf0e0df4f09b", "value": "1B05337A88211FDB25EBA89CC16CB75780671F0110C95572FE43A972AF1122BFCEF985", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619176264, "uuid": "99ddc363-5f76-4d56-b0a5-7fbc6ae5b1c1", "value": "24576:FdKDJAiZYUSHBpzsXqWcFFHmMz5yi4ZDOvjDJzv:+FAiZB6nwuLHttyPBO7DJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619176264, "uuid": "326d3a28-9faf-407c-a742-3fc195ec0782", "value": 856355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619176264, "uuid": "6d696463-a8b7-4594-bf65-372480809512", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619176264, "uuid": "0b7d8245-50d8-4aed-9757-e934a5f7eebe", "value": "_INVOICE.xls.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9193bce-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221846, "uuid": "01a83901-8eb8-4b61-82f8-52c459fd5598", "comment": "Malware payload", "value": "ff7402569b8c472796b2cfb3c5e77559", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221846, "uuid": "99630e05-e38e-4d7a-a033-ed81222ce271", "comment": "Malware payload", "value": "4ca897a973118af34c3397ce093c559c36b50e15e3fc592dcebcec49d612da12", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221846, "uuid": "42fdb60e-0c1f-4735-ac4d-c8415c04a3f9", "comment": "Malware payload", "value": "205da0dbf6a67974cef6bdb218d1adb64cbe7e1e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221846, "uuid": "ad710504-3ab1-46e0-b4eb-733d694340d6", "comment": "Malware payload", "value": "a09cb3281c872707a8dc30e16d0606f7bf80d349aee977ec9798c95d664606e1bae4de2cdbe5c40eb03a34083639a507", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221846, "uuid": "98ce7880-8aa9-403d-bcb5-b886501413c4", "value": "CC831273382E86EF904FB5AB50AFF47DF115B82D8D1DD615A3A42A20383242AD415DBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221846, "uuid": "d4fa303c-2cb1-470a-bdf6-535f7b99c41e", "value": "1536:zpxKz4ATZvjL3+xnxv5ZUSzhhcBrasoi8vQMwdjV46CTq:zpxKz4AZP3+9xv/UGDmrajvIM6CTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221846, "uuid": "e18ca647-12ca-4a75-8ec8-62561745af77", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221846, "uuid": "f32dceb5-095a-43c3-971a-72efec4427ae", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221846, "uuid": "89996cc9-fea4-4b8f-be21-437796082812", "value": "info-1924634555.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "783138e7-a48f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619222166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222166, "uuid": "6da925fc-ad0f-4edc-ae7d-e8bcd49c7726", "comment": "Malware payload", "value": "3535a26e86cb8c794b026998ffcf1065", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222166, "uuid": "6f2266fa-f983-473b-a052-3c0a631d8b9b", "comment": "Malware payload", "value": "4cd1c9527c8ca78391fdf0a6e36d81732424031c8807c1365638135f981f1351", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222166, "uuid": "e57c0a32-c302-4226-80d8-10c141d2930b", "comment": "Malware payload", "value": "6ec42af13cf9a40d450bd042930f7be2ac4d7fc8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619222166, "uuid": "cdcc8768-5211-4975-8989-f1b491a0cd14", "comment": "Malware payload", "value": "79b909da84565f4135a5fb1841c28314b8740ddb0f13761b4464fb082968d7aefe819b68e234ad347df35acadb3dff2a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222166, "uuid": "19735e69-8446-4647-a234-26d7d7552124", "value": "338312A7F5376CF9C19DF2D7A22F624C36EC85C0B0358286F62E2E17C59AAED550480C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222166, "uuid": "301b49e7-ecca-4fc2-aaab-458518b85a94", "value": "1536:uNHZbN5m6RtUlLHfAkZ8kISNq7xWgwMQZcUT7oqlaHvvbFq9GHocnoe1RqfwSOJh:u9Bm6XUFHfA210waUT7o/v096oiBkwPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619222166, "uuid": "1c8882a9-5f74-4b41-a552-db6e74a16f11", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619222166, "uuid": "b9f6d247-6562-4195-bf13-5d8067dd5d52", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619222166, "uuid": "eb257776-19c7-4e38-97e1-22e8043fa970", "value": "info-230049668.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6159c1-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220590, "uuid": "fe937f9b-9eb1-440d-814f-ca01c17d6e7e", "comment": "Malware payload", "value": "a1a726f3a793416d14cd4337beb489b1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220590, "uuid": "62f3c7d8-e435-4c1b-a721-624de7a0b2eb", "comment": "Malware payload", "value": "4ce006edcdd837db65fcd7379ba0fe576afe7b344961dc82e7926a143cd4c1e6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220590, "uuid": "3ca07094-71d2-4fc8-b2fe-606e187c40db", "comment": "Malware payload", "value": "268e66701e9397672bcf57057385f70dda6e59a2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220590, "uuid": "7ae0c1b6-39bf-4f9a-a3b2-6dee78288d86", "comment": "Malware payload", "value": "c124def6e4f1537226da3e0a8c2781144851a79067b61d53ac278ab10e92f92f195c1f6f21023617578027579de76da4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220590, "uuid": "422c25b1-49f1-4511-8057-465c9be3ad3e", "value": "1C831207987F24ECD07A7BE01D72584D58B0EF68801C8598F259768FB1D89E64BDBDC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220590, "uuid": "adc4e0f0-61f1-466e-8eb4-2e85ad2bb440", "value": "1536:CjHZbN5m6RtwWdwSp6yMvBjqq1PGLuhCWdHsh1oSFWsfEFhHqLWR:CrBm6XwWl3MvBjqqdOsZdHAO5hKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220590, "uuid": "7ee90c91-0e89-40de-b7ee-705284c2d523", "value": 86799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220590, "uuid": "f885c70f-5838-4a9e-8e72-e42314d196db", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220590, "uuid": "68cf2bc2-ed1c-40f0-82dc-b8418386876f", "value": "info-1261819990.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cae223e1-a485-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218010, "uuid": "567bd641-4cdf-43ea-84fd-d03455a82dc6", "comment": "Malware payload", "value": "cab6c31b3c6953b4e509caecda5a8a2b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218010, "uuid": "0bc6882f-3df0-4cdd-9e54-ac21783ad27a", "comment": "Malware payload", "value": "4ce85028c36658c261230ed27019c8e6decfe71624d5c522cba33cf0dd85031f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218010, "uuid": "5fc1130e-b4e6-4c83-b9fa-44cb8f5cc16f", "comment": "Malware payload", "value": "1ed89d9ac82fb2f535bbb00613b54e48c4d6ad24", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218010, "uuid": "30b02108-6f57-4636-98bd-8362e89a43e9", "comment": "Malware payload", "value": "6518f106bd7617172a18d60323a3ecb98b62db5e1b69435d53597e4e649e130607cbc0e6629df0be3e45e1a91d69b59e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218010, "uuid": "66989358-8ea4-4e28-837c-0314e8243ceb", "value": "198312D75E8B22AC702DECB9C4772C840A19CDB7D246222A265636771456F7FB7008FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218010, "uuid": "8569e64b-9bbe-47de-a63c-887000d1c672", "value": "1536:CAS5f5E/5fEnaj1ZQUcDpTe87VqINbtezgVRxr9AiUrQTKXs8FI+bh:CASvE/Ztj1ZQUcDJe8JqmdIrLjFRbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218010, "uuid": "c404b26d-6ab9-4427-8cae-5ab29cc74544", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218010, "uuid": "190a1377-19ef-43d9-9bc5-dafab509b487", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218010, "uuid": "79063fb2-6ce4-43aa-beb5-1a8281c1b609", "value": "catalog-1288626498.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67fc2357-a48a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219992, "uuid": "971d6e0b-29a7-4389-8033-6fc5be54490a", "comment": "Malware payload", "value": "5163539829cf03cedc7fb506fc77f810", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219992, "uuid": "68171dd3-cc5a-4bba-aa5d-9335b7ccf737", "comment": "Malware payload", "value": "4cf9d43e1bef9f8e17a446fcf9ccdde69f766666ac6881f07f8e9f820bec90ac", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219992, "uuid": "ef53002c-86fb-4d79-9258-8a8acddfd9ee", "comment": "Malware payload", "value": "4cd6b41a2fdd5423235db2d916d62da1135cdfdc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219992, "uuid": "74c2a680-55cb-4241-b8d5-ef110c82e18c", "comment": "Malware payload", "value": "758c7f3e7b8e549953832ede97f111eaec5e4733da7dc6c8f993b88d0b5691895de0d27928e1c522c0b2d559f29663c9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219992, "uuid": "d1c8c23d-dbb0-4dbe-af85-374e8aa356f5", "value": "D4831227FBC735A28046E9F39B323B196A4279D9745835A68FBC0380F63615F1DAC1D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219992, "uuid": "4017d34f-4208-402d-b327-a46f36d7ae1a", "value": "1536:/my0pi0wOQMF4gCQZiwotTCWBxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZiZte:ey0pgOQMFEvtTCWjJ9a03fjwe1moYpoy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219992, "uuid": "008d65e8-e827-4fa7-9b83-aa90e4c15c0b", "value": 86932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219992, "uuid": "f0eed585-3a24-4fbd-94ee-f1f08c6ebd33", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219992, "uuid": "d1271d13-c63a-4976-a29a-000f56449d02", "value": "catalog-455954559.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0827a02-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221402, "uuid": "09e607ea-5a77-4d86-b2b3-a20f0e069f0c", "comment": "Malware payload", "value": "5fb0201d43c4b30a8c3b77e472b29b1f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221402, "uuid": "4d6ae0ca-5610-4962-aeb8-976f5f0ba02e", "comment": "Malware payload", "value": "4d0176527897cf9d3fda109cc92e51d4a0d3b78183308bccbfeea88431018382", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221402, "uuid": "d29cc8e9-117a-451b-b64f-bcaa38264bf0", "comment": "Malware payload", "value": "331c7784900daf68926fa6730eacdd46d1ebec46", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221402, "uuid": "609c44da-0338-499d-95cb-ba3cbf7f86e6", "comment": "Malware payload", "value": "44ae43a90d61ef1d898c1b575a6f9238f9c52669857616d98e4dfa7040b1514e957065527bf7c15a1a23724b89e36ebf", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221402, "uuid": "0ee086e5-c1e5-414d-b554-6a38a8632f64", "value": "53831209A0BD4FE890E21D813D347A8ACAF4EFD229869443F1745B7791B1F364179E2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221402, "uuid": "d3f908a2-8d15-426d-9993-d4a53a9d3227", "value": "1536:/qHyJmpq7rWVy+qBDkq7M5Y2VXw1QFsrGq9ZMlmZQTQd5:CQmceVy+qBDkqUXw6Af5d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221402, "uuid": "5830fcc2-faf8-4b3f-b1ef-d6be660e41ca", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221402, "uuid": "03c5b144-c217-4479-93de-225c1371ed26", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221402, "uuid": "6a6d167b-618f-4887-91d3-3f2504975f0a", "value": "info-1668475963.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1998a9-a489-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619219703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219703, "uuid": "09f32387-2fd2-4429-bd76-e38be4a130a0", "comment": "Malware payload", "value": "59d3dc19995423718f02c708401c1a33", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219703, "uuid": "84c5dd61-e16a-4bbb-a944-ad34f02806c8", "comment": "Malware payload", "value": "4d2f7ea052ea35bf6165d0e640f027fc9ee20c32178348fbfcbfee6bb413980a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219703, "uuid": "3636652e-fbec-4710-985a-83640a67b778", "comment": "Malware payload", "value": "07cc5ce4ae5323c61479d044711229c93b5c7ab5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619219703, "uuid": "3515b9b7-1dcb-422f-8a93-08b0733d3c6c", "comment": "Malware payload", "value": "add4b78356629c2ad3f0fcdaf2a59a0906c142f7e926fc75b59fd4f5fecce07c368c2a193ec04cccca246331e6220f70", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219703, "uuid": "bcf58565-e8c1-457c-912f-c827548203aa", "value": "54831217FBC626618066E9F25B3A3B1E6A8379DD795471A64FBC03C0F53614E1CE81C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219703, "uuid": "7477d837-9a47-4073-b8b0-64b9d4a898a5", "value": "1536:1qmy0pi0wcMlbCUN4gCQZiwotTCWxxJaA6bL0NhgQcizgAMEeIcs1mfwY1/QGXZJ:5y0pgGUNEvtTCWzJ9a03fjwe1moYpoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619219703, "uuid": "2ac59035-ce81-40bb-b84e-4f67e4cd8bb9", "value": 86931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619219703, "uuid": "652b739d-4714-4c3f-97f1-20718819ffa0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619219703, "uuid": "1ee49d80-89a2-4e18-bd97-f6a035341635", "value": "catalog-287062673.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d272fde9-a484-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217593, "uuid": "f6e496a6-fc7a-4711-b170-5d236c300f2e", "comment": "Malware payload", "value": "cae977076d5bf569ea353c27d28ba09f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217593, "uuid": "eea017fe-df94-4ab0-a213-da08413781fe", "comment": "Malware payload", "value": "4d38e2b761af844d48fb1f1ad4c54467c82ddf05ddbcce33c0e09a0a23983d95", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217593, "uuid": "33119154-7667-4ecc-9371-dfdf40bdca64", "comment": "Malware payload", "value": "f51a9907e245a880b4c567bb5b083223a20e15e9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217593, "uuid": "af007996-543b-41b3-852b-4e2a6ef7d53f", "comment": "Malware payload", "value": "99aabb0241c8ca8e076b51bf9821a920f58c3364b703a400908e660d34303958f1176e40fed58fb99b534f1c482d2245", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217593, "uuid": "3002ec26-c15e-48f5-9620-5beffb80be1a", "value": "5A8302CF74E9433D8F3527B648AE1E042661A43F44088ADC75D73BB86B52AB265733C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217593, "uuid": "bc484d5e-7300-462c-89f5-86413044be38", "value": "1536:oAfNtg2tf2vCapQ72ZTaNqeoGVadrj7ZIXFWgKilkAq14HE6M5XL2l92VyqJvd:oijtt2v7mU9j7+XFWtYe14hbOj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217593, "uuid": "e4d29c01-7ddb-4de5-a4c6-341d16c32831", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217593, "uuid": "8139be42-7c91-4a35-85fd-dadd519950c7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217593, "uuid": "8b7b349d-97bf-4ad7-9760-f85af6bf8915", "value": "catalog-1057028713.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "477f9ee4-a3f6-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619156372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619156372, "uuid": "33bb7c72-0f82-44bf-ab21-f887d482ef0c", "comment": "Malware payload (AgentTesla)", "value": "ac3b6cf815d81be857e59bd9201294b8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619156372, "uuid": "c1a873f8-d1e5-4d0b-9f2f-a9e1d89b1cd7", "comment": "Malware payload (AgentTesla)", "value": "4d47bec841a028ba6a2f2aa931ea768fbb19adea17a13cb27b2a3d644a52862b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619156372, "uuid": "9bb0b6f5-9943-4eaa-93ca-c27bc3a86d9e", "comment": "Malware payload (AgentTesla)", "value": "96113cef71683f49c15cbbd50efbb43830ff5ce4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619156372, "uuid": "0cb1b17d-e8df-4258-85d2-21f6985d9a32", "comment": "Malware payload (AgentTesla)", "value": "6acdd8e5d5a9b846c5ca5fc3bb8178484b5fe1ec52d399fa24c134eb48925e0d706a6eceb44efcde48c84986c3c452cb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619156372, "uuid": "40951bbc-7b03-42ec-adcb-a71eb14b426b", "value": "CC7302C017677413205DA26A00378F65B8AF984809D58A02D47B1F73F9ED697BEE31F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619156372, "uuid": "53849f1d-b4bd-4377-b044-0b1306c03b8c", "value": "1536:g61CyanPGB0kwAz2E/ojjP51oK+eDUvQ0vnl9S/OL+kM9fAGYKXVh+tc/:7Bww2Egjb51on+QhfPGvVh2c/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619156372, "uuid": "6faf8b36-9359-4018-a573-7e3312c940d2", "value": 75633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619156372, "uuid": "701e9996-dd2a-4086-8c63-fd33e9548cc4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619156372, "uuid": "54c74ca0-a0de-44af-a8bb-fc468948436c", "value": "Bill of lading.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfdad2a0-a484-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217616, "uuid": "b67874af-4183-4c89-9d94-714f820b07ba", "comment": "Malware payload", "value": "d915ca04f0e7acea03bdcef00e9b474c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217616, "uuid": "40ba64a4-7ebb-478a-92ec-692895cfe278", "comment": "Malware payload", "value": "4d587a0f81174f17a155a74ba4617603adb3ffbf7dc0d9ff6f74c9e9b715306f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217616, "uuid": "6303ee09-701e-42fb-8c17-d12a5b0e9182", "comment": "Malware payload", "value": "6664d64bc4754aaf7caef14d850c5c2116ff1769", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217616, "uuid": "780a7369-9168-487b-a697-4a0d19fd1a28", "comment": "Malware payload", "value": "17cde2928bc05b9361afec0a0cb30fd5ef983a6cedb4f6dd4a95b76944202c50bf584f221189fdb46db4d891b9dd598a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217616, "uuid": "b583d239-bf4c-42b3-8539-57e21908d66b", "value": "6F8302EAB853197A42FE7262767F7D501FBC35F49E3122B683A9601790B07E9C8D421C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217616, "uuid": "790bf18b-1e03-4e0e-9581-d5660cc419fa", "value": "1536:8AQKTWDK4QlztdZ2rQD2aCM1ZQUcDdiFALqCJI3+xOtGkwde2eDiFX0:Z/KDMzQQKG1ZQUcDcFALAOxeh4eNqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217616, "uuid": "d4cb4323-3722-4e2d-a0cc-e0b5ece33968", "value": 86930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217616, "uuid": "037a2810-9961-4bcf-b49c-fc0c04821398", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217616, "uuid": "51ebe526-0c7b-41f8-b968-a20bed222c01", "value": "catalog-1064502885.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af9a9aca-a48c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220971, "uuid": "f6a4ec31-9749-4a26-a52b-d0610c71a34c", "comment": "Malware payload", "value": "7c8010f08eb9f449ff12b01551095aff", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220971, "uuid": "9a99b701-4cf4-4f20-83da-296f9e921eaa", "comment": "Malware payload", "value": "4d657bd7de6baeaade068713abc8709266b0589bee6f2b7c968bb923c11f3f27", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220971, "uuid": "d4cbe180-e4f7-4781-8a21-a9888adfeb9f", "comment": "Malware payload", "value": "e3a9334c4e778c03c9fe6c220b5d043301af2100", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220971, "uuid": "8881249a-7ad9-4d39-b100-0a5a820f31dd", "comment": "Malware payload", "value": "e4ae93a27b6c42c65842b761506e793d22ea7a483e0498c04744b7d552e1a06cd0e9941ea06e85585b904eac8e5fc134", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220971, "uuid": "84b7ae1d-a4f7-424c-ab98-fa0c4c13c3e0", "value": "058302F12CAE15B98389A676A07D2643CC9C1FE016586FDB632153282EB1CDFC03B675", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220971, "uuid": "460359b1-3246-40a6-85b0-c505c3465120", "value": "1536:Gr7l+KIUejUgUlrZ8CWb/bLCDxxp/ERd9QnGlRTH7qrelc6:M7l+tUhlrZ8nfLMZERQnGnTHMex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220971, "uuid": "91000b31-c073-45b6-9893-b7392e3acf65", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220971, "uuid": "56ef4e9f-14f3-4abd-9b73-c31fb52bee25", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220971, "uuid": "184815b1-a6b8-4c2c-b04c-d40898613038", "value": "info-1410409736.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b34ad01-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220427, "uuid": "4ee6e958-2426-41a8-aa06-70d459509db5", "comment": "Malware payload", "value": "95d7d1c74b9f86c8298139a03a66789e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220427, "uuid": "d5dd4142-3c29-4d04-94b9-1e6440827823", "comment": "Malware payload", "value": "4d774a0b31c3728cc00e20527dab84e8aa13e870917a321ffc564558d9fb0319", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220427, "uuid": "ef0747d2-166a-4684-b3e8-3eac8948146d", "comment": "Malware payload", "value": "339b544a926a79b9fc5e9cc454efe543fbb18ea1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220427, "uuid": "2178c775-b8f2-43d7-b9e1-f771533564ff", "comment": "Malware payload", "value": "bc5ebd260dd611009e45318762393817cca8a9d51b8be7814eef609e012e5383aa3a2dbf6fe1d92282a49ecbbe4ecac9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220427, "uuid": "06c441ae-9ba8-4ed0-8cbf-6acc69f34474", "value": "B2831207866158FDF16ABF01273DD8CFA64ECBE1E93519C0F20E6F65D2A3399625440B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220427, "uuid": "ec9b9f81-23dc-4fbb-8d80-436218adc0b2", "value": "1536:zHZbN5m6RtLlLHfAkZ8kISNq7xWgwMQZL197v7UZoctQ2kPo+4mpRlDi1nUSUqxB:bBm6XLFHfA210wN19T7YptKRNpoUSUq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220427, "uuid": "b4fda5f5-840b-406e-b5b0-b93d732b3726", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220427, "uuid": "b4c50711-79c2-443c-84d3-0ae2caa824e1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220427, "uuid": "9130d06e-16a3-404b-b214-c977b934bd1d", "value": "info-1150025753.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c87de3ee-a484-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217577, "uuid": "88705d13-9df1-4173-902f-b3fb19c3ce8f", "comment": "Malware payload", "value": "02755675f34d9b42d2946f8251430ff5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217577, "uuid": "11b6e313-3a3a-4184-a7da-a8c480bd0034", "comment": "Malware payload", "value": "4d7bd14a195c0876657edf18d62764c7a9f9224c6457f5eb465137aeb49464aa", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217577, "uuid": "d6de7330-bb0b-44c2-8e97-0bf0e7e3251f", "comment": "Malware payload", "value": "16e6a02c9a722770bfeb288762f25fa3fb59eca3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217577, "uuid": "3562aa07-6b26-443d-a9a8-ae8c24ee9aa1", "comment": "Malware payload", "value": "068e631aab6010c4ebdca3610b8a3f854a54d3b4a47c422e1791ef9921e0d5ac65f5046255c0d2a2fe588e3a0eb7b05f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217577, "uuid": "d5d51b6d-0996-4de0-80d2-7770a2ff558b", "value": "878312EC70238A65637345A6DD7E90C32B5A9BBC441DB056A82B79364A307FFE121531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217577, "uuid": "75c001b7-4d7f-46fa-a75a-6a5961ccb638", "value": "1536:+zKTWDE4Qgl8LS4v50FC+p7UjoB8+wXdpUna5ahL2dmTLUVVvd:+eKDPKLRvaFjp7uXinakEmEV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217577, "uuid": "119268be-7fb1-4f05-b08b-c7ec1345216a", "value": 86933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217577, "uuid": "b4acfe6e-f675-4199-afd1-990bb55b9e00", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217577, "uuid": "ef1c06d6-faea-40b2-86af-1d1a5340513c", "value": "catalog-1051833321.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6e30d4f-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221386, "uuid": "2584cf59-c72e-4134-8066-2c6abf86c6eb", "comment": "Malware payload", "value": "e5f116a74e6532b46e23f0b8f14fb1c9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221386, "uuid": "672ddf90-1831-4ae0-b50b-0d4d6d12c949", "comment": "Malware payload", "value": "4d80dbf145b888b0822036b9598f827ac13a2f20b3cd643bae31b0c99d5edf9a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221386, "uuid": "592c65a4-dd0a-44ca-9c3f-894f48dcc3f3", "comment": "Malware payload", "value": "cc61dde5139f37404d5c6297e9937708d6812131", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221386, "uuid": "2b80a18a-529c-4f79-bc70-57260808fcb8", "comment": "Malware payload", "value": "a074139ba92388f9f1c7dabc558e4a31e35648cd04eae664dac7b7e9ab94f4c9b0373328409eac0264201c5c3454bb7d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221386, "uuid": "a58b9d97-12a4-4361-9d7b-cd74b61cfe06", "value": "BE83025B598828FFA255AF10232CD98EA90FCEF4D9705514F20BEB5CD0B7B29726041B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221386, "uuid": "023715f3-2e9b-42e3-a311-a2e105c283f2", "value": "1536:m6sEDF9MwsqZSCzfAkZ8kISNurvd197v7UZoctQ2kPo+4mpRlDi1nUSUqxuu9:m65R6wsqZXzfA21s19T7YptKRNpoUSUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221386, "uuid": "dfde350f-1ea6-498c-8770-ac7231c447fe", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221386, "uuid": "8ebc62ae-dde2-4dd1-ae47-ef35009b1d12", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221386, "uuid": "2e5a6af6-885a-44dd-b64c-5c1b537f21cd", "value": "info-1645916553.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f3db436-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221641, "uuid": "44620f5d-5c4f-4fa1-9027-eb9ca8f25e14", "comment": "Malware payload", "value": "9c2991c8261cbb5590a3a7294f1c3340", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221641, "uuid": "87ef1570-0a02-4787-93d1-94a816d699df", "comment": "Malware payload", "value": "4d986d937ac147fba11cc825e44a4613db60cb3da24e5c01e994d0b70337ba58", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221641, "uuid": "bdb89df3-7e97-4602-bf58-9b8c778c2c2b", "comment": "Malware payload", "value": "fa47f102cf9d33fc816f18ec38869c7a7d05eb5c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221641, "uuid": "e01509cd-5027-438c-a26e-431398139a3e", "comment": "Malware payload", "value": "15d7b72c223efc971f699c85c506f3626682ff6b1b71a0750c78d351f63cf75e537102dc42d66eb8d4fb7e4be8cc1926", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221641, "uuid": "0cb5fe35-25f3-4a80-92f2-a453c7b72a87", "value": "3F83029C30FF0144957A6CB8613FE80750FCAFDB2D37B74947208574AA114DAB6279AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221641, "uuid": "d811d5dd-99b4-4999-b90d-902a15a92f87", "value": "1536:Fr7l+KI0ejUgUlrZKFO6xoKO7sShqIwJc4wBURDMi+nyU/3nzbXYZTa4hph:N7l+NUhlrZ6O6xoKDShicdBMM1/XPQTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221641, "uuid": "ca40d0ee-a773-41b3-861c-42704579f472", "value": 86797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221641, "uuid": "66107f8f-3135-47b8-8590-37e8af40cbcb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221641, "uuid": "8d798419-94ff-4c63-8a08-e6ac2440cdd0", "value": "info-1791626822.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48aca18a-a48d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221228, "uuid": "1f8f8a07-8e64-4bad-8821-76726d7c9243", "comment": "Malware payload", "value": "936c14ccb939d5a67bd96e60a5f6cfba", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221228, "uuid": "9acfdf6f-2aa9-409a-b349-e7e24f4fe9b4", "comment": "Malware payload", "value": "4da5c04f78d928a87c1f026b560a0a4d0422415a490a5ff43af26ef7772a6f09", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221228, "uuid": "d42871a3-87a7-489f-a97c-50ae280b4784", "comment": "Malware payload", "value": "ddbaf040bd54612a00e08034b30f14984c74ad52", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221228, "uuid": "7acce45d-b854-464c-b7e1-6996888f7dee", "comment": "Malware payload", "value": "68e54c42ece11420f8a3e49f71ce4b0d34896c209c223c8a1f0f4822383fe5c30c6500fb66a51a43886d4c6c5224a940", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221228, "uuid": "7e69391a-4b67-45f4-becb-1cfa52660070", "value": "65830266E87A9CEE419DE0A2E03E3A1837FC11D3E0799787F65E3D0680379CE591442E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221228, "uuid": "55a15afd-b975-4976-8e43-32b74e0a592d", "value": "1536:RnNHeop+LU9t5t7mgV3eE7JWgtrQZcUT7oqlaHvvbFq9GHocnoe1RqfwSOJrpMEt:LrkLUj5tSCrIGUT7o/v096oiBkwPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221228, "uuid": "c842dec8-c625-4595-a6fe-de511393bfa1", "value": 86792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221228, "uuid": "050c78d1-c36b-4451-ab92-b698dffebeb3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221228, "uuid": "1f889daa-0a34-48b0-a34a-23035ba1c5d5", "value": "info-1565594.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd76eb0-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220488, "uuid": "b2656b73-c372-4cb9-92b6-c4b57828de28", "comment": "Malware payload", "value": "92b6cb2018e6e55e8ff5660ba66233c8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220488, "uuid": "fda61c4f-a13b-48c3-b7d6-5dabdc6b66a5", "comment": "Malware payload", "value": "4db640229fe1ac86ce275e6fa8d2d500008a99613b77a35d98aaed54753626b9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220488, "uuid": "523e9e80-2b9a-4428-858f-c83df28b724a", "comment": "Malware payload", "value": "f79b830436d52a76032e8326e54879a4fbb68b95", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220488, "uuid": "232d9039-4aff-408c-b9b2-7963159d2b91", "comment": "Malware payload", "value": "92be03e6a78f28aca96d1abf19ea1c359e765e0155523ee729f6ab8626f2e6d55c92fde88b7d41d2b814b757b0ed2b27", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220488, "uuid": "00022f6a-fbf4-4e21-acb6-9441511d05d7", "value": "D0831217DC6E14DCC06E46E41CB2291D94709FAD801C888971AEBBCF31E8E499EB7DE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220488, "uuid": "6e9aa9df-a6ed-4ccc-b711-d2736d5cbc55", "value": "1536:JNZhdaLgblJKa6wSp6yMvBjqqxPGLuhCWdHsh1oSFWsfEFhHqLWW:nZZJt6l3MvBjqq5OsZdHAO5hKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220488, "uuid": "8d0b1865-461b-4687-9bd9-8e0f0ad8ac42", "value": 86798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220488, "uuid": "364d386e-079b-4919-8d2e-9a47ac223f7f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220488, "uuid": "c073d517-189f-452e-b9a3-fdaa9ebaf21a", "value": "info-1190375925.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d646f963-a48e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619221895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221895, "uuid": "70dd8b42-3b2f-4695-ae35-e1f9143ac060", "comment": "Malware payload", "value": "80e194c548014d4f8e5afbcf97b8ca4c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221895, "uuid": "cbe6049b-0dcf-451f-87aa-08ff67e94d8b", "comment": "Malware payload", "value": "4dd6dbe5e56fb6dfa0bc72972fa99d7a01280731c2a4e64bb8ecc6ebac7896e9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221895, "uuid": "dc1081b9-499b-40cf-be54-4525956c17f5", "comment": "Malware payload", "value": "57add42b97def69a7c102b13c303ab6025a1f2d3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619221895, "uuid": "7a5536e9-b610-4482-b31e-c22664a48ca9", "comment": "Malware payload", "value": "3c66f0af9f7e7be63138ba3a20dbc0963bcb14543cf2380630010b2b95e6b9327ec28f0828ee9c4f226734b5785c7b75", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221895, "uuid": "c2238f55-9adc-4086-ad71-60f8306c8396", "value": "F48302B7322D0BFF904AB89B509BF5F9F155693E5D2EE510B3642D20317143E9421ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221895, "uuid": "e25ffcab-8c0e-4f79-a78e-e1e2b5afda06", "value": "1536:QHQBAV8QI/AATZvjL3+xnxv5ZUS0hhcBrasoi8vQMwdjVH6CTS:Q18QI4AZP3+9xv/UpDmrajvI76CTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619221895, "uuid": "90f8bf8a-0952-4a1b-92da-3676830ba14c", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619221895, "uuid": "7934a54d-02d4-4091-b60e-31ab0746a662", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619221895, "uuid": "e4805a6d-0f31-4649-bc92-11054f72f43e", "value": "info-1961140705.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee8b60e-a48b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619220648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220648, "uuid": "1d266a57-677f-4d36-bcc9-63e67f426fec", "comment": "Malware payload", "value": "71c7359536ec8a5cc5b28867acbb88b7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220648, "uuid": "243672d7-be90-4a33-b9ae-f53ac79927f7", "comment": "Malware payload", "value": "4dfb5cbe9ca069bd054695d6a70d9ca5687729ef35e768b955744699de23cdc8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220648, "uuid": "f16bab79-5fb0-46bc-a435-c93c53d0579a", "comment": "Malware payload", "value": "d815cc7c5b62546f3d47c18ece01fef2e3e9dd59", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619220648, "uuid": "14a60544-b30e-471d-9268-305c6832b8d3", "comment": "Malware payload", "value": "0bcd43ac9d3137a5af84ebc5cc5c189c5d106b5c1d50317d300ddf67b716cd18e38c94c212dee815fe537fd1b0197e4f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220648, "uuid": "d15f5d6f-7342-46e8-a36f-3ad3d9135032", "value": "5F8302AD1836EF1D8B09E4E222DC37A93E840073B2B453DF415E607271A6FB5B9611B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220648, "uuid": "75f14d30-43e7-4a89-b6f8-86b5f7381754", "value": "1536:IataLgbaL+q1zmW7nlTJkv9c/EWd8E//nfYRq1o+VCQHeWnsUWuopyr:IaZ++xW7nVJklMdT//gRL+VbARk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619220648, "uuid": "5b4a3af8-df29-479a-ae3c-899631f3c508", "value": 86796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619220648, "uuid": "dd315d5a-b90d-477d-a5c6-b4d5e5045c18", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619220648, "uuid": "0e219451-de09-48be-9409-a271869ac66c", "value": "info-1283029901.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321a23de-a44f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619194561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619194561, "uuid": "b05422d0-aa49-4258-a59c-1d388b90194f", "comment": "Malware payload (AgentTesla)", "value": "b106186b98eb51834726a84bf7892ed6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619194561, "uuid": "d79da575-2057-4818-bf9b-27fcd13c54bd", "comment": "Malware payload (AgentTesla)", "value": "4e19cfa6f22651da477ff949c3398fddc7dd903ea8d75eceac54b900d913ceb0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619194561, "uuid": "7dde75bc-715f-4514-9e95-3c55b3402b00", "comment": "Malware payload (AgentTesla)", "value": "68c1f10675af07f91aaeb256d705deac55b91623", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619194561, "uuid": "9e13a875-a629-4287-971e-0d2fde6d39cf", "comment": "Malware payload (AgentTesla)", "value": "990e44daaf6cadb34cfd52183a2b7fdf5130cbab41012851e304babc8442249a01026a25a7e30efa56cd1e26144570c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619194561, "uuid": "7e6e9a46-8257-4251-be9c-f27e835c2db5", "value": "A9C402361718EFE5E57EE73E6024550003F9F114E712EA4A7EF840CAA45BF864B336A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619194561, "uuid": "4bb491d5-c570-43f0-bf62-b1d815459b7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619194561, "uuid": "a23a42e3-5e51-4ec5-ad74-663426db92cd", "value": "12288:Qep0AnuTVs/wzgDjQ+ck4Ddo6GFCppAuUmwNbHMePnueQNiyhEorX:v6SuTVs5y7GFCzAu7o9nLlySoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619194561, "uuid": "2cb7b5ff-baa4-4d03-8f37-daf93d31e3c6", "value": 588288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619194561, "uuid": "76069940-8f5d-4646-a508-0fce56c3db90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619194561, "uuid": "55be78c2-ab29-473c-8afc-a7ea169ccb81", "value": "THXX_Reminder23042021B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "042d3e6c-a3f8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1619157118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157118, "uuid": "003cb6f9-57af-4857-a72d-b7c03c02f353", "comment": "Malware payload (Formbook)", "value": "15a3905abf66017b7616039f105a5fbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157118, "uuid": "2ed50fd9-d0d5-4dca-8014-8bc5c0403097", "comment": "Malware payload (Formbook)", "value": "4e34a2ac6b08b40c6d0fe8c805813524e58ae8e28104d9ddfbe8a26bc9305afd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157118, "uuid": "7583a72c-f8d1-4f04-957b-6c2ef8387a17", "comment": "Malware payload (Formbook)", "value": "d262ebd812a5c04064e1d6f7e9f72a1171726f16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619157118, "uuid": "25297a0f-e35c-4d17-8ac6-75f65046b634", "comment": "Malware payload (Formbook)", "value": "1433416a4ffaec181c40ad12bd0437a5f75b68d7a9e4855f930c0ee8d7af2ae4fa103a714f671a84f1356b46b6594476", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157118, "uuid": "a3bc8ef5-4f3a-4c4e-8d61-f820b0267848", "value": "9DF4F0A0356EA309DD6D8AB8257117F153B77D4AFB67EE9C3DE83109AB738020705A31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157118, "uuid": "d9838ac8-5746-47fa-8d06-a7aea49462d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157118, "uuid": "0967ce67-8c97-4699-95a1-5e3eddd8cc71", "value": "12288:HYeguzDVRimo263rVBFD1De7Ll7xwDr2tmTiHhU:HvgcRim8rXFx67Lxxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619157118, "uuid": "e3c00619-0010-401d-a54a-628cd8bfc2e0", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619157118, "uuid": "f09e83ec-dfa6-4156-b646-3fcf4207e610", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619157118, "uuid": "8bbbcb39-f328-4c24-be01-6c26177713ab", "value": "BCS_ECS9522019111121380024_1206_952.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c164f7e7-a486-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619218424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218424, "uuid": "3a703aff-712a-4cbc-b977-b2bc015b8a48", "comment": "Malware payload", "value": "d1ee8077013819d6449aee2d169ae9ac", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218424, "uuid": "d45b7ae9-bb85-4ad1-904a-dfe405b07bbc", "comment": "Malware payload", "value": "4ebae8e25d21c57fd5060473b7a665a2c0fb532f16476233d31674360461bc47", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218424, "uuid": "51fb888b-0f48-443a-ae8b-ae834407d0f9", "comment": "Malware payload", "value": "a4ca56529e0c39ea94f2076210632a00af732360", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619218424, "uuid": "5f79a577-ea95-4d03-a9f8-00291d07ee1a", "comment": "Malware payload", "value": "150cc5f2b3ef52062220b8c1d460ee9de8d83d8fbde0b9193c9630823e2474865c61b4c4e91587f047a5a98fe058d73b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218424, "uuid": "5ba4d6ca-3a3b-405f-8671-f6c0954055dd", "value": "E48302EE71E60C6858FDF61A1A6B7A552DF8F3A18F721736D3898536ACF11885CD0304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218424, "uuid": "bc901612-08df-4dd1-968e-9e2add3635a7", "value": "1536:BxRn2hLUf0IPct4r94hhs/9AGEiFALqCJI3+xOtGkwdO2eDiFX1:PR2h6PceEaKUFALAOxeh4ONqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619218424, "uuid": "f6b8ebed-a344-4008-9325-06799c89c58b", "value": 86935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619218424, "uuid": "3881f5b9-75e4-40ca-8392-d649031d8dee", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619218424, "uuid": "f66407f0-8cd7-4775-8b19-ea06ff811708", "value": "catalog-1494116910.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb83dff0-a484-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619217635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217635, "uuid": "bcf6f25b-d641-4124-bf95-d0fab5f94c03", "comment": "Malware payload", "value": "4404acd2bca634db69209d5b47a122c4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217635, "uuid": "81cccabd-9d77-4b7f-aeac-bed29d25d5cd", "comment": "Malware payload", "value": "4ec955be8e6c63f7fdf4e3574363858f74b55e7a56246ca5029eed57b5bef053", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217635, "uuid": "765bd018-33ca-451e-8f68-92bbddc608ff", "comment": "Malware payload", "value": "0d0bd6fc4ff618329e48e1d438aa3e1a4e08b1c8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619217635, "uuid": "bea490f9-33cb-4cda-85be-16841ca52864", "comment": "Malware payload", "value": "b4dd37060032466a188668b0e3cd20584c1f00de68ab039b2b97d16814e1a869f02eb324abc8db28eb1e3a78b7c55e1f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217635, "uuid": "969c4314-7731-4f56-adf2-80d89b176f75", "value": "708312EC74138565637345F7C97E90C32B6A8BFC442CB056682BAA3659307FFE521531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619217635, "uuid": "99c6d672-ddce-41d0-bcbd-a1b8ad8e6f79", "value": "1536:aBzKTWDE4Qll8LS4v50FC+pTUjoB8+wXdpUna5ahL2dmTLUVVvv:eeKDiKLRvaFjpTuXinakEmEVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619217635, "uuid": "171aba5b-a1df-4ccb-a256-8e6f1196634b", "value": 86934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619217635, "uuid": "ff1e590a-7093-4cdf-b121-8740690b6d06", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "